[Resolvido!]Problemas com popup cid

alebenetti · Agosto 10, 2007

Olá amigo , peço descupas como disse sou novo e por entrar atraves de site de busca ñ havia visto essas regras, conforme citei anteriormente estou com problema para remoção deste popup cid , poderiam me ajudar? Como vi q foi solicitado os logs do Hijack e ComboFix estou mandando abaixo, esses são os logs q tirei ontem , seria necessario logs de hoje ?

Logfile of HijackThis v1.99.1

Scan saved at 15:19:08, on 9/8/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Network Associates\Common Framework\FrameworkService.exe

C:\Arquivos de programas\Network Associates\VirusScan\Mcshield.exe

C:\Arquivos de programas\Network Associates\VirusScan\VsTskMgr.exe

C:\WINDOWS\system32\WgaTray.exe

C:\Arquivos de programas\Network Associates\VirusScan\SHSTAT.EXE

C:\Arquivos de programas\Network Associates\Common Framework\UpdaterUI.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Microsoft Office\Office\FINDFAST.EXE

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\explorer.exe

E:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uol.com.br/

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [shStatEXE] "C:\Arquivos de programas\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Arquivos de programas\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Windows Security Protocol] win32sprot.exe

O4 - HKCU\..\Run: [blah poll] C:\DOCUME~1\Benetti\DADOSD~1\chicpop\você Internet Atom.exe

O4 - Startup: Localização acelerada da Microsoft.lnk = C:\Arquivos de programas\Microsoft Office\Office\FINDFAST.EXE

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{03D58205-E5F1-42DA-9AF1-8E2916300AB2}: NameServer = 10.10.10.10

O17 - HKLM\System\CS1\Services\Tcpip\..\{03D58205-E5F1-42DA-9AF1-8E2916300AB2}: NameServer = 10.10.10.10

O17 - HKLM\System\CS2\Services\Tcpip\..\{03D58205-E5F1-42DA-9AF1-8E2916300AB2}: NameServer = 10.10.10.10

O17 - HKLM\System\CS3\Services\Tcpip\..\{03D58205-E5F1-42DA-9AF1-8E2916300AB2}: NameServer = 10.10.10.10

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Serviço McAfee Framework (McAfeeFramework) - Network Associates, Inc. - C:\Arquivos de programas\Network Associates\Common Framework\FrameworkService.exe

O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Arquivos de programas\Network Associates\VirusScan\Mcshield.exe

O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Arquivos de programas\Network Associates\VirusScan\VsTskMgr.exe

ComboFix 07-08-09.3 - "Benetti" 2007-08-09 15:20:11.2 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.104 [GMT -3:00]

((((((((((((((((((((((((( Files Created from 2007-07-09 to 2007-08-09 )))))))))))))))))))))))))))))))

2007-08-09 15:18 <DIR> d-------- C:\Combo fix

2007-08-09 14:16 <DIR> d-------- C:\hijack

2007-08-09 13:38 51,200 --a------ C:\WINDOWS\nircmd.exe

2007-08-03 18:47 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\else download defy scr

2007-08-03 18:45 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\scr style mp3 glue

2007-08-03 18:44 <DIR> d-------- C:\Arquivos de programas\chicpop

2007-07-31 12:54 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys

2007-07-31 12:37 <DIR> d-------- C:\Arquivos de programas\VS Revo Group

2007-07-09 18:27 <DIR> d-a------ C:\fotos

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-13 13:16 1321 --a------ C:\WINDOWS\mozver.dat

2007-06-12 16:29 --------- d-------- C:\Arquivos de programas\Windows Media Connect 2

2007-06-12 13:07 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf

2007-06-12 13:07 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf

2007-06-12 12:59 --------- d-------- C:\Arquivos de programas\Arquivos comuns\Motorola Shared

2007-05-22 15:33 216064 --a------ C:\WINDOWS\iun3405.exe

2007-05-16 12:13 86528 --------- C:\WINDOWS\system32\dllcache\directdb.dll

2007-05-16 12:13 85504 --------- C:\WINDOWS\system32\dllcache\wabimp.dll

2007-05-16 12:13 683520 --a------ C:\WINDOWS\system32\inetcomm.dll

2007-05-16 12:13 683520 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll

2007-05-16 12:13 510976 --------- C:\WINDOWS\system32\dllcache\wab32.dll

2007-05-16 12:13 1314816 --------- C:\WINDOWS\system32\dllcache\msoe.dll

2007-02-15 14:40 325519 --a------ C:\Arquivos de programas\cla.JPG

2007-02-06 14:34 361058 --a------ C:\Arquivos de programas\calii.jpg

2007-02-05 16:49 129491 --a------ C:\Arquivos de programas\DSC05956.JPG

2007-02-02 18:56 37735 --a------ C:\Arquivos de programas\cali.jpg

2007-01-09 20:45 16366 --a------ C:\Arquivos de programas\tatybtas.jpg

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ShStatEXE"="C:\Arquivos de programas\Network Associates\VirusScan\SHSTAT.exe" [2003-10-15 07:10]

"McAfeeUpdaterUI"="C:\Arquivos de programas\Network Associates\Common Framework\UpdaterUI.exe" [2003-09-10 03:11]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:45]

"Windows Security Protocol"="win32sprot.exe" []

"Blah poll"="C:\DOCUME~1\Benetti\DADOSD~1\chicpop\você Internet Atom.exe" [2007-08-03 18:43]

C:\Documents and Settings\Benetti\Menu Iniciar\Programas\Inicializar\

Localiza‡Æo acelerada da Microsoft.lnk - C:\Arquivos de programas\Microsoft Office\Office\FINDFAST.EXE [1997-01-06]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

"Authentication Packages"= msv1_0 nwprovau

R1 PQNTDrv;PQNTDrv;C:\WINDOWS\system32\drivers\PQNTDrv.sys

R2 NWCWorkstation;Serviço de cliente para NetWare;C:\WINDOWS\system32\svchost.exe -k netsvcs

R3 ati2mtaa;ati2mtaa;C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys

R3 msloop;Microsoft Loopback Adapter Driver;C:\WINDOWS\system32\DRIVERS\loop.sys

R3 NWRDR;NetWare Rdr;C:\WINDOWS\system32\DRIVERS\nwrdr.sys

R3 rtl8029;Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\RTL8029.SYS

S3 ati2mpaa;ati2mpaa;C:\WINDOWS\system32\DRIVERS\ati2mpaa.sys

S3 ATICDSDr;ATICDSDr;\??\C:\WINDOWS\TEMP\ATICDSDr.sys

S3 motmodem;Motorola USB CDC ACM Driver;C:\WINDOWS\system32\DRIVERS\motmodem.sys

S3 Wdf01000;Wdf01000;C:\WINDOWS\system32\DRIVERS\Wdf01000.sys

*Newly Created Service* - CATCHME

Contents of the 'Scheduled Tasks' folder

2007-08-09 18:00:02 C:\WINDOWS\Tasks\AFE3B07B90442733.job - c:\docume~1\benetti\dadosd~1\chicpop\lies dent bolt.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-08-09 15:21:38

Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

Completion time: 2007-08-09 15:22:45

C:\ComboFix2.txt ... 2007-08-09 13:44

--- E O F ---

por favor se puderem me ajudar.

grato

Benetti.

DigRam · Agosto 11, 2007

Bom Dia alebenetti!

>@< Faça o download do KillBox.

>@< Salve-o no Disco Local-C,em uma pasta própria < C:\Killbox.exe >.

>@< Faça o dowload do HostsXpert.

>@< Descompacte-o e mova o executável ( HostsXpert.exe ),para o Desktop.

>@< Mas,não execute-o ainda!

>@< Abra o KillBox e marque Delete on reboot.

>@< Copie os ficheiros,logo abaixo,para a área de transferência ( Full path of file to delete ).

>@< Selecione e clique em Copiar.Ou seja,estando desconectado e com estas instruções salvas,voçê copiará os ficheiros para o Bloco de Notas e,dêste,para a área de transferência no KillBox.

C:\DOCUME~1\Benetti\DADOS~1\chicpop\lies dent bolt.exe

C:\DOCUME~1\Benetti\DADOSD~1\chicpop\você Internet Atom.exe

C:\WINDOWS\Tasks\AFE3B07B90442733.job

>@< Volte ao KillBox e clique em File >> Past from clipboard >> All files.

>@< Clique no botão X e,na pergunta sobre o Reboot,diga Não!

>@< Reinicie o computador e entre em Modo de Segurança.

>@< Durante a reinicialização aperte,intermitentemente,a tecla F8 ou F5 e,no Menu que surgir escolha:Modo Seguro ou de Segurança.

>@< Abra o HijackThis e clique em Do a system scan only e marque as entradas,logo abaixo:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKCU\..\Run: [Windows Security Protocol] win32sprot.exe

O4 - HKCU\..\Run: [blah poll] C:\DOCUME~1\Benetti\DADOSD~1\chicpop\você Internet Atom.exe

>@< Finalize-as,clicando em Fix checked!

>@< Ainda em Modo Seguro,execute o HostsXpert.exe,com um duplo clique no seu ícone.

>@< Clique em Restore Microsoft's Hosts file >> Ok.

>@< Finalize o programa!

>@< Faça uma busca ao arquivo: < win32sprot.exe > << Encontrando-o,pode deletar!

>@< Reinicie,normalmente,o computador!

>@< Faça e poste um nôvo Log,do HijackThis,na sua resposta.

Abraços!

alebenetti · Agosto 17, 2007

Olá amigo agradeço a resposta ,s egui os passos q citou e apos reiniciei e executei o hijackthis segue abaixo o log:

Logfile of HijackThis v1.99.1

Scan saved at 13:37:49, on 17/8/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Network Associates\Common Framework\FrameworkService.exe

C:\Arquivos de programas\Network Associates\VirusScan\Mcshield.exe

C:\Arquivos de programas\Network Associates\VirusScan\VsTskMgr.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\WgaTray.exe

C:\Arquivos de programas\Network Associates\VirusScan\SHSTAT.EXE

C:\Arquivos de programas\Network Associates\Common Framework\UpdaterUI.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Microsoft Office\Office\FINDFAST.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe