[Arquivado] Log do Hijackthis

silmawiel · Janeiro 5, 2009

Não sei qual o problema, gostaria que me ajudassem a identificar!

Obrigada!

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:05:51, on 5/1/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe

C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe

C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\tcpsvcs.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe

C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe

C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Arquivos de programas\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\sistray.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\TIM Web Banda Larga\TIM Web Banda Larga.exe

C:\Arquivos de programas\TIM Web Banda Larga\UpdateUI.exe

C:\Arquivos de programas\Adobe\Reader 8.0\Reader\AcroRd32.exe

C:\WINDOWS\system32\notepad.exe

C:\Documents and Settings\Carol e Jaime\Desktop\HiJackThis.exe

C:\Arquivos de programas\Windows NT\Acessórios\wordpad.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O4 - HKLM\..\Run: [soundMax] "C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [soundMAXPnP] C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [siSRaid] C:\Arquivos de programas\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

O4 - HKLM\..\Run: [siSPower] Rundll32.exe SiSPower.dll,ModeAgent

O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKLM\..\Policies\Explorer\Run: [TABAJARA-809F1B] .vbe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\ARQUIV~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~3\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1230947774968

O17 - HKLM\System\CCS\Services\Tcpip\..\{990BD5DB-51C9-436E-946A-0866F5A0F7D4}: NameServer = 189.40.224.5 10.223.246.102

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

--

End of file - 5514 bytes

Sam Spade · Janeiro 5, 2009

Olá silmawiel! Sabe algo sobre essa entrada?

O4 - HKLM\..\Policies\Explorer\Run: [TABAJARA-809F1B] .vbe

silmawiel · Janeiro 6, 2009

Tentei pesquisar sobre ele e é um virus que tá na net desde abril do ano passado, mas não sei como tirá-lo, preciso que me ajudem!

silmawiel · Janeiro 7, 2009

Ta ae o que consegui!

Vírus VBS/Autorun.VF

Data em que surgiu: 18/04/2008

Tipo: Worm

Incluído na lista "In The Wild" Sim

Nível de danos: De baixo a médio

Nível de distribuição: De baixo a médio

Nível de risco: De baixo a médio

Ficheiro estático: Não

Tamanho: ~18.000 Bytes

Versão IVDF: 7.00.03.188

Vulgarmente Meio de transmissão:

• Unidade de rede

Alias:

• Mcafee: W32/Autorun.worm.cg

• Kaspersky: Worm.VBS.Autorun.r

• TrendMicro: VBS_AGENT.AMAF

• F-Secure: Worm.VBS.Autorun.r

• Sophos: VBS/Autorun-EC

• Bitdefender: Worm.VBS.Autorun.D

Sistemas Operativos:

• Windows 98

• Windows 98 SE

• Windows NT

• Windows ME

• Windows 2000

• Windows XP

• Windows 2003

Efeitos secundários:

• Acesso à disquete

• Descarrega ficheiros

• Altera o registo do Windows

Ficheiros Autocopia-se para as seguintes localizações

• %SYSDIR%\.vbe

• %SYSDIR%\wbem\.vbe

• %unidade%:\.vbe

São criados os seguintes ficheiros:

– %unidade%:\autorun.inf É um ficheiro de texto não malicioso com o seguinte conteúdo:

•

Registry (Registo do Windows) É adicionado o seguinte valor ao registo do Windows de forma a que o processo seja executado depois do computador ser reiniciado:

– [HKLM\software\microsoft\windows\currentversion\policies\explorer\

run]

• %nome do computador% = .vbe

É adicionada a seguinte chave de registo:

– [HKLM\software\%nome do computador%]

• %dependente do sistema%

O seguinte valor do registo é alterado:

Desactiva o Regedit e o Gestor de Tarefas:

– [HKCU\software\microsoft\windows\currentversion\explorer\advanced]

Valor recente:

• showsuperhidden = 0

silmawiel · Janeiro 7, 2009

Olá, passei o antivirus panda online e o relatorio é este que se apresenta ai embaixo!

;*******************************************************************************

*********************************************************************************

*******************

ANALYSIS: 2009-01-07 09:29:12

PROTECTIONS: 0

MALWARE: 7

SUSPECTS: 0

;*******************************************************************************

*********************************************************************************

*******************

PROTECTIONS

Description Version Active Updated

;===============================================================================

=================================================================================

===================

;===============================================================================

=================================================================================

===================

MALWARE

Id Description Type Active Severity Disinfectable Disinfected Location

;===============================================================================

=================================================================================

===================

00055522 Eicar.Mod Virus No 0 No No C:\System Volume Information\_restore{93FC3F7D-921A-442C-93AD-FCCF59ED3ACC}\RP3\A0002181.exe[eicar.html]

00055522 Eicar.Mod Virus No 0 No No C:\System Volume Information\_restore{93FC3F7D-921A-442C-93AD-FCCF59ED3ACC}\RP3\A0004890.exe[eicar.html]

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Carol e Jaime\Cookies\carol e jaime@atdmt[2].txt

00140033 Trj/Zapchast.I Virus/Trojan No 0 Yes Yes C:\System Volume Information\_restore{93FC3F7D-921A-442C-93AD-FCCF59ED3ACC}\RP3\A0002570.EXE

00140033 Trj/Zapchast.I Virus/Trojan No 0 Yes Yes C:\System Volume Information\_restore{93FC3F7D-921A-442C-93AD-FCCF59ED3ACC}\RP3\A0004498.EXE

00170553 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Carol e Jaime\Cookies\carol e jaime@ig.com[2].txt

00170559 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Carol e Jaime\Cookies\carol e jaime@uol.com[1].txt

00366244 Application/NirCmd.A HackTools No 0 No No C:\Downloads\Flash_Disinfector.exe[C:\Downloads\Flash_Disinfector.exe][nircmd.exe]

00366244 Application/NirCmd.A HackTools No 0 No No C:\Documents and Settings\Carol e Jaime\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\9foj6znw.default\Cache\DF9A30BCd01[C:\Documents and Settings\Carol e Jaime\Configura├º├╡es locais\Dados de aplicativos\Mozilla\Firefox\Profiles\9foj6znw.default\Cache\DF9A30BCd01][nircmd.exe]

00509861 Hacktool/AngryScan HackTools No 1 Yes No C:\System Volume Information\_restore{93FC3F7D-921A-442C-93AD-FCCF59ED3ACC}\RP3\A0001725.EXE

00509861 Hacktool/AngryScan HackTools No 1 Yes No C:\System Volume Information\_restore{93FC3F7D-921A-442C-93AD-FCCF59ED3ACC}\RP3\A0005346.EXE

;===============================================================================

=================================================================================

===================

SUSPECTS

Sent Location &

;===============================================================================

=================================================================================

===================

;===============================================================================

=================================================================================

===================

VULNERABILITIES

Id Severity Description &

;===============================================================================

=================================================================================

===================

184380 MEDIUM MS08-002 &

184379 MEDIUM MS08-001 &

182048 HIGH MS07-069 &

182046 HIGH MS07-067 &

182043 HIGH MS07-064 &

179553 HIGH MS07-061 &

176382 HIGH MS07-057 &

176383 HIGH MS07-058 &

170911 HIGH MS07-050 &

170907 HIGH MS07-046 &

170906 HIGH MS07-045 &

170904 HIGH MS07-043 &

164915 HIGH MS07-035 &

164913 HIGH MS07-033 &

164911 HIGH MS07-031 &

160623 HIGH MS07-027 &

157262 HIGH MS07-022 &

157261 HIGH MS07-021 &

157260 HIGH MS07-020 &

157259 HIGH MS07-019 &

156477 HIGH MS07-017 &

150253 HIGH MS07-016 &

150249 HIGH MS07-013 &

150248 HIGH MS07-012 &

150247 HIGH MS07-011 &

150243 HIGH MS07-008 &

150242 HIGH MS07-007 &

150241 MEDIUM MS07-006 &

141034 HIGH MS06-076 &

141033 MEDIUM MS06-075 &

141030 HIGH MS06-072 &

137571 HIGH MS06-070 &

137568 HIGH MS06-067 &

133387 MEDIUM MS06-065 &

133386 MEDIUM MS06-064 &

133385 MEDIUM MS06-063 &

133379 HIGH MS06-057 &

131654 HIGH MS06-055 &

129977 MEDIUM MS06-053 &

129976 MEDIUM MS06-052 &

126093 HIGH MS06-051 &

126092 MEDIUM MS06-050 &

126087 HIGH MS06-046 &

126086 MEDIUM MS06-045 &

126083 HIGH MS06-042 &

126082 HIGH MS06-041 &

126081 HIGH MS06-040 &

123421 HIGH MS06-036 &

123420 HIGH MS06-035 &

120825 MEDIUM MS06-032 &

120823 MEDIUM MS06-030 &

120818 HIGH MS06-025 &

120815 HIGH MS06-022 &

120814 HIGH MS06-021 &

117384 MEDIUM MS06-018 &

114666 HIGH MS06-015 &

114664 HIGH MS06-013 &

108744 MEDIUM MS06-008 &

108743 MEDIUM MS06-007 &

108742 MEDIUM MS06-006 &

104567 HIGH MS06-002 &

104237 HIGH MS06-001 &

96574 HIGH MS05-053 &

93395 HIGH MS05-051 &

93394 HIGH MS05-050 &

93454 MEDIUM MS05-049 &

;===============================================================================

=================================================================================

===================

Sam Spade · Janeiro 7, 2009

Ok, baixe -> Random's System Information Tool (RSIT), de random/random

Salve na sua área de trabalho.

Execute o RSIT.exe, e na janela que vai abrir, clique em Continue.

Quando terminar, dois blocos de notas serão abertos:

log.txt -> abrirá maximizado

info.txt -> abrirá minimizado.

Copie o conteúdo dos arquivos info.txt e log.txt e cole na sua resposta.

Uma cópia desses arquivos ficará salva na pasta C:\RSIT

Obs: Se o seu firewall alertar sobre o arquivo rsit.exe tentando se conectar, certifique-se de permitir (allow).

silmawiel · Janeiro 9, 2009

Logfile of random's system information tool 1.05 (written by random/random)

Run by Carol e Jaime at 2009-01-08 22:07:15

Microsoft Windows XP Professional Service Pack 2

System drive C: has 70 GB (91%) free of 76 GB

Total RAM: 222 MB (12% free)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:08:14, on 8/1/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\ESET\ESET Smart Security\ekrn.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe

C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

C:\Arquivos de programas\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Google\Google Talk\googletalk.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\Arquivos de programas\ESET\ESET Smart Security\egui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\tcpsvcs.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\sistray.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\TIM Web Banda Larga\TIM Web Banda Larga.exe

C:\Arquivos de programas\TIM Web Banda Larga\UpdateUI.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Carol e Jaime\Desktop\RSIT.exe

C:\Arquivos de programas\trend micro\Carol e Jaime.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre6\bin\ssv.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [soundMax] "C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [soundMAXPnP] C:\Arquivos de programas\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [siSRaid] C:\Arquivos de programas\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

O4 - HKLM\..\Run: [siSPower] Rundll32.exe SiSPower.dll,ModeAgent

O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [googletalk] C:\Arquivos de programas\Google\Google Talk\googletalk.exe /autostart

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [egui] "C:\Arquivos de programas\ESET\ESET Smart Security\egui.exe" /hide /waitservice