[Resolvido!] PC infectado com virus BOO/Sinowal.

razzmad · Outubro 5, 2008

Olá amigos do Imasters,

Quando começo a escanear meu pc com o Avira, logo no início dá uma mensagem que ele está infectado com um virus de boot chamado BOO/Sinowal.A. O próprio antivirus me sugere uma vacina dele mesmo, me dá o link pra baixar o programinha que irá removê-lo, mas isso não acontece....o que sugerem??

Segue o log do hijack.....grato...

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:00:33, on 05/10/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Arquivos de programas\a-squared Free\a2service.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe

C:\ARQUIV~1\A4Tech\Keyboard\Ikeymain.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Arquivos de programas\Programinhas vírus\hijack\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.compartilhando.org/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://br.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://br.rd.yahoo.com/customize/ie/defaul...earch.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://br.rd.yahoo.com/customize/ie/defaul...earch.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://br.yahoo.com

R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\ARQUIV~1\Yahoo!\Companion\Installs\cpn\yt.dll

R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Arquivos de programas\AskPBar\SrchAstt\2.bin\A9SRCHAS.DLL

O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\ARQUIV~1\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Ask Search Assistant BHO - {0A94B111-4504-4e26-AB05-E61E474AA38B} - C:\Arquivos de programas\AskPBar\SrchAstt\2.bin\A9SRCHAS.DLL

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\Windows Live Toolbar\msntb.dll

O2 - BHO: G-Buster Browser Defense Unibanco - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\WINDOWS\Downloaded Program Files\gbiehuni.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar1.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Arquivos de programas\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARQUIV~1\MEGAUP~1\MEGAUP~1.DLL

O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\ARQUIV~1\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [iKeyWorks] C:\ARQUIV~1\A4Tech\Keyboard\Ikeymain.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')

O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: &Windows Live Search - res://C:\Arquivos de programas\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~1\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Arquivos de programas\Paltalk Messenger\Paltalk.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O14 - IERESET.INF: START_PAGE_URL=http://www.compartilhando.org/

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://download.gamedesire.com/g_bin/eng/cards_2_0_0_77.cab

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab

O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -

O16 - DPF: {41ACD49D-1974-791A-0981-AA9872721044} (Ganymede Board Games) - http://200.212.184.212/g_bin/eng/boards_2_0_0_34.cab

O16 - DPF: {4B4513E2-4E57-43DF-9496-FCD37E9DFA64} (GameDesire Sea Battle) - http://200.212.184.212/g_bin/eng/navy_2_0_0_29.cab

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1184291363687

O16 - DPF: {A1FE3DEF-CF77-11D4-8340-0080C8D7ED4A} (GameDesire Pinball Pirate) - http://200.212.184.212/g_bin/eng/pirate_2_0_0_30.cab

O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} (GameDesire Word Games) - http://download.gamedesire.com/g_bin/eng/words_2_0_0_51.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwa...ash/swflash.cab

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399008} (GbPluginObj Class) - https://clickbanking.unibanco.com.br/GbPlug...GbPluginUni.cab

O20 - Winlogon Notify: GbPluginUni - C:\WINDOWS\Downloaded Program Files\gbiehuni.dll

O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Arquivos de programas\a-squared Free\a2service.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - (no file)

O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

--

End of file - 10305 bytes

jgarcia · Outubro 6, 2008

Opa razzmad,

Baixe o ComboFix em:

ComboFix

1) Desabilite o seu anti-vírus temporariamente;

2) Dê um duplo-clique no combofix.exe e tecle "1" para prosseguir. O processo vai durar, em média, 10 minutos;

3) O ComboFix reiniciará o PC automaticamente, a fim de que o processo de remoção seja finalizado (somente se houver infecção);

4) Quando a varredura acabar, será gerado um log, que estará em C:\ComboFix.txt;

5) Não clique na janela do ComboFix, nem feche clicando no X, enquanto a ferramenta estiver sendo executada, pois isto implicará na desconfiguração de seu desktop (ele ficará todo branco);

6) Para parar ou sair do ComboFix, tecle "N";

7) Reabilite o seu anti-vírus;

8) Preciso que você cole o conteúdo do ComboFix.txt em sua próxima resposta.

OBS.: Caso apareça uma mensagem avisando que ESTE NÃO É UM APLICATIVO WIN 32 VÁLIDO baixe o ComboFix novamente, mas salve-o em seu Desktop como KomboFix. Em último caso, tente utilizar o ComboFix em MODO SEGURO.

Abraços.

razzmad · Outubro 6, 2008

ComboFix 08-10-06.03 - inga 2008-10-06 18:42:25.1 - NTFSx86 NETWORK

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1046.18.349 [GMT -3:00]

Executando de: C:\Arquivos de programas\Programinhas vírus\ComboFix.exe

ATENÇAO - ESTA MAQUINA NAO TEM A CONSOLE DE RECUPERAÇÃO INSTALADA !!

.

((((((((((((((((((((((( Ficheiros criados de 2008-09-06 to 2008-10-06 ))))))))))))))))))))))))))))))))

.

2008-10-04 13:34 . 2008-10-04 13:34 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\GbPlugin

2008-09-17 06:21 . 2008-09-27 17:56 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Winamp Toolbar

2008-09-17 06:17 . 2008-09-27 17:54 <DIR> d-------- C:\Arquivos de programas\Winamp

2008-09-08 01:49 . 2008-09-27 19:08 54,156 --ah----- C:\WINDOWS\QTFont.qfn

2008-09-08 01:49 . 2008-09-08 01:49 1,409 --a------ C:\WINDOWS\QTFont.for

2008-09-07 12:00 . 2008-05-09 07:55 512,000 --------- C:\WINDOWS\system32\DllCache\jscript.dll

2008-09-07 12:00 . 2008-05-09 07:55 430,080 --------- C:\WINDOWS\system32\DllCache\vbscript.dll

2008-09-07 12:00 . 2008-05-09 07:55 180,224 --------- C:\WINDOWS\system32\DllCache\scrobj.dll

2008-09-07 12:00 . 2008-05-09 07:55 172,032 --------- C:\WINDOWS\system32\DllCache\scrrun.dll

2008-09-07 12:00 . 2008-05-08 08:24 155,648 --------- C:\WINDOWS\system32\DllCache\wscript.exe

2008-09-07 12:00 . 2008-05-09 05:45 135,168 --------- C:\WINDOWS\system32\DllCache\cscript.exe

2008-09-07 12:00 . 2008-05-09 07:55 90,112 --------- C:\WINDOWS\system32\DllCache\wshext.dll

2008-09-07 10:51 . 2008-09-07 10:51 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\PC Drivers HeadQuarters

2008-09-06 20:28 . 2008-09-06 20:28 <DIR> d-------- C:\WINDOWS\system32\xircom

2008-09-06 20:28 . 2008-09-06 20:28 <DIR> d-------- C:\Arquivos de programas\microsoft frontpage

2008-09-06 19:07 . 2008-06-14 14:34 272,384 --------- C:\WINDOWS\system32\DllCache\bthport.sys

2008-09-06 19:06 . 2008-09-07 20:17 <DIR> d--h----- C:\WINDOWS\$hf_mig$

2008-09-06 19:06 . 2008-04-11 16:05 691,712 --------- C:\WINDOWS\system32\DllCache\inetcomm.dll

2008-09-06 19:06 . 2008-05-08 11:02 203,136 --------- C:\WINDOWS\system32\DllCache\rmcast.sys

2008-09-06 18:59 . 2008-09-06 18:59 <DIR> d-------- C:\WINDOWS\system32\oobe

2008-09-06 18:59 . 2008-09-06 18:59 <DIR> d-------- C:\WINDOWS\system32\bits

2008-09-06 18:59 . 2008-09-06 18:59 <DIR> d-------- C:\WINDOWS\l2schemas

2008-09-06 18:49 . 2008-09-06 19:00 <DIR> d-------- C:\WINDOWS\ServicePackFiles

2008-09-06 08:30 . 2008-04-13 23:20 412,160 --------- C:\WINDOWS\system32\photometadatahandler.dll

2008-09-06 08:29 . 2008-04-13 23:20 1,737,856 --------- C:\WINDOWS\system32\mtxparhd.dll

2008-09-06 08:28 . 2008-04-13 23:20 397,312 --------- C:\WINDOWS\system32\mmcex.dll

2008-09-06 08:27 . 2005-08-31 05:11 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys

2008-09-06 08:26 . 2008-04-13 23:20 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll

2008-09-06 08:25 . 2008-04-13 23:20 136,192 --------- C:\WINDOWS\system32\aaclient.dll

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-10-06 21:41 --------- d-----w C:\Arquivos de programas\Programinhas vírus

2008-10-03 15:15 21,504 ----a-w C:\Documents and Settings\inga\Dados de aplicativos\GDIPFONTCACHEV1.DAT

2008-09-24 00:22 --------- d-----w C:\Arquivos de programas\Real

2008-09-24 00:22 --------- d-----w C:\Arquivos de programas\Programas RFB

2008-09-11 22:58 --------- d-----w C:\Arquivos de programas\CCleaner

2008-09-07 14:06 --------- d--h--w C:\Arquivos de programas\InstallShield Installation Information

2008-09-03 21:34 --------- d-----w C:\Arquivos de programas\Google

2008-08-17 14:42 --------- d-----w C:\Arquivos de programas\Badongo

2008-08-16 01:37 --------- d-----w C:\Arquivos de programas\Panda Security

2008-08-10 21:28 --------- d-----w C:\Arquivos de programas\Avira

2008-08-10 21:25 --------- d-----w C:\Arquivos de programas\a-squared Free

2008-08-10 21:07 --------- d-----w C:\Arquivos de programas\VideoLAN

2008-08-10 20:56 --------- d-----w C:\Documents and Settings\All Users\Dados de aplicativos\Avira

2008-08-06 09:53 --------- d-----w C:\Arquivos de programas\Arquivos comuns\xing shared

2008-08-06 09:53 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Real

2008-08-06 09:52 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll

2008-08-06 09:52 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll

2008-07-19 01:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll

2008-07-19 01:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe

2008-07-19 01:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll

2008-07-19 01:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll

2008-07-19 01:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll

2008-07-19 01:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll

2008-07-19 01:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll

2008-07-19 01:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll

2008-07-19 01:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll

2008-07-19 01:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll

2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll

2008-07-07 20:28 253,952 ------w C:\WINDOWS\system32\DllCache\es.dll

2008-05-31 09:50 452,000 ----a-w C:\Arquivos de programas\msgr8br.exe

2008-03-08 17:31 10,242,455 ----a-w C:\Arquivos de programas\IRPF2008win32v1.0.zip

2007-11-16 20:41 9,414,856 ----a-w C:\Arquivos de programas\Install_MSN_Messenger.EXE

2007-08-22 18:36 68,150 ----a-w C:\Arquivos de programas\ReadMe.rtf

2007-08-22 18:36 2,916,264 ----a-w C:\Arquivos de programas\DPInst.exe

2007-08-11 00:16 11,257 ----a-w C:\Arquivos de programas\AmdPPM.cat

2007-08-10 17:14 12,278 ----a-w C:\Arquivos de programas\AmdPPM.inf

2007-04-16 19:46 44,544 ----a-w C:\Arquivos de programas\AmdPPM64.sys

2007-04-16 19:46 33,792 ----a-w C:\Arquivos de programas\AmdPPM.sys

2006-07-02 02:31 7,803 ----a-w C:\Arquivos de programas\amdk8.cat

2006-07-02 02:12 43,520 ----a-w C:\Arquivos de programas\amdk8.sys

2006-07-02 01:39 5,333 ----a-w C:\Arquivos de programas\amdk8.inf

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{0A94B116-4504-4e26-AB05-E61E474AA38B}"= "C:\Arquivos de programas\AskPBar\SrchAstt\2.bin\A9SRCHAS.DLL" [2008-01-04 61440]

[HKEY_CLASSES_ROOT\clsid\{0a94b116-4504-4e26-ab05-e61e474aa38b}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]

"swg"="C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-12 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [X]

"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]

"iKeyWorks"="C:\ARQUIV~1\A4Tech\Keyboard\Ikeymain.exe" [2003-12-24 61440]

"Adobe Reader Speed Launcher"="C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]

"TkBellExe"="C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" [2008-08-06 185896]

"avgnt"="C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-13 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-03 44544]

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\

Microsoft Office.lnk - C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{E37CB5F0-51F5-4395-A808-5FA49E399008}"= "C:\WINDOWS\Downloaded Program Files\gbiehuni.dll" [2008-08-29 378784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginUni]

2008-08-29 14:33 378784 C:\WINDOWS\Downloaded Program Files\gbiehuni.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.3iv2"= 3ivxVfWCodec.dll

"VIDC.VP31"= vp31vfw.dll

"VIDC.CLBR"= P1001Dex.ax

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Adobe Reader Speed Launch.lnk]

backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^PalTalk.lnk]

backup=C:\WINDOWS\pss\PalTalk.lnkCommon Startup

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Arquivos de programas\\Paltalk Messenger\\paltalk.exe"=

"C:\\Arquivos de programas\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"C:\\Arquivos de programas\\Yahoo!\\Messenger\\YServer.exe"=

"C:\\WINDOWS\\system32\\rtcshare.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Arquivos de programas\\Windows Live\\Messenger\\livecall.exe"=

"C:\\Arquivos de programas\\Messenger\\msmsgs.exe"=

S0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544]

S3 genmcmn;Scroll Mouse Driver;C:\WINDOWS\system32\DRIVERS\gmfiltr.sys [ ]

S3 P1001VID;Creative WebCam (WDM);C:\WINDOWS\system32\DRIVERS\P1001Vid.sys [2002-01-29 395224]

.

Conteúdo da pasta 'Tarefas Agendadas'

2008-10-06 C:\WINDOWS\Tasks\Verificar Atualizações para a Barra de Ferramentas do Windows Live.job

- C:\Arquivos de programas\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]

.

- - - - ORFAOS REMOVIDOS - - - -

Notify-WgaLogon - (no file)

.

------- Ccan Suplementar -------

.

FireFox -: Profile - C:\Documents and Settings\inga\Dados de aplicativos\Mozilla\Firefox\Profiles\d7vxsdld.default\

FF -: plugin - C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll

FF -: plugin - C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll

FF -: plugin - C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-10-06 18:46:30

Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros ocultos ...

Varredura completada com sucesso

Ficheiros ocultos: 0

**************************************************************************

.

Tempo para conclusão: 2008-10-06 18:48:15

ComboFix-quarantined-files.txt 2008-10-06 21:48:09

Pre-Run: 20 pasta(s) 60,395,311,104 bytes disponíveis

Post-Run: 22 pasta(s) 62,333,673,472 bytes disponíveis

164 --- E O F --- 2008-09-10 23:04:51

jgarcia · Outubro 8, 2008

Opa razzmad,

Baixe o Sophos Anti-Rootkit.

1. Preencha o formulário com os dados solicitados. Clique em Submit. Efetue o download salvando-o em seu desktop;

2. Após o término do download o executável sarsfx.exe será embutido em seu desktop. Dê duplo-clique sobre o sarsfx.exe. Aceite a licença. Clique em Install;

3. Depois de executado o processo haverá uma pasta denominada C:\SOPHTEMP alocada no C. Entre nesta pasta e dê duplo-clique sobre sargui.exe. Execute uma verificação (por padrão todos os itens estarão marcados);

4. Deixe o programa rodar até que o mesmo mostre a janela com os prováveis problemas (localização e nome do arquivo no disco). Pouse o mouse sobre os problemas encontrados e verifique qual é a recomendação dada para ele. Marcados os arquivos a serem removidos, clique em Clean Up;

PS.: Somente execute a limpeza caso haja a seguinte mensagem em Removable --> Yes (clean up recommended) <--;

5. Finalizada a limpeza o programa irá requerer a Reinicialização (clique em Restart Now);

6. Quando o PC reiniciar abrir-se-á uma caixa de diálogo com o resultado final do Scan. Preciso que você copie e cole o conteúdo da caixa de diálogo em sua próxima resposta. Poste também um novo log do HijackThis.

Abraços.

razzmad · Outubro 8, 2008

ok...no scan do Shopos não detectou nada e não teve log.......e depois o log do hijack deu isso:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 01:13:53, on 8/10/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Arquivos de programas\a-squared Free\a2service.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Windows Live\Messenger\usnsvc.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe

C:\ARQUIV~1\A4Tech\Keyboard\Ikeymain.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\Arquivos de programas\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Programinhas vírus\hijack\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://terra.com.br/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896