[Resolvido!]Pc muito estranho, log.

RAT_GTR · Novembro 27, 2007

Boa noite pessoal!

Segue o log do HT, meu pc tá muito estranho, acho que está com algum malware...

Ele trava toda hora, além de estar muito lento (não era para estar lento assim).

Logfile of HijackThis v1.99.1

Scan saved at 21:28:43, on 27/11/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Ahead\InCD\InCDsrv.exe

C:\Arquivos de programas\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe

C:\Arquivos de programas\Java\jre1.6.0_03\bin\jusched.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\ARQUIV~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe

C:\WINDOWS\NCLAUNCH.EXe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Delux\PS2 Keyboard English Edition 2.0\kb_2k.exe

C:\WINDOWS\system32\sistray.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\WINDOWS\system32\tcpsvcs.exe

C:\WINDOWS\System32\snmp.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\eMule\emule.exe

C:\Arquivos de programas\MSN Messenger\msnmsgr.exe

C:\Arquivos de programas\MSN Messenger\usnsvc.exe

C:\Arquivos de programas\Windows Media Player\wmplayer.exe

C:\hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uol.com.br/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [siSPower] Rundll32.exe SiSPower.dll,ModeAgent

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [areslite] "D:\Ares Lite Edition\AresLite.exe" -h

O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\ARQUIV~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe

O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe

O4 - HKCU\..\Run: [EPSON Stylus CX5600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAL.EXE /FU "C:\DOCUME~1\Neri\CONFIG~1\Temp\E_S1E.tmp" /EF "HKCU"

O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\acstart17.exe

O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE

O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: PS2 Keyboard English Edition 2.0.lnk = ?

O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/PT-BR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Arquivos de programas\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - D:\Ares\chatServer.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Arquivos de programas\Ahead\InCD\InCDsrv.exe

O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Arquivos de programas\Ahead\InCD\InCDsrv.exe

Caso alguém possa ajudar, ficaria muito agradecido.

Valeu!

jgarcia · Dezembro 2, 2007

Opa RAT_GTR,

Baixe o ComboFix em:

ComboFix

1) Desabilite o seu anti-vírus temporariamente;

2) Dê um duplo-clique no combofix.exe e tecle "1" para prosseguir. O processo vai durar, em média, 10 minutos;

3) O ComboFix reiniciará o PC automaticamente, a fim de que o processo de remoção seja finalizado (somente se houver infecção);

4) Quando a varredura acabar, será gerado um log, que estará em C:\ComboFix.txt;

5) Não clique na janela do ComboFix, nem feche clicando no X, enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco);

6) Para parar ou sair do ComboFix, tecle "N";

7) Reabilite o seu anti-vírus;

8) Preciso que você cole o conteúdo do ComboFix.txt em sua próxima resposta, juntamente com um novo log do HijackThis.

Abraços.

RAT_GTR · Dezembro 2, 2007

Ok, segue o log do ComboFix:

ComboFix 07-12-02.5 - Neri 2007-12-02 16:44:04.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.71 [GMT -2:00]

Executando de: D:\Shared\ComboFix.exe

* Criado um novo ponto de restauro

.

((((((((((((((((((((((((((((((((((((( Outras Exclusäes )))))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\WINDOWS\msvrc20.dll

C:\WINDOWS\system32\Cache

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\LEGACY_IPRIP

-------\LEGACY_PERFORMANCE_MONITOR

-------\Iprip

((((((((((((((((((((((( Ficheiros criados de 2007-11-02 to 2007-12-02 ))))))))))))))))))))))))))))))))

.

2007-11-28 15:39 . 2007-11-28 15:43 <DIR> d-------- C:\Arquivos de programas\Valve

2007-11-15 19:36 . 2007-11-15 19:37 <DIR> d-------- C:\Arquivos de programas\SiS VGA Utilities V3.78

2007-11-15 19:25 . 2007-11-15 19:25 <DIR> d-------- C:\Arquivos de programas\directx

2007-11-15 19:21 . 2007-11-15 19:28 <DIR> d-------- C:\Arquivos de programas\Railthree

2007-11-15 19:13 . 2007-11-15 19:17 <DIR> d-------- C:\Arquivos de programas\Rail

2007-11-15 15:18 . 2007-11-15 15:18 <DIR> d-------- C:\DX

2007-11-11 15:28 . 2007-11-11 15:28 <DIR> d-------- C:\WINDOWS\system32\trayres

2007-11-11 12:20 . 2007-11-30 15:34 54,156 --ah----- C:\WINDOWS\QTFont.qfn

2007-11-11 12:20 . 2007-11-11 12:20 1,409 --a------ C:\WINDOWS\QTFont.for

2007-11-07 22:23 . 2007-11-07 22:23 <DIR> d-------- C:\Arquivos de programas\QuickTime

2007-11-04 17:19 . 2007-12-02 16:41 <DIR> d-------- C:\Incompletos

2007-11-02 18:06 . 2007-04-05 01:00 169,328 --a------ C:\WINDOWS\system32\everest_cpl.cpl

2007-11-02 18:06 . 2007-11-19 19:18 30 --a------ C:\WINDOWS\system32\everest_cpl.ini

.

((((((((((((((((((((((((((((((((((((( Relat¢rio Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-12-02 17:45 --------- d-----w C:\Arquivos de programas\eMule

2007-11-28 17:39 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information

2007-11-26 18:34 --------- d-----w C:\Arquivos de programas\Google

2007-11-14 22:50 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Adobe

2007-11-11 17:29 --------- d-----w C:\Arquivos de programas\sisagp

2007-11-08 00:23 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Apple Computer

2007-11-06 00:26 --------- d-----w C:\Arquivos de programas\ABBYY FineReader 6.0 Sprint

2007-11-01 01:08 --------- d-----w C:\Documents and Settings\Neri\Dados de aplicativos\U3

2007-10-30 20:48 --------- d-----w C:\Arquivos de programas\Triumph Studios

2007-10-28 20:32 --------- d-----w C:\Arquivos de programas\NWN

2007-10-25 22:09 --------- d-----w C:\Arquivos de programas\FLV Player

2007-10-23 02:25 --------- d-----w C:\Arquivos de programas\Guitar Pro 5

2007-10-22 21:59 12,464 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys

2007-10-22 21:49 --------- d-----w C:\Arquivos de programas\Arquivos comuns\InstallShield

2007-10-22 21:39 --------- d-----w C:\Arquivos de programas\AP Tuner

2007-10-22 21:38 --------- d-----w C:\Arquivos de programas\Macromedia

2007-10-22 21:38 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Macromedia

2007-10-22 21:21 --------- d-----w C:\Arquivos de programas\SystemRequirementsLab

2007-10-22 19:28 --------- d-----w C:\Arquivos de programas\Lavasoft

2007-10-22 19:27 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Lavasoft

2007-10-22 19:26 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Wise Installation Wizard

2007-10-19 18:31 5,286,138 ----a-w C:\Documents and Settings\Neri\GL.zip

2007-10-17 21:07 --------- d-----w C:\Arquivos de programas\MSXML 4.0

2007-10-17 19:03 --------- d-----w C:\Documents and Settings\Neri\Dados de aplicativos\Microsoft Games

2007-10-15 15:40 --------- d-----w C:\Arquivos de programas\Java

2007-10-08 01:10 --------- d-----w C:\Documents and Settings\Neri\Dados de aplicativos\AdobeUM

2007-10-07 19:42 --------- d-----w C:\Arquivos de programas\PDF Acrobat Abobe Writer

2007-07-11 22:49 8 ----a-w C:\Documents and Settings\All Users\Dados de aplicativos\SDGLYBMPWPP.SYS

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias & leg¡timas por defeito nÆo sÆo mostradas.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:45]

"areslite"="D:\Ares Lite Edition\AresLite.exe" []

"PhotoShow Deluxe Media Manager"="C:\ARQUIV~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe" [2005-02-25 22:28]

"NCLaunch"="C:\WINDOWS\NCLAUNCH.EXe" [2007-07-07 15:13]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avast!"="C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 08:06]

"RemoteControl"="C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50]

"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11]

"NWEReboot"="" []

"TkBellExe"="C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" [2007-09-18 23:10]

"SoundMan"="SOUNDMAN.EXE" [2003-08-15 16:34 C:\WINDOWS\soundman.exe]

"QuickTime Task"="C:\Arquivos de programas\QuickTime\QTTask.exe" [2007-10-19 20:16]

"Adobe Reader Speed Launcher"="C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]

"SiSPower"="Rundll32.exe" [2004-08-04 01:45 C:\WINDOWS\system32\rundll32.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 01:45]

"EPSON Stylus CX5600 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAL.exe" [2007-01-25 04:00]

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\

AutoCAD Startup Accelerator.lnk - C:\Arquivos de programas\Arquivos comuns\Autodesk Shared\acstart17.exe [2006-03-05 05:43:54]

EPSON Status Monitor 3 Environment Check.lnk - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE [2007-07-11 13:56:11]

Microsoft Office.lnk - C:\Arquivos de programas\Microsoft Office\Office\OSA9.EXE [1999-02-17 16:05:56]

PS2 Keyboard English Edition 2.0.lnk - C:\Arquivos de programas\Delux\PS2 Keyboard English Edition 2.0\kb_2k.exe [2007-07-02 23:10:29]

Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2007-11-15 19:37:11]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveSearch"= 1 (0x1)

R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\System32\inetsrv\inetinfo.exe

S3 p2pgasvc;Autenticação de grupo de rede ponto-a-ponto;C:\WINDOWS\system32\svchost.exe -k p2psvc

S3 p2pimsvc;Gerenciador de identidades ponto-a-ponto da Microsoft;C:\WINDOWS\system32\svchost.exe -k p2psvc

S3 p2psvc;Configuração de rede ponto-a-ponto;C:\WINDOWS\system32\svchost.exe -k p2psvc

S3 PNRPSvc;Protocolo de resolução de nomes ponto-a-ponto;C:\WINDOWS\system32\svchost.exe -k p2psvc

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

p2psvc p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]

\Shell\AutoRun\command - J:\LaunchU3.exe -a

.

Conte£do da pasta 'Tarefas Agendadas'

"2007-11-28 23:44:07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"

- C:\Arquivos de programas\Apple Software Update\SoftwareUpdate.exe

.

**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-12-02 16:47:51

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializ veis ocultas ...

Procurando ficheiros ocultos ...

Varredura completada com sucesso

Ficheiros ocultos: 0

**************************************************************************

.

Tempo para conclusÆo: 2007-12-02 16:49:27 - machine was rebooted

.

--- E O F ---

/\/\/\/\/\//\/\/\/\/\/\/\//\/\//\\/\/\/\//\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\//\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/

E agora o log do HijackThis:

Logfile of HijackThis v1.99.1

Scan saved at 16:54:53, on 2/12/2007