[Arquivado] pc infectado

[Armando Leitão 0]

Ola pessoal fiz uma scaneamento pelo Antivir num pc que não tinha an-tivirus pegou 20 virus, Orkut não quer mais abrir veja a foto que apresenta quando pede para abrir o orkut:

 

 

 

 

ComboFix 08-04-04.1 - Samuel 2008-04-05 17:54:26.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.135 [GMT -3:00]

Executando de: C:\Documents and Settings\Samuel\Desktop\ComboFix.exe

* Criado um novo ponto de restauro

 

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

 

((((((((((((((((((((((( Ficheiros criados de 2008-03-05 to 2008-04-05 ))))))))))))))))))))))))))))))))

.

 

2008-04-04 11:51 . 2008-04-04 11:51 <DIR> d-------- C:\Arquivos de programas\Windows Media Connect 2

2008-04-04 11:49 . 2008-04-04 11:49 <DIR> d-------- C:\WINDOWS\system32\LogFiles

2008-04-04 11:49 . 2008-04-04 11:50 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF

2008-04-04 11:49 . 2008-04-05 09:08 1,355 --a------ C:\WINDOWS\imsins.BAK

2008-04-04 11:39 . 2008-04-04 11:39 <DIR> d-------- C:\Arquivos de programas\CCleaner

2008-04-04 10:38 . 2008-04-04 10:38 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Avira

2008-04-04 10:38 . 2008-04-04 10:38 <DIR> d-------- C:\Arquivos de programas\Avira

2008-04-02 10:54 . 2008-04-02 10:54 98,343 --a------ C:\WINDOWS\hpqins16.dat

2008-03-23 21:18 . 2008-03-23 21:18 268 --ah----- C:\sqmdata00.sqm

2008-03-23 21:18 . 2008-03-23 21:18 244 --ah----- C:\sqmnoopt00.sqm

2008-03-16 09:12 . 2008-03-16 09:12 <DIR> d---s---- C:\Documents and Settings\Samuel\Abn.gpc, Cef.gpc, gbieh.gmd, gbiehuni.dll , GBIEHCEF.DLL , gbiehabn.dll, gbpdist.dll', PChar('Abn.gpc, Cef.gpc, gbieh.gmd, gbiehuni.dll , GBIEHCEF.DLL , gbiehabn.dll, gbpdist.dll

2008-03-15 16:44 . 2008-03-30 12:19 1,651 --a------ C:\WINDOWS\system32\msnprint.dll

2008-03-09 18:12 . 2008-03-24 16:02 151 --a------ C:\WINDOWS\PhotoSnapViewer.INI

2008-03-08 17:47 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll

2008-03-08 17:47 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll

2008-03-08 17:47 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui

2008-03-07 22:57 . 2008-04-05 07:18 <DIR> d-------- C:\Documents and Settings\Samuel\Contacts

2008-03-07 20:41 . 2008-03-07 20:41 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Windows Live Toolbar

2008-03-07 20:18 . 2008-03-07 20:18 <DIR> d-------- C:\Arquivos de programas\Windows Live Toolbar

2008-03-07 20:03 . 2008-03-07 20:03 <DIR> d-------- C:\Documents and Settings\Samuel\Dados de aplicativos\MSN Search Toolbar

2008-03-07 20:00 . 2008-03-07 20:00 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\MSN Search Toolbar

2008-03-07 19:01 . 2008-03-07 22:51 <DIR> d--hsc--- C:\Arquivos de programas\Arquivos comuns\WindowsLiveInstaller

2008-03-07 19:00 . 2008-03-07 22:51 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\WLInstaller

2008-03-07 19:00 . 2008-03-07 22:52 <DIR> d-------- C:\Arquivos de programas\Windows Live

2008-03-05 13:42 . 2008-03-05 13:42 <DIR> d-------- C:\Arquivos de programas\MSXML 4.0

 

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-04-02 13:54 --------- d-----w C:\Arquivos de programas\HP

2008-03-25 17:46 --------- d-----w C:\Documents and Settings\Samuel\Dados de aplicativos\Image Zone Express

2008-03-01 21:27 --------- d-----w C:\Documents and Settings\Samuel\Dados de aplicativos\Printer Info Cache

2008-03-01 21:24 --------- d-----w C:\Documents and Settings\Samuel\Dados de aplicativos\HP

2008-03-01 21:23 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\WEBREG

2008-03-01 21:22 --------- d-----w C:\Arquivos de programas\Arquivos comuns\HP

2008-03-01 21:21 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\HP

2008-03-01 21:20 --------- d-----w C:\Arquivos de programas\Hewlett-Packard

2008-03-01 21:20 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Hewlett-Packard

2008-03-01 21:19 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Hewlett-Packard

2008-03-01 19:37 21,275 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys

2008-03-01 19:37 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information

2008-03-01 19:37 --------- d-----w C:\Arquivos de programas\GREATEK

2008-02-12 12:40 --------- d-----w C:\Documents and Settings\Samuel\Dados de aplicativos\Ahead

2008-02-12 12:27 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Ahead

2008-02-12 12:27 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Ahead

2008-02-12 12:25 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Nero

2008-02-12 12:25 --------- d-----w C:\Arquivos de programas\Nero

2008-02-04 00:52 15,600 ----a-w C:\WINDOWS\gdrv.sys

.

 

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

REGEDIT4

*Nota* entradas vazias & legítimas por defeito não são mostradas.

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45 15360]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 10:21 153136]

"MsnMsgr"="C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SMSERIAL"="sm56hlpr.exe" [2005-07-05 17:47 544768 C:\WINDOWS\sm56hlpr.exe]

"VTTimer"="VTTimer.exe" [2006-09-21 05:36 53248 C:\WINDOWS\system32\VTTimer.exe]

"S3Trayp"="S3trayp.exe" [2007-02-05 20:30 176128 C:\WINDOWS\system32\S3Trayp.exe]

"HDAudDeck"="C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe" [2007-05-11 04:47 790528]

"NeroFilterCheck"="C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]

"GTKCU"="C:\Arquivos de programas\GREATEK\GTKCU\GTKCU.exe" [2006-12-18 14:09 315392]

"HP Software Update"="C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 21:52 49152]

"avgnt"="C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-04 11:02 249896]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:45 15360]

 

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\

HP Digital Imaging Monitor.lnk - C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 21:40:10 210520]

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Arquivos de programas\\Messenger\\msmsgs.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=

 

R0 ViBus;ViBus;C:\WINDOWS\system32\DRIVERS\ViBus.sys [2007-03-26 04:26]

R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2007-03-29 00:36]

R0 ViPrt;VIA SATA IDE Device Driver;C:\WINDOWS\system32\DRIVERS\ViPrt.sys [2007-03-26 04:26]

R3 S3GIGP;S3GIGP;C:\WINDOWS\system32\DRIVERS\S3gIGPm.sys [2007-03-04 22:54]

S3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2007-04-17 00:58]

S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2008-02-03 21:52]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

 

.

Conteúdo da pasta 'Tarefas Agendadas'

"2008-04-05 15:14:05 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"

- C:\Arquivos de programas\Windows Live Toolbar\MSNTBUP.EXE

.

**************************************************************************

 

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-04-05 17:55:49

Windows 5.1.2600 Service Pack 2 NTFS

 

Procurando processos ocultos ...

 

Procurando entradas auto inicializáveis ocultas ...

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

HDAudDeck = C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????????????

 

Procurando ficheiros ocultos ...

 

Varredura completada com sucesso

Ficheiros ocultos: 0

 

**************************************************************************

.

Tempo para conclusão: 2008-04-05 17:56:34

ComboFix-quarantined-files.txt 2008-04-05 20:56:09

Pre-Run: 153,316,528,128 bytes disponíveis

Post-Run: 153,309,016,064 bytes disponíveis

.

2008-04-04 22:13:48 --- E O F ---

 

 

 

 

Logfile of HijackThis v1.99.1

Scan saved at 18:06:06, on 5/4/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\acs.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\WINDOWS\sm56hlpr.exe

C:\WINDOWS\system32\VTTimer.exe

C:\WINDOWS\system32\S3trayp.exe

C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe

C:\Arquivos de programas\GREATEK\GTKCU\GTKCU.exe

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe

C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe

C:\HijackThis.exe

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://br.yahoo.com

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Arquivos de programas\HP\Smart Web Printing\SmartWebPrinting.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\Windows Live Toolbar\msntb.dll

O4 - HKLM\..\Run: [sMSERIAL] sm56hlpr.exe

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [s3Trayp] S3trayp.exe

O4 - HKLM\..\Run: [HDAudDeck] C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe 1

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [GTKCU] "C:\Arquivos de programas\GREATEK\GTKCU\GTKCU.exe" -nogui

O4 - HKLM\..\Run: [HP Software Update] C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: &MSN Search - res://C:\Arquivos de programas\MSN Toolbar Suite\TB\02.05.0001.1119\en-us\msntb.dll/search.htm

O8 - Extra context menu item: &Windows Live Search - res://C:\Arquivos de programas\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Open in new background tab - res://C:\Arquivos de programas\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/229?3c741f6dc9ed455a837358d4e7dd7dd

O8 - Extra context menu item: Open in new foreground tab - res://C:\Arquivos de programas\MSN Toolbar Suite\TAB\02.05.0001.1119\en-us\msntabres.dll/230?3c741f6dc9ed455a837358d4e7dd7dd

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: GREATEK Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

[jgarcia 1]

Opa Armando Leitão,

 

Poste um novo log do ComboFix.

 

Abraços.

[Mário Monteiro 179]

Tópico Arquivado

 

Como o autor não respondeu por mais de 20 dias, o tópico foi arquivado.

 

Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura.