[Arquivado] pc infectado

[Edvan 30]

Maquina do meu TIO...

 

BankerFix 3.0 VALKYRIE {beta} - Removedor de Bankers

Linha Defensiva | http://www.linhadefensiva.org

http://www.linhadefensiva.org/bankerfix/

-------------------------------------------------------

Data: 2008-09-22 - 19:02

-------------------------------------------------------

Lista de Definição: 2008-09-15-1 | CORE: 2008-09-07-1

=======================================================

 

Arquivo infectado detectado: C:\WINDOWS\ponto.dll

Arquivo infectado removido com sucesso!

 

Arquivo infectado detectado: C:\WINDOWS\Prefetch\orkutkut.dll

Arquivo infectado removido com sucesso!

 

Arquivo infectado detectado: C:\WINDOWS\system32\MEGATRON.ini

Arquivo infectado removido com sucesso!

 

 

 

----- Fim -------------------------

 

 

 

 

ComboFix 08-09-20.05 - Usuário 2008-09-22 19:05:28.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.1037 [GMT -3:00]

Executando de: C:\Documents and Settings\Usuário\Desktop\ComboFix.exe

* Criado um novo ponto de restauro

 

ATENÇAO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!

.

ADS - system32: deleted 0 bytes in 1 streams.

ADS - WINDOWS: deleted 0 bytes in 1 streams.

 

((((((((((((((((((((((((((((((((((((( Outras Exclusäes )))))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\Documents and Settings\Usuário\Abn.gpc, Cef.gpc, gbieh.gmd, gbiehuni.dll , GBIEHCEF.DLL , gbiehabn.dll, gbpdist.dll', PChar('Abn.gpc, Cef.gpc, gbieh.gmd, gbiehuni.dll , GBIEHCEF.DLL , gbiehabn.dll, gbpdist.dll\desktop.ini

C:\WINDOWS\system32\amvo.exe

C:\WINDOWS\system32\msnav32.ax

C:\WINDOWS\system32\winpfz33.sys

C:\WINDOWS\system32\zxdnt3d.cfg

 

.

((((((((((((((((((((((( Ficheiros criados de 2008-08-22 to 2008-09-22 ))))))))))))))))))))))))))))))))

.

 

2008-09-22 19:02 . 2008-09-22 19:03 <DIR> d-------- C:\LinhaDefensiva

2008-09-09 17:35 . 2003-07-29 16:08 1,706,800 --a------ C:\WINDOWS\system32\gdiplus.dll

2008-09-09 17:35 . 2005-07-13 14:39 77,824 --a------ C:\WINDOWS\system32\CameraType.dll

2008-09-09 17:35 . 2003-06-11 16:49 49,152 --a------ C:\WINDOWS\system32\ZeniVideoSdk.dll

2008-08-28 19:01 . 2008-02-06 15:14 260,992 -ra------ C:\WINDOWS\system32\drivers\sembbus.sys

2008-08-28 19:01 . 2008-02-06 15:16 12,160 -ra------ C:\WINDOWS\system32\drivers\sembwhnt.sys

2008-08-28 19:01 . 2008-02-06 15:16 12,160 -ra------ C:\WINDOWS\system32\drivers\sembwh.sys

2008-08-28 19:00 . 2008-08-28 19:01 <DIR> d-------- C:\Arquivos de programas\Sony Ericsson

2008-08-28 15:12 . 2008-08-28 15:12 268 --ah----- C:\sqmdata06.sqm

2008-08-28 15:12 . 2008-08-28 15:12 244 --ah----- C:\sqmnoopt06.sqm

2008-08-28 14:03 . 2008-08-28 14:03 268 --ah----- C:\sqmdata05.sqm

2008-08-28 14:03 . 2008-08-28 14:03 244 --ah----- C:\sqmnoopt05.sqm

 

.

((((((((((((((((((((((((((((((((((((( Relat¢rio Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-09-18 22:31 --------- d-----w C:\Arquivos de programas\eMule

2008-09-09 20:36 --------- d-----w C:\Arquivos de programas\EZ-XDVR BX

2008-09-09 20:35 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information

2008-08-21 22:43 --------- d-----w C:\Arquivos de programas\Zapu

2008-07-29 17:16 --------- d-----w C:\Arquivos de programas\torrent_search

2008-07-29 01:49 --------- d-----w C:\Arquivos de programas\CyberLink DVD Solution

2008-07-28 21:16 --------- d-----w C:\Arquivos de programas\Conduit

2008-07-28 21:16 --------- d-----w C:\Arquivos de programas\BitTorrent Fastest Tool

2008-05-09 15:26 664,829 ----a-w C:\Arquivos de programas\MobAmrCon14-setup.zip

2004-03-11 15:27 40,960 ----a-w C:\Arquivos de programas\Uninstall_CDS.exe

.

 

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

*Nota* entradas vazias & leg¡timas por defeito nÆo sÆo mostradas.

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:45 15360]

"updateMgr"="C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RemoteControl"="C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2003-12-08 16:35 32768]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]

"SMSERIAL"="C:\WINDOWS\sm56hlpr.exe" [2006-04-05 06:36 565248]

"HDAudDeck"="C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe" [2007-05-11 04:47 790528]

"Lexmark 1200 Series"="C:\Arquivos de programas\Lexmark 1200 Series\lxczbmgr.exe" [2006-07-13 02:34 57344]

"VTTimer"="VTTimer.exe" [2006-09-21 05:36 53248 C:\WINDOWS\system32\VTTimer.exe]

"S3Trayp"="S3trayp.exe" [2007-02-06 07:30 176128 C:\WINDOWS\system32\S3Trayp.exe]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:45 15360]

 

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\

Adobe Reader Speed Launch.lnk - C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]

WinZip Quick Pick.lnk - C:\Arquivos de programas\WinZip\WZQKPICK.EXE [2007-11-29 13:57:26 118784]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.X264"= x264vfw.dll

"vidc.hfyu"= huffyuv.dll

"msacm.divxa32"= DivXa32.acm

"msacm.l3codec"= l3codecp.acm

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Arquivos de programas\\eMule\\emule.exe"=

"C:\\Arquivos de programas\\EZ-XDVR BX\\EZXDVRBXServer.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=

"C:\\Arquivos de programas\\Messenger\\msmsgs.exe"=

 

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 11:35 78416]

R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 11:37 20560]

R3 S3GIGP;S3GIGP;C:\WINDOWS\system32\DRIVERS\S3gIGPm.sys [2007-03-05 09:54 709632]

R3 WJ430A;WJ430A Audio Capture Device Ver3.0;C:\WINDOWS\system32\Drivers\WJ430A.sys [2004-09-22 06:13 9344]

R3 WJ430V;WJ430V Video Capture Device Ver3.0;C:\WINDOWS\system32\Drivers\WJ430V.sys [2004-09-22 06:13 24576]

S2 ShellHWDetection_Untrusted_BZ;Detecção do hardware do shell_Untrusted_BZ;C:\Virtual\Untrusted\C_\WINDOWS\System32\svchost.exe [2004-08-04 00:45 14336]

S2 StiSvc_Untrusted_BZ;Assistente de aquisição de imagens do Windows (WIA)_Untrusted_BZ;C:\Virtual\Untrusted\C_\WINDOWS\system32\svchost.exe [2004-08-04 00:45 14336]

S3 GoogleDesktopManager_Untrusted_BZ;GoogleDesktopManager;C:\Virtual\Untrusted\C_\Arquivos de programas\Google\Google Desktop Search\GoogleDesktop.exe [2008-05-31 10:40 1862144]

S3 gusvc_Untrusted_BZ;Google Updater Service;C:\Virtual\Untrusted\C_\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-31 10:40 138168]

S3 MSIServer_Untrusted_BZ;Windows Installer_Untrusted_BZ;C:\Virtual\Untrusted\C_\WINDOWS\system32\msiexec.exe [2005-05-04 13:45 78848]

S3 sembbus;SEMC WMC Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\sembbus.sys [2008-02-06 15:14 260992]

S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 09:42 61504]

S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 09:42 9328]

S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 09:42 97056]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{219447f9-4d56-11dd-85e3-001d7d80e90e}]

\Shell\AutoRun\command - mnl6on3.com

\Shell\explore\Command - mnl6on3.com

\Shell\open\Command - mnl6on3.com

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c56837a-1ebd-11dd-8509-001d7d80e90e}]

\Shell\Auto\command - auto.exe

\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe

\Shell\explore\Command - d6fagcs8.cmd

\Shell\open\Command - d6fagcs8.cmd

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b9100e34-a417-11dc-8307-001d7d80e90e}]

\Shell\Auto\command - MicrosoftPowerPoint.exe

\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MicrosoftPowerPoint.exe

.

.

------- Ccan Suplementar -------

.

R0 -: HKCU-Main,Start Page = hxxp://www.google.com.br/

O8 -: E&xportar para o Microsoft Excel - C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

.

 

 

 

OBS: Depois que passei as ferramentas está aí o log..

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:49, on 2008-09-22

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

C:\WINDOWS\sm56hlpr.exe

C:\WINDOWS\system32\VTTimer.exe

C:\WINDOWS\system32\S3trayp.exe

C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe

C:\Arquivos de programas\Lexmark 1200 Series\lxczbmgr.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\WinZip\WZQKPICK.EXE

C:\Arquivos de programas\Lexmark 1200 Series\lxczbmon.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Arquivos de programas\Windows Live\Messenger\usnsvc.exe

C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\AcroRd32.exe

C:\HiJackThis.exe

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Arquivos de programas\Share_Accelerator_MM\tbSha1.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Arquivos de programas\Share_Accelerator_MM\tbSha1.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Arquivos de programas\Share_Accelerator_MM\tbSha1.dll

O4 - HKLM\..\Run: [RemoteControl] "C:\Arquivos de programas\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [sMSERIAL] C:\WINDOWS\sm56hlpr.exe

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [s3Trayp] S3trayp.exe

O4 - HKLM\..\Run: [HDAudDeck] C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe 1

O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Arquivos de programas\Lexmark 1200 Series\lxczbmgr.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [updateMgr] C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: WinZip Quick Pick.lnk = C:\Arquivos de programas\WinZip\WZQKPICK.EXE

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: GoogleDesktopManager (GoogleDesktopManager_Untrusted_BZ) - Google - C:\Virtual\Untrusted\C_\Arquivos de programas\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Updater Service (gusvc_Untrusted_BZ) - Google - C:\Virtual\Untrusted\C_\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

 

--

End of file - 5995 bytes

[Silas Martins 0]

Baixe o Malwarebytes Anti-Malware

 

* Inicie a instalação clique em "mbam-setup.exe";

* Marque "Atualizar Malwarebytes Anti-Malware" e "Executar Malwarebytes Anti-Malware", e clique em concluir.

* Marque "Verificação Rápida" e depois clique em Verificar.

* Quando o scan terminar, clique em Ok e em "Mostrar Resultados" para ver o log;

* Se algo for detectado, veja se tudo está marcado e clique em "Remover";

* O log é automaticamente gravado e pode ser consultado clicando em "Logs" do menu principal;

* Copie e cole esse log, juntamente com o novo log do hijacktihis .

Aguado o retorno.

[jgarcia 1]

Tópico Arquivado

 

Como o autor não respondeu por mais de 30 dias, o tópico foi arquivado.

 

Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura.