[Resolvido!] Atualizações automáticas desabilitadas

JerryS · Outubro 3, 2008

Olá pessoal meu problema é o seguinte: ligo o pc e aparece o alerta de segurança doWindows ativado porque as Atualizações Automáticas estão desabilitadas. A tentativa de habilitá-las pelo ícone do Alerta não funciona, nem pelo painel de controle. No painel modifico o status para automático mas quando reinicio o pc o problema persiste. Agora além disso estou com a seguinte mensagem quando reinicia o pc:

c:\WINDOWS\system32\qbnqxfbv.dll (não foi possível encontrar módulo especificado)

c:\WINDOWS\system32\gcrudhdj.dll (acesso negado)

e também o antivírus (AVG) apresenta as seguintes infecções que estão colocadas em quarentena:

Cavalo de tróia

Generic11.ANII - gcrudhdj.dll

Generic11.AMUK - geBUILD.dll

Generic11.ANKS - nnnnNFYP.dll

Generic11.ANQF - qbnqxfvb.dll

Silas Martins · Outubro 3, 2008

Baixe o ComboFix em:

ComboFix

1) Desabilite o seu anti-vírus temporariamente;

2) Dê um duplo-clique no combofix.exe e tecle "1" para prosseguir. O processo vai durar, em média, 10 minutos;

3) O ComboFix reiniciará o PC automaticamente, a fim de que o processo de remoção seja finalizado (somente se houver infecção);

4) Quando a varredura acabar, será gerado um log, que estará em C:\ComboFix.txt;

5) Não clique na janela do ComboFix, nem feche clicando no X, enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco);

6) Para parar ou sair do ComboFix, tecle "N";

7) Reabilite o seu anti-vírus;

8) Preciso que você cole o conteúdo do ComboFix.txtjuntamente com o novo log do hijackthis em sua próxima resposta.

OBS.: Caso apareça uma mensagem avisando que ESTE NÃO É UM APLICATIVO WIN 32 VÁLIDO baixe o ComboFix novamente, mas salve-o em seu Desktop como KomboFix. Em último caso, tente utilizar o ComboFix em MODO SEGURO.

Atenção:

Não clique em nada enquanto o Combofix estiver rodando, Do contrário seu desktop ficará em branco.

Para parar o processo ou sair do ComboFix, tecle "2" e Enter.

Aguardo o retorno

JerryS · Outubro 3, 2008

Grato pela eficiência Silas. Conforme as instruções aqui vão os relatórios:

ComboFix 08-09-30.03 - cliente 2008-10-03 11:03:05.3 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.1581 [GMT -3:00]Executando de: C:\Documents and Settings\cliente\Desktop\beleza\ComboFix.exe

ATENÇAO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft\Network\Downloader\qmgr0.dat

C:\Documents and Settings\All Users\Dados de aplicativos\Microsoft\Network\Downloader\qmgr1.dat

C:\Documents and Settings\cliente\Dados de aplicativos\inst.exe

C:\WINDOWS\BMfa24718a.txt

C:\WINDOWS\BMfa24718a.xml

C:\WINDOWS\pskt.ini

C:\WINDOWS\system32\awwwlk.dll

C:\WINDOWS\system32\lrsopjmb.dll

C:\WINDOWS\system32\rdntcmms.dll

C:\WINDOWS\system32\tkekcr.dll

C:\WINDOWS\system32\ybuuxcgv.dll

----- BITS: Sites possivelmente infetados -----

hxxp://hostit.x10hosting.com

.

((((((((((((((((((((((( Ficheiros criados de 2008-09-03 to 2008-10-03 ))))))))))))))))))))))))))))))))

.

2008-10-03 10:39 . 2008-10-03 10:39 <DIR> d-------- C:\LinhaDefensiva

2008-10-02 13:59 . 2008-10-02 13:59 <DIR> d-------- C:\Arquivos de programas\VSO

2008-10-02 13:59 . 2004-05-04 12:53 1,645,320 --a------ C:\WINDOWS\gdiplus.dll

2008-10-02 13:59 . 2006-05-20 17:16 1,184,984 --a------ C:\WINDOWS\system32\wvc1dmod.dll

2008-10-02 13:59 . 2006-05-11 20:21 626,688 --a------ C:\WINDOWS\system32\vp7vfw.dll

2008-10-02 13:59 . 2006-09-29 13:24 217,127 --a------ C:\WINDOWS\system32\drv43260.dll

2008-10-02 13:59 . 2006-09-29 13:25 208,935 --a------ C:\WINDOWS\system32\drv33260.dll

2008-10-02 13:59 . 2006-09-29 13:26 176,165 --a------ C:\WINDOWS\system32\drv23260.dll

2008-10-02 13:59 . 2007-03-18 21:37 65,602 --a------ C:\WINDOWS\system32\cook3260.dll

2008-10-02 12:50 . 2008-10-02 12:50 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy

2008-10-02 09:44 . 2008-10-02 10:06 <DIR> d-------- C:\WINDOWS\BDOSCAN8

2008-10-02 09:23 . 2008-10-03 09:24 1,100,427 ---hs---- C:\WINDOWS\system32\vbfxqnbq.ini

2008-10-01 21:44 . 2008-10-01 21:44 971,683 ---hs---- C:\WINDOWS\system32\eacriwoy.ini

2008-10-01 21:43 . 2008-10-03 09:34 1,537 --ahs---- C:\WINDOWS\system32\dLlUuBeg.ini2

2008-10-01 21:43 . 2008-10-03 09:36 1,537 --ahs---- C:\WINDOWS\system32\dLlUuBeg.ini

2008-10-01 15:00 . 2008-10-01 15:00 <DIR> d-------- C:\Documents and Settings\Administrador\Menu Iniciar

2008-10-01 15:00 . 2008-10-01 15:00 <DIR> dr------- C:\Documents and Settings\Administrador\Favoritos

2008-09-30 23:48 . 2008-10-03 01:20 <DIR> d-------- C:\Documents and Settings\cliente\Dados de aplicativos\Vso

2008-09-30 23:48 . 2008-10-02 13:59 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys

2008-09-30 23:48 . 2008-10-02 13:59 47,360 --a------ C:\Documents and Settings\cliente\Dados de aplicativos\pcouffin.sys

2008-09-29 14:40 . 2008-09-29 14:40 <DIR> d-------- C:\WINDOWS\IBN Video Joiner

2008-09-13 16:16 . 2008-09-13 16:16 <DIR> d-------- C:\Arquivos de programas\DVD Decrypter

2008-09-09 13:15 . 2008-09-09 13:15 <DIR> d-------- C:\Arquivos de programas\DsNET Corp

2008-09-09 13:15 . 2004-03-09 00:00 124,688 --a------ C:\WINDOWS\system32\MSWINSCK.OCX

2008-09-07 21:12 . 2008-09-07 21:12 <DIR> d-------- C:\Arquivos de programas\Rocket Division Software

2008-09-07 21:12 . 2008-08-20 13:09 93,544 --a------ C:\WINDOWS\system32\drivers\StarPortLite.sys

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-10-03 14:07 --------- d-----w C:\Documents and Settings\cliente\Dados de aplicativos\AVG7

2008-10-03 12:32 --------- d-----w C:\Documents and Settings\cliente\Dados de aplicativos\uTorrent

2008-10-02 12:42 --------- d-----w C:\Documents and Settings\cliente\Dados de aplicativos\MegauploadToolbar

2008-09-13 19:42 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\DVD Shrink

2008-09-13 10:50 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Avg7

2008-09-08 00:13 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys

2008-09-02 19:02 --------- d-----w C:\Documents and Settings\cliente\Dados de aplicativos\Winamp

2008-09-02 19:02 --------- d-----w C:\Arquivos de programas\Winamp

2008-08-27 15:12 --------- d-----w C:\Arquivos de programas\DVD Shrink

2008-08-25 18:15 --------- d-----w C:\Arquivos de programas\Java

2008-08-20 17:23 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information

2008-04-13 00:39 22,328 ----a-w C:\Documents and Settings\cliente\Dados de aplicativos\PnkBstrK.sys

.

<pre>----a-w		15,106,127 2008-10-02 20:26:44  C:\Documents and Settings\cliente\Meus documentos\Downloads\ConvertXtoDVD 4.0.0.1 Final And Patch\ConvertXtoDVD 3.0.0.1 Final And Patch .exe</pre>

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias & legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSMSGS"="C:\Arquivos de programas\Messenger\msmsgs.exe" [2004-10-13 1694208]

"swg"="C:\Arquivos de programas\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-06-22 171448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-10-07 155648]

"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-10-07 126976]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 8523776]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]

"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-15 196608]

"AVG7_CC"="C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe" [2008-04-20 579584]

"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]

"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 81920]

"Adobe Reader Speed Launcher"="C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]

"TkBellExe"="C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" [2008-05-30 185896]

"WinampAgent"="C:\Arquivos de programas\Winamp\winampa.exe" [2008-08-03 36352]

"f9174216"="C:\WINDOWS\system32\qbnqxfbv.dll" [N/A]

"BMfa24718a"="C:\WINDOWS\system32\gcrudhdj.dll" [N/A]

"nwiz"="nwiz.exe" [2007-12-05 C:\WINDOWS\system32\nwiz.exe]

"SoundMan"="SOUNDMAN.EXE" [2004-07-27 C:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]

"AVG7_Run"="C:\ARQUIV~1\Grisoft\AVG7\avgw.exe" [2007-10-29 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=tkekcr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.X264"= x264vfw.dll

"msacm.avis"= ff_acm.acm

"VIDC.YV12"= yv12vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Arquivos de programas\\uTorrent\\utorrent.exe"=

"C:\\Arquivos de programas\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=

"C:\\Arquivos de programas\\Ubisoft\\Gearbox Software\\BrothersInArms\\System\\bia.exe"=

"C:\\Program Files\\Activision\\Rome - Total War\\RomeTW.exe"=

"C:\\Arquivos de programas\\Grisoft\\AVG7\\avginet.exe"=

"C:\\Arquivos de programas\\Grisoft\\AVG7\\avgemc.exe"=

"C:\\Arquivos de programas\\Real\\RealPlayer\\realplay.exe"=

"C:\\WINDOWS\\system32\\PnkBstrA.exe"=

"C:\\WINDOWS\\system32\\PnkBstrB.exe"=

"C:\\WINDOWS\\system32\\dpvsetup.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=

R1 StarPortLite;StarPort Storage Controller (Lite);C:\WINDOWS\system32\DRIVERS\StarPortLite.sys [2008-08-20 93544]

R2 ppsio2;PPDevice;C:\WINDOWS\system32\drivers\ppsio2.sys [1999-04-02 22400]

S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\w300bus.sys [2006-03-13 60800]

S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w300mdfl.sys [2006-03-13 9264]

S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w300mdm.sys [2006-03-13 96352]

S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w300mgmt.sys [2006-03-13 87824]

S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w300obex.sys [2006-03-13 85696]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46b2fb35-8b89-11dc-a2d9-0015f2f50dc0}]

\Shell\AutoRun\command - a.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{471bf835-fb37-11db-a243-000fead881e5}]

\Shell\AutoRun\command - a.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9c56a9a1-f8b9-11db-a242-000fead881e5}]

\Shell\AutoRun\command - a.exe

.

Conteúdo da pasta 'Tarefas Agendadas'

.

- - - - ORFAOS REMOVIDOS - - - -

URLSearchHooks-{bc4be15d-6a34-4356-9e97-79e43da32b1d} - (no file)

BHO-{0C3E3A63-66B1-4FAB-8ECC-0010EBDC1A3C} - C:\WINDOWS\system32\geBuUlLd.dll

BHO-{54A8264B-AFFB-4614-95FE-0234817EA282} - C:\WINDOWS\system32\nnnnNFYP.dll

BHO-{742cea07-987e-4360-83c7-f884f4dc3891} - C:\WINDOWS\system32\tkekcr.dll

Toolbar-{bc4be15d-6a34-4356-9e97-79e43da32b1d} - (no file)

WebBrowser-{BC4BE15D-6A34-4356-9E97-79E43DA32B1D} - (no file)

ShellExecuteHooks-{54A8264B-AFFB-4614-95FE-0234817EA282} - C:\WINDOWS\system32\nnnnNFYP.dll

Notify-nnnnNFYP - nnnnNFYP.dll

.

------- Ccan Suplementar -------

.

FireFox -: Profile - C:\Documents and Settings\cliente\Dados de aplicativos\Mozilla\Firefox\Profiles\t5ud0ndi.default\

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-10-03 11:07:20

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros ocultos ...

Varredura completada com sucesso

Ficheiros ocultos: 0

**************************************************************************

.

------------------------ Outros Processos em Execução ------------------------

.

C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe

C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\WINDOWS\system32\msiexec.exe

.

**************************************************************************

.

Tempo para conclusão: 2008-10-03 11:16:03 - Maquina reiniciou

ComboFix-quarantined-files.txt 2008-10-03 14:15:43

Pre-Run: 9 pasta(s) 42.651.811.840 bytes dispon¡veis

Post-Run: 13 pasta(s) 42,579,312,640 bytes dispon¡veis

172 --- E O F --- 2008-10-01 01:22:10

e também

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:40:44, on 10/3/aaaa

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe

C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\Arquivos de programas\Winamp\winampa.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.terra.com.br/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Arquivos de programas\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll

O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [WinampAgent] "C:\Arquivos de programas\Winamp\winampa.exe"

O4 - HKLM\..\Run: [f9174216] rundll32.exe "C:\WINDOWS\system32\qbnqxfbv.dll",b

O4 - HKLM\..\Run: [bMfa24718a] Rundll32.exe "C:\WINDOWS\system32\gcrudhdj.dll",s

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\ARQUIV~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/...?p=ZNxdm119YYBR

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://img2.orkut.com/activex/10035/photouploader.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppD...ap/PhtPkMSN.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O20 - AppInit_DLLs: tkekcr.dll

O21 - SSODL: CompIBBrd - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Arquivos de programas\Scpad\scpLIB.dll (file missing)

O22 - SharedTaskScheduler: scpLIB - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Arquivos de programas\Scpad\scpLIB.dll (file missing)

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--

End of file - 7384 bytes

Silas Martins · Outubro 3, 2008

Sigas as instruções abaixo:

Baixe o Bankerfix.

desative o seu antivírus temporariamente, para não haver conflitos e para uma melhor detecção.

Clique duas vezes sobre bankerfix.exe, dê o Enter e espere ele terminar. Ao terminar, leia a mensagem na tela e aperte Enter novamente.

Habilite o seu antivírus. e gere um novo log do hijackthis, e poste juntamente com o relatório .txt do Bankerfix.

Aguardo o Retorno

JerryS · Outubro 3, 2008

Bem primeiro peço desculpas a todos pelo erro na digitação do título do tópico. Quanto as instruções Silas, aqui vão os relatórios:

BankerFix 3.0 VALKYRIE - Removedor de Bankers

Linha Defensiva | http://www.linhadefensiva.org

http://www.linhadefensiva.org/bankerfix/

-------------------------------------------------------

Data: 2008-10-03 - 19:28

-------------------------------------------------------

Lista de Definição: 2008-09-15-1 | CORE: 2008-09-30-2

=======================================================

Arquivo infectado detectado: C:\WINDOWS\Arq.ini

Arquivo infectado removido com sucesso!

Arquivo infectado detectado: C:\WINDOWS\syst.dat

Arquivo infectado removido com sucesso!

----- Fim -------------------------

e do hijack:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:30:20, on 10/3/aaaa

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe

C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\WINDOWS\explorer.exe

C:\Arquivos de programas\Adobe\Reader 8.0\Reader\AcroRd32.exe

C:\Arquivos de programas\Grisoft\AVG7\avgcc.exe