Edvan 30 Denunciar post Postado Setembro 22, 2008 Maquina do meu TIO... BankerFix 3.0 VALKYRIE {beta} - Removedor de Bankers Linha Defensiva | http://www.linhadefensiva.org http://www.linhadefensiva.org/bankerfix/ ------------------------------------------------------- Data: 2008-09-22 - 19:02 ------------------------------------------------------- Lista de Definição: 2008-09-15-1 | CORE: 2008-09-07-1 ======================================================= Arquivo infectado detectado: C:\WINDOWS\ponto.dll Arquivo infectado removido com sucesso! Arquivo infectado detectado: C:\WINDOWS\Prefetch\orkutkut.dll Arquivo infectado removido com sucesso! Arquivo infectado detectado: C:\WINDOWS\system32\MEGATRON.ini Arquivo infectado removido com sucesso! ----- Fim ------------------------- ComboFix 08-09-20.05 - Usuário 2008-09-22 19:05:28.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.1037 [GMT -3:00] Executando de: C:\Documents and Settings\Usuário\Desktop\ComboFix.exe * Criado um novo ponto de restauro ATENÇAO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !! . ADS - system32: deleted 0 bytes in 1 streams. ADS - WINDOWS: deleted 0 bytes in 1 streams. ((((((((((((((((((((((((((((((((((((( Outras Exclusäes ))))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Usuário\Abn.gpc, Cef.gpc, gbieh.gmd, gbiehuni.dll , GBIEHCEF.DLL , gbiehabn.dll, gbpdist.dll', PChar('Abn.gpc, Cef.gpc, gbieh.gmd, gbiehuni.dll , GBIEHCEF.DLL , gbiehabn.dll, gbpdist.dll\desktop.ini C:\WINDOWS\system32\amvo.exe C:\WINDOWS\system32\msnav32.ax C:\WINDOWS\system32\winpfz33.sys C:\WINDOWS\system32\zxdnt3d.cfg . ((((((((((((((((((((((( Ficheiros criados de 2008-08-22 to 2008-09-22 )))))))))))))))))))))))))))))))) . 2008-09-22 19:02 . 2008-09-22 19:03 <DIR> d-------- C:\LinhaDefensiva 2008-09-09 17:35 . 2003-07-29 16:08 1,706,800 --a------ C:\WINDOWS\system32\gdiplus.dll 2008-09-09 17:35 . 2005-07-13 14:39 77,824 --a------ C:\WINDOWS\system32\CameraType.dll 2008-09-09 17:35 . 2003-06-11 16:49 49,152 --a------ C:\WINDOWS\system32\ZeniVideoSdk.dll 2008-08-28 19:01 . 2008-02-06 15:14 260,992 -ra------ C:\WINDOWS\system32\drivers\sembbus.sys 2008-08-28 19:01 . 2008-02-06 15:16 12,160 -ra------ C:\WINDOWS\system32\drivers\sembwhnt.sys 2008-08-28 19:01 . 2008-02-06 15:16 12,160 -ra------ C:\WINDOWS\system32\drivers\sembwh.sys 2008-08-28 19:00 . 2008-08-28 19:01 <DIR> d-------- C:\Arquivos de programas\Sony Ericsson 2008-08-28 15:12 . 2008-08-28 15:12 268 --ah----- C:\sqmdata06.sqm 2008-08-28 15:12 . 2008-08-28 15:12 244 --ah----- C:\sqmnoopt06.sqm 2008-08-28 14:03 . 2008-08-28 14:03 268 --ah----- C:\sqmdata05.sqm 2008-08-28 14:03 . 2008-08-28 14:03 244 --ah----- C:\sqmnoopt05.sqm . ((((((((((((((((((((((((((((((((((((( Relat¢rio Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-18 22:31 --------- d-----w C:\Arquivos de programas\eMule 2008-09-09 20:36 --------- d-----w C:\Arquivos de programas\EZ-XDVR BX 2008-09-09 20:35 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information 2008-08-21 22:43 --------- d-----w C:\Arquivos de programas\Zapu 2008-07-29 17:16 --------- d-----w C:\Arquivos de programas\torrent_search 2008-07-29 01:49 --------- d-----w C:\Arquivos de programas\CyberLink DVD Solution 2008-07-28 21:16 --------- d-----w C:\Arquivos de programas\Conduit 2008-07-28 21:16 --------- d-----w C:\Arquivos de programas\BitTorrent Fastest Tool 2008-05-09 15:26 664,829 ----a-w C:\Arquivos de programas\MobAmrCon14-setup.zip 2004-03-11 15:27 40,960 ----a-w C:\Arquivos de programas\Uninstall_CDS.exe . (((((((((((((((((((((((((( Pontos de Carregamento do Registro ))))))))))))))))))))))))))))))))))))))) . . *Nota* entradas vazias & leg¡timas por defeito nÆo sÆo mostradas. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45 15360] "updateMgr"="C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RemoteControl"="C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2003-12-08 16:35 32768] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648] "SMSERIAL"="C:\WINDOWS\sm56hlpr.exe" [2006-04-05 06:36 565248] "HDAudDeck"="C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe" [2007-05-11 04:47 790528] "Lexmark 1200 Series"="C:\Arquivos de programas\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 02:34 57344] "VTTimer"="VTTimer.exe" [2006-09-21 05:36 53248 C:\WINDOWS\system32\VTTimer.exe] "S3Trayp"="S3trayp.exe" [2007-02-06 07:30 176128 C:\WINDOWS\system32\S3Trayp.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:45 15360] C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\ Adobe Reader Speed Launch.lnk - C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696] WinZip Quick Pick.lnk - C:\Arquivos de programas\WinZip\WZQKPICK.EXE [2007-11-29 13:57:26 118784] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.X264"= x264vfw.dll "vidc.hfyu"= huffyuv.dll "msacm.divxa32"= DivXa32.acm "msacm.l3codec"= l3codecp.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Arquivos de programas\\eMule\\emule.exe"= "C:\\Arquivos de programas\\EZ-XDVR BX\\EZXDVRBXServer.exe"= "C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"= "C:\\Arquivos de programas\\Messenger\\msmsgs.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 11:35 78416] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 11:37 20560] R3 S3GIGP;S3GIGP;C:\WINDOWS\system32\DRIVERS\S3gIGPm.sys [2007-03-05 09:54 709632] R3 WJ430A;WJ430A Audio Capture Device Ver3.0;C:\WINDOWS\system32\Drivers\WJ430A.sys [2004-09-22 06:13 9344] R3 WJ430V;WJ430V Video Capture Device Ver3.0;C:\WINDOWS\system32\Drivers\WJ430V.sys [2004-09-22 06:13 24576] S2 ShellHWDetection_Untrusted_BZ;Detecção do hardware do shell_Untrusted_BZ;C:\Virtual\Untrusted\C_\WINDOWS\System32\svchost.exe [2004-08-04 00:45 14336] S2 StiSvc_Untrusted_BZ;Assistente de aquisição de imagens do Windows (WIA)_Untrusted_BZ;C:\Virtual\Untrusted\C_\WINDOWS\system32\svchost.exe [2004-08-04 00:45 14336] S3 GoogleDesktopManager_Untrusted_BZ;GoogleDesktopManager;C:\Virtual\Untrusted\C_\Arquivos de programas\Google\Google Desktop Search\GoogleDesktop.exe [2008-05-31 10:40 1862144] S3 gusvc_Untrusted_BZ;Google Updater Service;C:\Virtual\Untrusted\C_\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-31 10:40 138168] S3 MSIServer_Untrusted_BZ;Windows Installer_Untrusted_BZ;C:\Virtual\Untrusted\C_\WINDOWS\system32\msiexec.exe [2005-05-04 13:45 78848] S3 sembbus;SEMC WMC Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\sembbus.sys [2008-02-06 15:14 260992] S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 09:42 61504] S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 09:42 9328] S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 09:42 97056] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{219447f9-4d56-11dd-85e3-001d7d80e90e}] \Shell\AutoRun\command - mnl6on3.com \Shell\explore\Command - mnl6on3.com \Shell\open\Command - mnl6on3.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c56837a-1ebd-11dd-8509-001d7d80e90e}] \Shell\Auto\command - auto.exe \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe \Shell\explore\Command - d6fagcs8.cmd \Shell\open\Command - d6fagcs8.cmd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b9100e34-a417-11dc-8307-001d7d80e90e}] \Shell\Auto\command - MicrosoftPowerPoint.exe \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MicrosoftPowerPoint.exe . . ------- Ccan Suplementar ------- . R0 -: HKCU-Main,Start Page = hxxp://www.google.com.br/ O8 -: E&xportar para o Microsoft Excel - C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 . OBS: Depois que passei as ferramentas está aí o log.. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:49, on 2008-09-22 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16705) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\WINDOWS\sm56hlpr.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\S3trayp.exe C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe C:\Arquivos de programas\Lexmark 1200 Series\lxczbmgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Arquivos de programas\WinZip\WZQKPICK.EXE C:\Arquivos de programas\Lexmark 1200 Series\lxczbmon.exe C:\WINDOWS\system32\svchost.exe C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe C:\Arquivos de programas\Internet Explorer\iexplore.exe C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Arquivos de programas\Windows Live\Messenger\usnsvc.exe C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\AcroRd32.exe C:\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Arquivos de programas\Share_Accelerator_MM\tbSha1.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Arquivos de programas\Share_Accelerator_MM\tbSha1.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Arquivos de programas\Share_Accelerator_MM\tbSha1.dll O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [sMSERIAL] C:\WINDOWS\sm56hlpr.exe O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [s3Trayp] S3trayp.exe O4 - HKLM\..\Run: [HDAudDeck] C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe 1 O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Arquivos de programas\Lexmark 1200 Series\lxczbmgr.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [updateMgr] C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Arquivos de programas\WinZip\WZQKPICK.EXE O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe O23 - Service: GoogleDesktopManager (GoogleDesktopManager_Untrusted_BZ) - Google - C:\Virtual\Untrusted\C_\Arquivos de programas\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc_Untrusted_BZ) - Google - C:\Virtual\Untrusted\C_\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE -- End of file - 5995 bytes Compartilhar este post Link para o post Compartilhar em outros sites
Silas Martins 0 Denunciar post Postado Setembro 23, 2008 Baixe o Malwarebytes Anti-Malware * Inicie a instalação clique em "mbam-setup.exe"; * Marque "Atualizar Malwarebytes Anti-Malware" e "Executar Malwarebytes Anti-Malware", e clique em concluir. * Marque "Verificação Rápida" e depois clique em Verificar. * Quando o scan terminar, clique em Ok e em "Mostrar Resultados" para ver o log; * Se algo for detectado, veja se tudo está marcado e clique em "Remover"; * O log é automaticamente gravado e pode ser consultado clicando em "Logs" do menu principal; * Copie e cole esse log, juntamente com o novo log do hijacktihis . Aguado o retorno. Compartilhar este post Link para o post Compartilhar em outros sites
jgarcia 1 Denunciar post Postado Outubro 20, 2008 Tópico Arquivado Como o autor não respondeu por mais de 30 dias, o tópico foi arquivado. Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura. Compartilhar este post Link para o post Compartilhar em outros sites