[Arquivado] virus!

shanjay · Janeiro 17, 2009

Eu vi em outro topico para postar junto o log do hijack e do combofix, então eu postei os dois.

desde ja agradeço a todos.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:51:21, on 16/01/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\wbem\wmiapsrv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\alg.exe

C:\Arquivos de programas\VPN - SSP-GO\bin\openvpn-gui.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\WINDOWS\Help\seguracas.exe

C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe

C:\WINDOWS\systemq.exe

C:\WINDOWS\system32\ree1.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Help\Firewall.exe

C:\HijackThis\HiJackThis.exe

C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = &http://home.microsoft.com/intl/br/access/allinone.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.11.0.13:3128

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = intranet;*.tst.gov.br;<local>

R3 - URLSearchHook: Barra de Ferramentas do Yahoo! com bloqueador de pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {0199F80B-C612-46F0-8D48-D18F7FE86212} - C:\WINDOWS\system32\wgkuisab.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre6\bin\ssv.dll

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\Downloaded Program Files\gbieh.dll (file missing)

O2 - BHO: (no name) - {CD559F99-640C-4E58-B3A0-632495C9B66A} - c:\windows\system32\fsshtae.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Barra de Ferramentas do Yahoo! com bloqueador de pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [openvpn-gui] C:\Arquivos de programas\VPN - SSP-GO\bin\openvpn-gui.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [seguracas] C:\WINDOWS\Help\seguracas.exe

O4 - HKLM\..\Run: [AVP] "C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"

O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe

O4 - HKCU\..\Run: [NitroPC] "C:\Documents and Settings\Administrador\Meus documentos\NitroPC\NitroPC.exe" -minimized

O4 - HKCU\..\Run: [explorer] C:\WINDOWS\systemq.exe

O4 - HKCU\..\Run: [iexplorerskut] C:\WINDOWS\system32\ree1.exe

O4 - HKCU\..\Run: [star1] C:\WINDOWS\system32\Winrun.exe

O4 - HKCU\..\Run: [star2] C:\WINDOWS\system32\ischot.exe

O4 - HKCU\..\Run: [star3] C:\WINDOWS\system32\Xred1.exe

O4 - HKCU\..\Run: [star4] C:\WINDOWS\system32\Zred2.exe

O4 - HKCU\..\Run: [star6] C:\WINDOWS\system32\MscheldB.exe

O4 - HKCU\..\Run: [star7] C:\WINDOWS\system32\Mscheldncx.exe

O4 - HKCU\..\Run: [star8] C:\WINDOWS\system32\svscheld.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Estatísticas do Antivírus da Web - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) -

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399F83} (GbPluginObj Class) - https://www14.bancobrasil.com.br/plugin/GbPluginBb.cab

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ssp-go.sspj.go.gov.br

O17 - HKLM\Software\..\Telephony: DomainName = ssp-go.sspj.go.gov.br

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ssp-go.sspj.go.gov.br

O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = ssp-go.sspj.go.gov.br

O20 - AppInit_DLLs: C:\WINDOWS\System32\cryptdll32.dll

O20 - Winlogon Notify: 14f6a245511 - C:\WINDOWS\

O20 - Winlogon Notify: jmparwfr - C:\WINDOWS\SYSTEM32\fsshtae.dll

O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Arquivos de programas\VPN - SSP-GO\bin\openvpnserv.exe

O24 - Desktop Component 0: (no name) - file:///C:/WINDOWS/TEMP/msohtml1/01/clip_image001.gif

--

End of file - 6668 bytes

LOG DO COMBOFIX.

ComboFix 09-01-15.01 - Administrador 2009-01-17 0:13:57.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.247.93 [GMT -2:00]

Executando de: C:\Documents and Settings\Administrador\Desktop\ComboFix.exe

AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated)

* Criado um novo ponto de restauro

ATENÇAO - ESTA MAQUINA NAO TEM O CONSOLE DE RECUPERAÇÃO INSTALADA !!

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Arquivos de programas\Mjcore

C:\Autorun.inf

C:\Documents and Settings\Administrador\Abn.gpc, Cef.gpc, gbieh.gmd, gbiehuni.dll , GBIEHCEF.DLL , gbiehabn.dll, gbpdist.dll', PChar('Abn.gpc, Cef.gpc, gbieh.gmd, gbiehuni.dll , GBIEHCEF.DLL , gbiehabn.dll, gbpdist.dll

C:\Documents and Settings\Administrador\Abn.gpc, Cef.gpc, gbieh.gmd, gbiehuni.dll , GBIEHCEF.DLL , gbiehabn.dll, gbpdist.dll', PChar('Abn.gpc, Cef.gpc, gbieh.gmd, gbiehuni.dll , GBIEHCEF.DLL , gbiehabn.dll, gbpdist.dll\desktop.ini

C:\Documents and Settings\Administrador\Abn.gpc, Cef.gpc, gbieh.gmd, gbiehuni.dll , GBIEHCEF.DLL , gbiehabn.dll, gbpdist.dll', PChar('Abn.gpc, Cef.gpc, gbieh.gmd, gbiehuni.dll , GBIEHCEF.DLL , gbiehabn.dll, gbpdist.dll\FP_AX_CAB_INSTALLER.exe

C:\Documents and Settings\Administrador\Abn.gpc, Cef.gpc, gbieh.gmd, gbiehuni.dll , GBIEHCEF.DLL , gbiehabn.dll, gbpdist.dll', PChar('Abn.gpc, Cef.gpc, gbieh.gmd, gbiehuni.dll , GBIEHCEF.DLL , gbiehabn.dll, gbpdist.dll\swflash.inf

C:\Documents and Settings\Administrador\Dados de aplicativos\020000008beb06f3511C.manifest

C:\Documents and Settings\Administrador\Dados de aplicativos\020000008beb06f3511O.manifest

C:\Documents and Settings\Administrador\Dados de aplicativos\020000008beb06f3511P.manifest

C:\Documents and Settings\Administrador\Dados de aplicativos\020000008beb06f3511S.manifest

C:\WINDOWS\GnuHashes.ini

C:\WINDOWS\IE4 Error Log.txt

C:\WINDOWS\ponto2.DLL

C:\WINDOWS\system32\GroupPolicy000.dat

C:\WINDOWS\system32\GroupPolicyManifest

C:\WINDOWS\system32\GroupPolicyManifest\14.music.mp3

C:\WINDOWS\system32\GroupPolicyManifest\14.music.mp3.kwd

C:\WINDOWS\system32\GroupPolicyManifest\15.crack.zip.kwd

C:\WINDOWS\system32\GroupPolicyManifest\16.video.zip.kwd

C:\WINDOWS\system32\GroupPolicyManifest\17.setup.zip.kwd

C:\WINDOWS\system32\GroupPolicyManifest\18.unpack.zip.kwd

C:\WINDOWS\system32\GroupPolicyManifest\19.keygen.zip.kwd

C:\WINDOWS\system32\GroupPolicyManifest\20.serial.zip.kwd

C:\WINDOWS\system32\GroupPolicyManifest\21.mpgvideo.mpg

C:\WINDOWS\system32\GroupPolicyManifest\21.mpgvideo.mpg.kwd

C:\WINDOWS\system32\instsrv.exe

C:\WINDOWS\TRANSFORMERS.DLL

.

((((((((((((((((((((((((((((((((((((((( Drivers/Serviços )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_FCI

-------\Legacy_SXBNYCII

-------\Service_sxbnycii

(((((((((((((((( Arquivos/Ficheiros criados de 2008-12-17 to 2009-01-17 ))))))))))))))))))))))))))))

.

2009-01-16 23:28 . 2009-01-16 23:28 <DIR> d-------- C:\Documents and Settings\Administrador\Dados de aplicativos\tnkwojci

2009-01-16 13:49 . 2009-01-16 23:51 <DIR> d-------- C:\HijackThis

2009-01-13 23:36 . 2009-01-14 00:44 96,976 --a------ C:\WINDOWS\system32\drivers\klin.dat

2009-01-13 23:36 . 2009-01-14 00:44 87,855 --a------ C:\WINDOWS\system32\drivers\klick.dat

2009-01-13 23:34 . 2009-01-16 13:29 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Kaspersky Lab

2009-01-13 23:34 . 2009-01-13 23:34 <DIR> d-------- C:\Arquivos de programas\Kaspersky Lab

2009-01-13 23:34 . 2009-01-17 00:30 1,202,464 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat

2009-01-13 23:34 . 2009-01-17 00:29 41,248 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat

2009-01-13 23:34 . 2009-01-17 00:24 17,108 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx

2009-01-13 23:34 . 2009-01-17 00:24 4,868 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx

2009-01-13 23:28 . 2009-01-13 23:28 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Kaspersky Lab Setup Files

2009-01-13 18:36 . 2009-01-13 18:36 <DIR> d-------- C:\WINDOWS\Sun

2009-01-13 15:31 . 2009-01-13 15:31 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\Avg8

2009-01-13 15:31 . 2009-01-13 15:31 262,144 --a------ C:\Documents and Settings\IN241E~8

2009-01-13 15:29 . 2009-01-13 15:29 262,144 --a------ C:\Documents and Settings\IN241E~7

2009-01-13 15:21 . 2009-01-13 15:21 262,144 --a------ C:\Documents and Settings\IN241E~6

2009-01-13 15:06 . 2009-01-13 15:06 <DIR> d-------- C:\Documents and Settings\Administrador\Dados de aplicativos\IObit

2009-01-13 15:06 . 2009-01-13 15:06 <DIR> d-------- C:\Arquivos de programas\IObit

2009-01-13 15:06 . 2008-04-17 16:19 90,668 --a------ C:\WINDOWS\system32\vobis32.dll

2009-01-12 22:41 . 2009-01-13 15:14 <DIR> d-------- C:\Documents and Settings\Administrador\Dados de aplicativos\AVGTOOLBAR

2009-01-12 22:34 . 2009-01-12 22:43 8,192 --a------ C:\Documents and Settings\IN241E~5

2009-01-12 22:32 . 2009-01-12 22:32 <DIR> d-------- C:\Arquivos de programas\ESET

2009-01-12 22:30 . 2009-01-12 22:30 262,144 --a------ C:\Documents and Settings\IN241E~4

2009-01-09 00:27 . 2009-01-09 07:34 <DIR> d---s---- C:\WINDOWS\Downloaded Program Files

2009-01-07 11:58 . 2009-01-07 11:58 <DIR> d-------- C:\Documents and Settings\All Users\Dados de aplicativos\ESET

2009-01-05 14:11 . 2009-01-05 14:11 974 --a------ C:\WINDOWS\HP

2009-01-05 14:11 . 2009-01-05 20:07 59 --a------ C:\WINDOWS\plugin.fax

2009-01-05 14:11 . 2009-01-05 14:11 8 --a------ C:\WINDOWS\control.ctr

2009-01-05 13:44 . 2009-01-06 13:30 <DIR> d-------- C:\WINDOWS\system32\Prefetchxs

2009-01-05 13:44 . 2009-01-05 13:44 853,091 ---hs---- C:\WINDOWS\system32\ree1.exe

2009-01-05 13:44 . 2009-01-05 13:44 360,300 ---hs---- C:\WINDOWS\systemq.exe

2009-01-05 00:37 . 2009-01-05 00:37 <DIR> d-------- C:\Arquivos de programas\Microsoft Games

2009-01-04 02:32 . 2008-12-05 13:24 106,607 -r-hs---- C:\iqosrtk.bat

2009-01-04 02:28 . 2009-01-04 02:28 262,144 --a------ C:\Documents and Settings\IN241E~3

2009-01-04 02:24 . 2009-01-04 02:28 8,192 --a------ C:\Documents and Settings\IN241E~2

2009-01-03 16:10 . 2009-01-04 02:33 <DIR> d-a------ C:\Documents and Settings\All Users\Dados de aplicativos\TEMP

2009-01-01 16:26 . 2009-01-01 16:26 373,760 --ahs---- C:\WINDOWS\system32\8B.tmp

2008-12-31 13:33 . 2009-01-01 19:02 <DIR> d-------- C:\Documents and Settings\Administrador\Dados de aplicativos\LimeWire

2008-12-31 13:29 . 2008-12-31 13:28 410,984 --a------ C:\WINDOWS\system32\deploytk.dll

2008-12-31 13:29 . 2008-12-31 13:28 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl

2008-12-31 13:27 . 2008-12-31 13:27 <DIR> d-------- C:\Arquivos de programas\Java

2008-12-31 12:52 . 2008-12-31 12:52 <DIR> d-------- C:\Sun

2008-12-30 07:39 . 2006-10-04 12:06 1,197,294 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb

2008-12-30 07:38 . 2008-12-30 07:38 <DIR> d-------- C:\Arquivos de programas\Windows Media Connect 2

2008-12-30 07:33 . 2008-12-30 07:35 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF

2008-12-25 21:17 . 2008-12-25 21:17 <DIR> d-------- C:\Arquivos de programas\Arquivos comuns\SWF Studio

2008-12-22 14:51 . 2009-01-13 10:07 <DIR> d-------- C:\Arquivos de programas\AVIConverter

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-16 20:15 --------- d-----w C:\Arquivos de programas\Arquivos comuns\Mozilla Shared

2009-01-14 02:45 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys

2009-01-09 09:51 --------- d-----w C:\Arquivos de programas\Alwil Software

2009-01-01 17:46 73,728 ----a-w C:\WINDOWS\Help\Firewall.exe

2009-01-01 17:46 65,536 ----a-w C:\WINDOWS\Help\seguracas.exe

2008-12-12 16:34 --------- d-----w C:\Arquivos de programas\VPN - SSP-GO

2004-12-09 16:22 27,136 -c--a-w C:\Documents and Settings\Administrador\envupdat.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0199F80B-C612-46F0-8D48-D18F7FE86212}]

2003-04-08 10:00 143872 --a------ C:\WINDOWS\system32\wgkuisab.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CD559F99-640C-4E58-B3A0-632495C9B66A}]

2003-04-08 10:00 105984 --a------ c:\windows\system32\fsshtae.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"iexplorerskut"="C:\WINDOWS\system32\ree1.exe" [2009-01-05 13:44 853091]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"openvpn-gui"="C:\Arquivos de programas\VPN - SSP-GO\bin\openvpn-gui.exe" [2008-06-23 17:33 99328]

"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre6\bin\jusched.exe" [2008-12-31 13:28 136600]

"seguracas"="C:\WINDOWS\Help\seguracas.exe" [2009-01-01 15:46 65536]

"AVP"="C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2008-02-08 18:36 227856]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 05:45 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jmparwfr]

2003-04-08 10:00 105984 C:\WINDOWS\system32\fsshtae.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=C:\WINDOWS\System32\cryptdll32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.X264"= x264vfw.dll

"VIDC.DIV3"= DivXc32.dll

"VIDC.DIV4"= DivXc32f.dll

"VIDC.3iv2"= 3ivxVfWCodec.dll

"VIDC.HFYU"= huffyuv.dll

"vidc.i263"= i263_32.drv

"VIDC.VP31"= vp31vfw.dll

"msacm.l3fhg"= mp3fhg.acm

"msacm.divxa32"= divxa32.acm

"msacm.imc"= imc32.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^HP Digital Imaging Monitor.lnk]

path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\HP Digital Imaging Monitor.lnk

backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

--a------ 2004-08-04 05:45 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

--a------ 2003-07-10 05:13 114688 C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

--a------ 2005-05-12 00:12 49152 C:\Arquivos de programas\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

--a------ 2003-07-10 05:25 155648 C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McAfeeUpdaterUI]

--a------ 2007-08-30 16:06 136512 C:\Arquivos de programas\McAfee\Common Framework\UdaterUI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Naldesk]

--a------ 2002-11-04 12:22 16384 C:\Publico\Script\Exe\NalInit.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"WinVNC4"=2 (0x2)

"Windows Packager"=2 (0x2)

"Pml Driver HPZ12"=2 (0x2)

"ose"=3 (0x3)

"OracleClientCache80"=3 (0x3)

"OCS INVENTORY"=2 (0x2)

"MDM"=2 (0x2)

"McAfeeFramework"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

R0 wdjylyyf;wdjylyyf;C:\WINDOWS\system32\drivers\wdjylyyf.sys [2003-04-08 10:00:00 23424]

R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\drivers\klim5.sys [2007-12-13 13:28:40 24592]

R3 tap0801;TAP-Win32 Adapter V8;C:\WINDOWS\system32\drivers\tap0801.sys [2008-06-23 17:33:30 26624]

R4 sxbnycii;Microcode Update Controller;C:\WINDOWS\System32\svchost.exe -k netsvcs [2003-04-08 10:00:00 14336]

S4 OCS INVENTORY;OCS INVENTORY SERVICE;C:\Arquivos de programas\OCS Inventory Agent\OcsService.exe [2008-04-21 10:03:22 69632]

S4 OracleClientCache80;OracleClientCache80;C:\Software\Oradev\BIN\ONRSD80.EXE --> C:\Software\Oradev\BIN\ONRSD80.EXE [?]

S4 Windows Packager;Windows Packager;C:\WINDOWS\system32\Srvany.exe [2005-10-19 15:47:44 8464]

--- ---

*NewlyCreated* - SXBNYCII

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{889326bc-49ec-11dd-b316-00112588021d}]

\Shell\AutoRun\command - 1u0o8bnq.cmd

\Shell\explore\Command - 1u0o8bnq.cmd

\Shell\open\Command - 1u0o8bnq.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bc4d56ca-9146-11dd-b3f0-00112588021d}]

\Shell\AutoRun\command - F:\dp.cmd

\Shell\explore\Command - F:\dp.cmd

\Shell\open\Command - F:\dp.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c86ea9c5-7298-11dd-b391-00112588021d}]

\Shell\AutoRun\command - F:\reswdd.exe

\Shell\explore\Command - F:\reswdd.exe

\Shell\open\Command - F:\reswdd.exe

.

- - - - ORFÃOS REMOVIDOS - - - -

HKCU-Run-NitroPC - C:\Documents and Settings\Administrador\Meus documentos\NitroPC\NitroPC.exe

HKCU-Run-star1 - C:\WINDOWS\system32\Winrun.exe

HKCU-Run-star2 - C:\WINDOWS\system32\ischot.exe

HKCU-Run-star3 - C:\WINDOWS\system32\Xred1.exe

HKCU-Run-star4 - C:\WINDOWS\system32\Zred2.exe

HKCU-Run-star6 - C:\WINDOWS\system32\MscheldB.exe

HKCU-Run-star7 - C:\WINDOWS\system32\Mscheldncx.exe

HKCU-Run-star8 - C:\WINDOWS\system32\svscheld.exe

Notify-14f6a245511 - (no file)

MSConfigStartUp-bne3 - C:\WINDOWS\system32\Bradesco_Pessoa_Jurídica.exe

MSConfigStartUp-msnmesseger - C:\Arquivos de programas\msnmmensser.exe

MSConfigStartUp-Somefox - C:\WINDOWS\TEMP\94.tmp.exe

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.google.com.br/

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyServer = 10.11.0.13:3128

uInternet Settings,ProxyOverride = intranet;*.tst.gov.br;<local>

IE: E&xportar para o Microsoft Excel - C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab

C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

FF - ProfilePath - C:\Documents and Settings\Administrador\Dados de aplicativos\Mozilla\Firefox\Profiles\i87ycxiq.default\

FF - prefs.js: network.proxy.type - 4

FF - plugin: C:\Arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: C:\Arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

---- FIREFOX POLICIES ----

C:\Arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

.

------- Associação de arquivos/ficheiros -------

.

DigRam · Janeiro 18, 2009

Boa Noite! shanjay

Insira sua(s) unidade(s) removíveis,caso às possua,na entrada USB. ( pendrive,mp3,mp4,iPods,etc... )

<@> Selecione e copie,todo o conteúdo que está na área do QUOTE,para o Bloco de Notas.

<@> Salve-o,no Desktop,com o nome: CFScript.txt

File::
C:\WINDOWS\system32\drivers\wdjylyyf.sys

C:\Documents and Settings\IN241E~3

C:\Documents and Settings\IN241E~2

C:\WINDOWS\system32\8B.tmp

C:\WINDOWS\system32\deploytk.dll

C:\WINDOWS\Help\Firewall.exe

C:\WINDOWS\Help\seguracas.exe

c:\windows\system32\fsshtae.dll

C:\WINDOWS\system32\wgkuisab.dll

C:\WINDOWS\system32\ree1.exe

C:\WINDOWS\systemq.exe

C:\iqosrtk.bat

F:\dp.cmd

F:\reswdd.exe

Registry::

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{889326bc-49ec-11dd-b316-00112588021d}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bc4d56ca-9146-11dd-b3f0-00112588021d}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c86ea9c5-7298-11dd-b391-00112588021d}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0199F80B-C612-46F0-8D48-D18F7FE86212}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CD559F99-640C-4E58-B3A0-632495C9B66A}]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jmparwfr]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"iexplorerskut"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"seguracas"=-

Folder::

C:\WINDOWS\system32\Prefetchxs

Dirlook::

C:\WINDOWS\Help

Driver::

"wdjylyyf"

"sxbnycii"

Netsvc::

"sxbnycii"

<@> Arraste,o CFScript.txt para o ícone/interior do ComboFix.

<@> Veja a demonstração!

<@> Atenda à solicitação,que deverá surgir,para rodar o ComboFix.

<@> Ps: Faça o arraste,até surgir essa solicitação! ( janela )

<@> Terminando,poste os relatórios: C:\ComboFix.txt + HijackThis,atualizado.

Abraços!

shanjay · Janeiro 24, 2009

novo log do hijack e combofix

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 08:47:19, on 24/01/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\VPN - SSP-GO\bin\openvpn-gui.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\wbem\wmiapsrv.exe

C:\WINDOWS\System32\svchost.exe

C:\HijackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.11.0.13:3128

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = intranet;*.tst.gov.br;<local>

R3 - URLSearchHook: Barra de Ferramentas do Yahoo! com bloqueador de pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Arquivos de programas\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {0160E942-F852-47A1-9A2E-20D4B4DC1382} - C:\WINDOWS\system32\wgkuisab.dll