[Arquivado] Não consigo instalar nenhum antivirus...

cobradorf · Dezembro 20, 2008

Olá, Boa tarde a todos, me desculpe se estiver postando no lugar errado, a algum tempo atrás eu usava o Avira, e não conseguia mais atualiza-lo, e então resolvi remove-lo e baixa-lo de novo, porém desde então não consigo mais instalar nenhum antivírus, tentei o AVG, Avira, McAfee, entre outros e nada, inclusive formatei o pc, embora não entenda muito de informática, gostaria que alguém pudesse me ajudar, desde já agradeço muito a todos...vlw

JonJon CS · Dezembro 20, 2008

Realmente, lugar errado, isso tem que ser postado

na sessão de malwares.

Baixe o hijackthis no baixaki, e post o log para

os nossos moderadores lhe ajudar.

Mário Monteiro · Dezembro 20, 2008

Tópico Movido

Origem: Dúvidas Gerais :seta: Destino: Segurança & Malwares

-----------------------

Post um log conforme este topico

http://forum.imasters.com.br/index.php?showtopic=165906

cobradorf · Dezembro 20, 2008

Olá, me desculpem o engano sobre a postagem do problema....o log gerado foi esse:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:07:47, on 20/12/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\bndmss.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Motorola\SMSERIAL\sm56hlpr.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\ZSSnp211.exe

C:\WINDOWS\Domino.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\XP-5CED94A8.EXE

C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\winvggws.exe

C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\winyrxak.exe

C:\Hijack\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe, explorer.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [sMSERIAL] C:\Arquivos de programas\Motorola\SMSERIAL\sm56hlpr.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe

O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.exe

O4 - HKLM\..\Run: [barsaka] explorer.exe

O4 - HKLM\..\Run: [XP-5CED94A8] C:\WINDOWS\system32\XP-5CED94A8.EXE

O4 - HKLM\..\RunOnce: [Execute] C:\WINDOWS\System32\Tools\DelFolders.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [NitroPC] "C:\Arquivos de programas\NitroPC\NitroPC.exe" -minimized

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: ¡¡¡¡¡¡.lnk = C:\WINDOWS\system32\XP-5CED94A8.EXE

O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Reboot.exe

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{C42F28EA-3D2B-41C1-BA4B-F8E16335B24D}: NameServer = 200.222.0.34 200.202.193.75

O23 - Service: Windows Network Data Management System Service (BNDMSS) - Unknown owner - C:\WINDOWS\system32\bndmss.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--

End of file - 4877 bytes

cobradorf · Dezembro 24, 2008

Será que eu consigo passar o ano novo de pc em forma....rsrs

MGuitar · Janeiro 9, 2009

cobradorf, desculpe-nos a demora.

Se ainda estiver necessitando de ajuda, siga o procedimento abaixo.

- Faça o download do ComboFix e salve-o na área de trabalho;

● Desative temporariamente o seu antivirus para não detectar a ferramenta como vírus;

● Duplo clique no ícone combofix.exe para iniciar o scan;

● Leia o contrato que aparecerá e clique em Sim para continuar;

● Abrirá uma janela do Console de Recuperação, clique em Sim para instalar. Se aparecer outra janela do Console, clique em OK > Sim;

● Aguarde enquanto o ComboFix faz o scan;

● Se ocorrer algum problema durante o scan, reinicie seu computador em Modo de Segurança e repita o procedimento;

● Não clique na janela do ComboFix e procure não utilizar o teclado também, para não atrapalhar a varredura da ferramenta;

● Se quiser sair ou parar o ComboFix, tecle N;

● Quando terminar seu micro será reiniciado. Após o reinicio, a ferramenta executará novamente, aguarde;

● Será gerado um log em C:\ComboFix.txt.

Cole este log em sua próxima resposta.

cobradorf · Janeiro 9, 2009

Tomara que eu tenha feito certo....ComboFix 09-01-08.05 - Fernilson 2009-01-09 19:54:23.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1046.18.446.71 [GMT -2:00]

Executando de: c:\documents and settings\Fernilson\Desktop\ComboFix.exe

* Criado um novo ponto de restauro

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\docume~1\FERNIL~1\CONFIG~1\Temp\E_4

c:\docume~1\FERNIL~1\CONFIG~1\Temp\E_4\com.run

c:\docume~1\FERNIL~1\CONFIG~1\Temp\E_4\dp1.fne

c:\docume~1\FERNIL~1\CONFIG~1\Temp\E_4\eAPI.fne

c:\docume~1\FERNIL~1\CONFIG~1\Temp\E_4\internet.fne

c:\docume~1\FERNIL~1\CONFIG~1\Temp\E_4\krnln.fnr

c:\docume~1\FERNIL~1\CONFIG~1\Temp\E_4\RegEx.fnr

c:\docume~1\FERNIL~1\CONFIG~1\Temp\E_4\shell.fne

c:\docume~1\FERNIL~1\CONFIG~1\Temp\E_4\spec.fne

c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013

c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini

c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\exe32.exe

c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\ise.exe

c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\isee.exe

c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\winupd32.exe

c:\windows\IE4 Error Log.txt

c:\windows\system32\4560.EXE

c:\windows\system32\com.run

c:\windows\system32\dp1.fne

c:\windows\system32\eAPI.fne

c:\windows\system32\internet.fne

c:\windows\system32\krnln.fnr

c:\windows\system32\og.dll

c:\windows\system32\og.edt

c:\windows\system32\RegEx.fnr

c:\windows\system32\shell.fne

c:\windows\system32\spec.fne

c:\windows\system32\ul.dll

.

((((((((((((((((((((((((((((((((((((((( Drivers/Serviços )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_BNDMSS

-------\Legacy_GBPSV

-------\Service_BNDMSS

-------\Service_GbpSv

(((((((((((((((( Arquivos/Ficheiros criados de 2008-12-09 to 2009-01-09 ))))))))))))))))))))))))))))

.

2009-01-08 09:29 . 2009-01-08 09:29 0 --a------ C:\a73c

2009-01-06 05:34 . 2009-01-06 05:34 0 --a------ C:\a028

2008-12-28 06:02 . 2008-12-28 06:02 0 --a------ C:\b18d

2008-12-27 20:57 . 2008-12-27 20:57 <DIR> d-------- c:\arquivos de programas\Lexmark 510 Series

2008-12-27 20:57 . 2003-11-06 05:57 307,200 --a------ c:\windows\system32\LEXBCES.EXE

2008-12-27 20:57 . 2003-11-06 05:57 201,216 --a------ c:\windows\system32\LEXP2P32.DLL

2008-12-27 20:57 . 2003-11-06 06:03 200,192 --a------ c:\windows\system32\lexlmpm.dll

2008-12-27 20:57 . 2003-11-06 05:56 197,120 --a------ c:\windows\system32\LEX2KUSB.DLL

2008-12-27 20:57 . 2003-11-06 05:57 174,592 --a------ c:\windows\system32\LEXPPS.EXE

2008-12-27 20:57 . 2003-11-06 05:56 147,456 --a------ c:\windows\system32\LEXBCE.DLL

2008-12-27 20:57 . 2004-02-13 09:46 73,728 --a------ c:\windows\system32\lxbzpwr.dll

2008-12-26 18:18 . 2008-12-26 18:18 0 --a------ C:\151d4

2008-12-24 09:51 . 2008-10-24 12:10 31,296 --a------ c:\windows\system32\drivers\gbpkm.sys

2008-12-24 09:30 . 2008-12-24 09:51 <DIR> d-------- c:\documents and settings\All Users.WINDOWS\Dados de aplicativos\GbPlugin

2008-12-24 09:30 . 2008-12-24 09:51 <DIR> d-------- c:\arquivos de programas\GbPlugin

2008-12-20 19:06 . 2008-12-20 19:07 <DIR> d-------- C:\Hijack

2008-12-20 14:53 . 2008-12-20 14:53 16,896 ---hs---- c:\windows\system32\winzareg.exe

2008-12-15 17:57 . 2008-12-15 17:57 16,896 ---hs---- c:\windows\system32\winzcreg.exe

2008-12-15 17:57 . 2008-12-23 18:20 16,896 --a------ c:\windows\system32\DF7BE.EXE

2008-12-13 10:15 . 2008-12-13 10:15 16,896 ---hs---- c:\windows\system32\winycreg.exe

2008-12-09 15:50 . 2008-12-09 15:50 <DIR> d-------- c:\arquivos de programas\Total Video Player

2008-12-09 15:50 . 2008-12-09 15:50 16,896 ---hs---- c:\windows\system32\winxcreg.exe

2008-12-09 15:50 . 2008-12-15 17:29 16,896 --a------ c:\windows\system32\4560BFF.EXE

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-12-08 11:32 17,528 ----a-w c:\documents and settings\Fernilson\Dados de aplicativos\GDIPFONTCACHEV1.DAT

2008-12-04 08:26 111,281 ----a-w c:\documents and settings\Fernilson\wxp.exe

2008-11-30 21:30 30,720 ----a-w c:\documents and settings\Fernilson\skp66.exe

2008-11-26 15:34 --------- d-----w c:\arquivos de programas\Masfoot 2006

2008-11-25 08:50 --------- d-----w c:\arquivos de programas\XeFlashPlayer

2008-11-19 01:54 --------- d-----w c:\arquivos de programas\MSN Messenger

2008-11-17 20:31 --------- d--h--w c:\arquivos de programas\InstallShield Installation Information

2008-11-17 20:31 --------- d-----w c:\documents and settings\Fernilson\Dados de aplicativos\InstallShield

2008-11-17 20:31 --------- d-----w c:\arquivos de programas\Vimicro

2008-10-28 00:09 315,392 ----a-w c:\windows\HideWin.exe

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-16 7630848]

"SMSERIAL"="c:\arquivos de programas\Motorola\SMSERIAL\sm56hlpr.exe" [2006-09-14 651264]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-16 86016]

"Adobe Reader Speed Launcher"="c:\arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 218992]

"ZSSnp211"="c:\windows\ZSSnp211.exe" [2007-04-06 131072]

"Domino"="c:\windows\Domino.exe" [2006-08-18 49152]

"XP-5CED94A8"="c:\windows\system32\XP-5CED94A8.EXE" [2008-12-01 1586572]

"nwiz"="nwiz.exe" [2006-08-16 c:\windows\system32\nwiz.exe]

"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]

"RTHDCPL"="RTHDCPL.EXE" [2006-12-19 c:\windows\RTHDCPL.exe]

"Barsaka"="explorer.exe" [2008-04-14 c:\windows\explorer.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\Fernilson\Menu Iniciar\Programas\Inicializar\

.lnk - c:\windows\system32\XP-5CED94A8.EXE [2008-12-01 1586572]

c:\documents and settings\All Users.WINDOWS\Menu Iniciar\Programas\Inicializar\

Microsoft Office.lnk - c:\arquivos de programas\Microsoft Office\Office10\OSA.EXE [2001-02-13 157088]

Reboot.exe [2006-12-29 409088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableTaskMgr"= 1 (0x1)

"DisableRegistryTools"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.ffds"= ffdshow.ax

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"FirewallDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"AntiVirusOverride"=dword:00000001

"AntiVirusDisableNotify"=dword:00000001

"FirewallDisableNotify"=dword:00000001

"FirewallOverride"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\Motorola\\SMSERIAL\\sm56hlpr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\system32\\nwiz.exe"=

"c:\\Arquivos de programas\\Microsoft Office\\Office10\\OSA.EXE"=

"c:\\WINDOWS\\system32\\userinit.exe"=

"c:\\WINDOWS\\RTHDCPL.EXE"=

"c:\\Arquivos de programas\\MSN Messenger\\usnsvc.exe"=

"c:\\WINDOWS\\system32\\wuauclt.exe"=

"c:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\LXBZPSWX.EXE"=

"c:\\Arquivos de programas\\Mozilla Firefox\\firefox.exe"=

"c:\\Arquivos de programas\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe"=

"c:\\WINDOWS\\system32\\bndmss.exe"=

"c:\\Documents and Settings\\Fernilson\\skp66.exe"=skp66.exe

"skp66.exe"= skp66.exe:BNDMSS

"c:\\WINDOWS\\system32\\netsh.exe"=

"c:\\WINDOWS\\ALCMTR.EXE"=

"c:\\WINDOWS\\ZSSnp211.exe"=

"c:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\MSN Messenger\\livecall.exe"=

"c:\\WINDOWS\\system32\\sol.exe"=

"c:\\Arquivos de programas\\Windows Media Player\\wmplayer.exe"=

"c:\\WINDOWS\\System32\\Tools\\DelFolders.exe"=

"c:\\WINDOWS\\system32\\XP-5CED94A8.EXE"=

"c:\\WINDOWS\\system32\\C2CE.EXE"=

"c:\\WINDOWS\\system32\\mshearts.exe"=

"c:\\WINDOWS\\Domino.exe"=

"c:\\WINDOWS\\system32\\DF7BE.EXE"=

"c:\\WINDOWS\\system32\\freecell.exe"=

"c:\\ComboFix\\NirCmd.cfexe"=

R0 GbpKm;Gbp KernelMode;c:\windows\system32\drivers\gbpkm.sys [2008-12-24 31296]

R3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\jniem.sys --> c:\windows\system32\drivers\jniem.sys [?]

R4 BNDMSS;Windows Network Data Management System Service;c:\windows\system32\bndmss.exe [2008-11-09 30720]

S3 SQTECH9160;Digital Camera;c:\windows\system32\drivers\Capt9160.sys [2008-10-28 45711]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - BNDMSS

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1165ded0-088e-11dd-b119-001bb9923f0e}]

\shELl\AUtoPLaY\CoMmaNd - E:\uubfbc.pif

\shELl\AutoRun\command - E:\uubfbc.pif

\shELl\explore\Command - E:\uubfbc.pif

\shELl\opEn\CommanD - E:\uubfbc.pif

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4365a4a2-dbfb-11dc-86ba-dab8cdb64535}]

\Shell\AutoRun\command - E:\Recycled.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5058be38-b29d-11dc-85d6-001bb9923f0e}]

\Shell\1\Command - E:\Recycled.exe

\Shell\2\Command - E:\Recycled.exe

\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6ec711a9-886d-11dc-84ee-001bb9923f0e}]

\Shell\1\Command - F:\Recycled.exe

\Shell\2\Command - F:\

\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f3d5cb4-cf81-11dd-b9b1-001bb9923f0e}]

\Shell\1\Command - E:\Recycled.exe

\Shell\2\Command - E:\Recycled.exe

\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled.exe

.

- - - - ORFÃOS REMOVIDOS - - - -

HKCU-Run-NitroPC - c:\arquivos de programas\NitroPC\NitroPC.exe

.

------- Scan Suplementar -------

.

uInternet Connection Wizard,ShellNext = iexplore

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\Office10\EXCEL.EXE/3000

TCP: {C42F28EA-3D2B-41C1-BA4B-F8E16335B24D} = 200.222.0.34 200.202.193.75

c:\windows\Downloaded Program Files\gbpdist.dll - O16 -: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931}

hxxps://imagem.caixa.gov.br/cab/gbpdist.cab

c:\windows\Downloaded Program Files\gbpdist.inf

FF - ProfilePath - c:\documents and settings\Fernilson\Dados de aplicativos\Mozilla\Firefox\Profiles\1krgw69w.default\

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-01-09 19:59:11

Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

c:\windows\system32\shell.fne 40960 bytes executable

c:\windows\system32\spec.fne 73728 bytes executable

c:\windows\system32\ul.dll 1868 bytes

Varredura completada com sucesso

arquivos/ficheiros ocultos: 3

**************************************************************************

.

------------------------ Outros Processos em Execução ------------------------

.

c:\windows\system32\LEXBCES.EXE

c:\windows\system32\LEXPPS.EXE

c:\windows\system32\nvsvc32.exe

c:\windows\system32\wdfmgr.exe

c:\windows\system32\rundll32.exe

c:\windows\system32\netsh.exe

.

**************************************************************************

.

Tempo para conclusão: 2009-01-09 20:07:57 - Máquina reiniciou

ComboFix-quarantined-files.txt 2009-01-09 22:07:52

PrÚ-execuþÒo: 12 pasta(s) 23.127.359.488 bytes dispon¡veis

P¾s execuþÒo: 12 pasta(s) 23,066,722,304 bytes dispon¡veis

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

238 --- E O F --- 2008-12-20 03:54:35

MGuitar · Janeiro 10, 2009

1ª Etapa

Acesse o VirusTotal. Copie este caminho em negrito abaixo e cole ao lado do botão . Clique em Enviar Arquivo e aguarde.

c:\windows\system32\XP-5CED94A8.EXE

Copie o link que estará em frente ao nome Permalink e cole-o aqui. Veja na imagem:

Logo após, faça o mesmo procedimento, mas agora, colando o seguinte caminho > c:\windows\system32\DF7BE.EXE.

Poste o relatório das duas análises.

2ª Etapa

Delete a pasta C:\Qoobox e o log C:\ComboFix.txt.

Selecione e copie todo este conteúdo aqui abaixo (começando de Driver). Cole o conteúdo copiado no Bloco de Notas de seu PC e salve-o no desktop como CFScript.txt

Driver::abp470n5BNDMSSFile::C:\a73cC:\a028C:\b18dC:\151d4c:\windows\system32\winzareg.exec:\windows\system32\winzcreg.exec:\windows\system32\winycreg.exec:\windows\system32\winxcreg.exec:\windows\system32\4560BFF.EXEc:\documents and settings\Fernilson\Dados de aplicativos\GDIPFONTCACHEV1.DATc:\documents and settings\Fernilson\wxp.exec:\documents and settings\Fernilson\skp66.exec:\windows\system32\drivers\jniem.sysc:\windows\system32\bndmss.exeE:\uubfbc.pifE:\Recycled.exec:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled.exeF:\Recycled.exeRootkit::c:\windows\system32\shell.fne c:\windows\system32\spec.fne c:\windows\system32\ul.dllRegistry::[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Barsaka"=""[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]"DisableTaskMgr"=-"DisableRegistryTools"=-[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"c:\\Documents and Settings\\Fernilson\\skp66.exe"=-"skp66.exe"=-[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1165ded0-088e-11dd-b119-001bb9923f0e}][-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4365a4a2-dbfb-11dc-86ba-dab8cdb64535}][-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5058be38-b29d-11dc-85d6-001bb9923f0e}][-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6ec711a9-886d-11dc-84ee-001bb9923f0e}][-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f3d5cb4-cf81-11dd-b9b1-001bb9923f0e}]

Arraste o CFScript para o ComboFix como na imagem aqui abaixo e aguarde a execução automática da ferramenta:

● Se for solicitado à você, pressione Enter para iniciar o processo de remoção;

● Não use o mouse nem o teclado quando o ComboFix estiver rodando;

● Quando terminar, será gerado um novo log que estará em C:\ComboFix.txt;

● Talvez seu computador seja reiniciado automaticamente. Caso não ocorra, reinicie-o manualmente.

Na sua próxima resposta, cole o novo ComboFix.txt e os resultados da análise no VirusTotal.

cobradorf · Janeiro 13, 2009

Não sei se por minha conexão ser discada, não estou conseguindo abrir o http://www.virustotal.com/pt/, a página não abre....

MGuitar · Janeiro 13, 2009

Ok, não precisa fazer o procedimento no VirusTotal.

Prossiga com a "2ª Etapa" e faça o procedimento com o ComboFix.

cobradorf · Janeiro 14, 2009

A tela que aparece é essa: O ComboFix.exe encontrou um problema e precisa ser fechado....

MGuitar · Janeiro 15, 2009

- Faça o download do OTMoveIt3 e salve no desktop;

● Dê um duplo clique no ícone do programa (OTMoveIt3) para executá-lo;

● Selecione e copie todo este conteúdo aqui abaixo dentro do code:

:Processesexplorer.exe:Servicesabp470n5BNDMSS:FilesC:\a73cC:\a028C:\b18dC:\151d4c:\windows\system32\winzareg.exec:\windows\system32\winzcreg.exec:\windows\system32\winycreg.exec:\windows\system32\winxcreg.exec:\windows\system32\4560BFF.EXEc:\documents and settings\Fernilson\Dados de aplicativos\GDIPFONTCACHEV1.DATc:\documents and settings\Fernilson\wxp.exec:\documents and settings\Fernilson\skp66.exec:\windows\system32\drivers\jniem.sysc:\windows\system32\bndmss.exec:\windows\system32\shell.fnec:\windows\system32\spec.fnec:\windows\system32\ul.dllE:\uubfbc.pifE:\Recycled.exec:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled.exeF:\Recycled.exe:Reg[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Barsaka"=""[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]"DisableTaskMgr"=-"DisableRegistryTools"=-[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"c:\\Documents and Settings\\Fernilson\\skp66.exe"=-"skp66.exe"=-[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1165ded0-088e-11dd-b119-001bb9923f0e}][-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4365a4a2-dbfb-11dc-86ba-dab8cdb64535}][-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5058be38-b29d-11dc-85d6-001bb9923f0e}][-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6ec711a9-886d-11dc-84ee-001bb9923f0e}][-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f3d5cb4-cf81-11dd-b9b1-001bb9923f0e}]:Commands[purity][emptytemp][start explorer][Reboot]

● Cole o que você copiou no programa (no espaço em branco da janela);

● Clique no botão MoveIt;

● Se aparecer uma mensagem para reiniciar o computador, reinicie-o;

● Na sua proxima resposta, copie e cole o todo o conteúdo que está em Results;

● Se o computador reiniciou, vá na pasta C:\_OTMoveIt\MovedFiles, e abra o mais recente arquivo .log presente. Copie e cole todo o conteúdo desse arquivo.

cobradorf · Janeiro 15, 2009

========== PROCESSES ==========

Process explorer.exe killed successfully.

========== SERVICES/DRIVERS ==========

Unable to stop service abp470n5 .

Service BNDMSS stopped successfully.

Service BNDMSS deleted successfully.

========== FILES ==========

File/Folder C:\a73c not found.

File/Folder C:\a028 not found.

File/Folder C:\b18d not found.

File/Folder C:\151d4 not found.

File/Folder c:\windows\system32\winzareg.exe not found.

File/Folder c:\windows\system32\winzcreg.exe not found.

File/Folder c:\windows\system32\winycreg.exe not found.

File/Folder c:\windows\system32\winxcreg.exe not found.

File/Folder c:\windows\system32\4560BFF.EXE not found.

File/Folder c:\documents and settings\Fernilson\Dados de aplicativos\GDIPFONTCACHEV1.DAT not found.

File/Folder c:\documents and settings\Fernilson\wxp.exe not found.

File/Folder c:\documents and settings\Fernilson\skp66.exe not found.

File/Folder c:\windows\system32\drivers\jniem.sys not found.

File/Folder c:\windows\system32\bndmss.exe not found.

c:\windows\system32\shell.fne moved successfully.

c:\windows\system32\spec.fne moved successfully.

LoadLibrary failed for c:\windows\system32\ul.dll

c:\windows\system32\ul.dll NOT unregistered.

File move failed. c:\windows\system32\ul.dll scheduled to be moved on reboot.

File/Folder E:\uubfbc.pif not found.

File/Folder E:\Recycled.exe not found.

File/Folder c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled.exe not found.

File/Folder F:\Recycled.exe not found.

========== REGISTRY ==========

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\"Barsaka"|"" /E : value set successfully!

Registry value HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system\\DisableTaskMgr deleted successfully.

Registry value HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system\\DisableRegistryTools deleted successfully.

Registry key HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List not found.

Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1165ded0-088e-11dd-b119-001bb9923f0e}\\ not found.

Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4365a4a2-dbfb-11dc-86ba-dab8cdb64535}\\ not found.

Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5058be38-b29d-11dc-85d6-001bb9923f0e}\\ not found.

Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6ec711a9-886d-11dc-84ee-001bb9923f0e}\\ not found.

Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f3d5cb4-cf81-11dd-b9b1-001bb9923f0e}\\ not found.

========== COMMANDS ==========

File delete failed. C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\E_4\com.run scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\E_4\dp1.fne scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\E_4\eAPI.fne scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\E_4\internet.fne scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\E_4\krnln.fnr scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\E_4\shell.fne scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\00016155_Rar\XP-5CED94A8.EXE scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\etilqs_9Dx6MNoe447V3rbeuAHt scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\tufwt.exe scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\winbmlcq.exe scheduled to be deleted on reboot.

File delete failed. C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\winhnres.exe scheduled to be deleted on reboot.

User's Temp folder emptied.

User's Temporary Internet Files folder emptied.

User's Internet Explorer cache folder emptied.

Local Service Temp folder emptied.

Local Service Temporary Internet Files folder emptied.

Windows Temp folder emptied.

File delete failed. C:\Documents and Settings\Fernilson\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\1krgw69w.default\Cache\453C1F77d01 scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Fernilson\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\1krgw69w.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Fernilson\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\1krgw69w.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Fernilson\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\1krgw69w.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Fernilson\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\1krgw69w.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Fernilson\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\1krgw69w.default\urlclassifier3.sqlite scheduled to be deleted on reboot.

FireFox cache emptied.

Temp folders emptied.

Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01152009_180611

Files moved on Reboot...

LoadLibrary failed for c:\windows\system32\ul.dll

c:\windows\system32\ul.dll NOT unregistered.

c:\windows\system32\ul.dll moved successfully.

C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\E_4\com.run moved successfully.

C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\E_4\dp1.fne moved successfully.

C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\E_4\eAPI.fne moved successfully.

C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\E_4\internet.fne moved successfully.

C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\E_4\krnln.fnr moved successfully.

C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\E_4\shell.fne moved successfully.

C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\00016155_Rar\XP-5CED94A8.EXE moved successfully.

File C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\etilqs_9Dx6MNoe447V3rbeuAHt not found!

C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\tufwt.exe moved successfully.

C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\winbmlcq.exe moved successfully.

C:\DOCUME~1\FERNIL~1\CONFIG~1\Temp\winhnres.exe moved successfully.

C:\Documents and Settings\Fernilson\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\1krgw69w.default\Cache\453C1F77d01 moved successfully.

C:\Documents and Settings\Fernilson\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\1krgw69w.default\Cache\_CACHE_001_ moved successfully.

C:\Documents and Settings\Fernilson\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\1krgw69w.default\Cache\_CACHE_002_ moved successfully.

C:\Documents and Settings\Fernilson\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\1krgw69w.default\Cache\_CACHE_003_ moved successfully.

C:\Documents and Settings\Fernilson\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\1krgw69w.default\Cache\_CACHE_MAP_ moved successfully.

C:\Documents and Settings\Fernilson\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\1krgw69w.default\urlclassifier3.sqlite moved successfully.

MGuitar · Janeiro 15, 2009

- Faça o download do RSIT e salve no seu desktop;

● Dê dois cliques em RSIT.exe para executar o programa;

● Na janela que abrir clique no botão Continue para que a ferramenta comece a rodar;

● Quando a ferramenta terminar de rodar, abrirá um log automaticamente no bloco de notas contendo o resultado do scan. Cole o resultado desse log (log.txt) na sua próxima resposta;

● Cole também o conteúdo do arquivo info.txt que estará em C:\rsit\info.txt.

cobradorf · Janeiro 16, 2009

Logfile of random's system information tool 1.05 (written by random/random)

Run by Fernilson at 2009-01-16 05:07:18

Microsoft Windows XP Professional Service Pack 3

System drive C: has 19 GB (50%) free of 38 GB

Total RAM: 446 MB (28% free)