[Resolvido!] Problemas com a inicialização...

jgarcia · Fevereiro 14, 2009

Opa roberta alana,

Siga as instruções:

1. Abra o Bloco de Notas -> Copie (Control + C) e Cole (Control + V) todo o texto incluído no "Quote":

RegNull::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•6~*]

Driver::

R3 2d91D;2d91D

ATENÇÃO: O script acima foi elaborado especificamente para a infecção contida neste computador. Utilizá-lo em outra máquina poderá originar graves problemas ao usuário.

2. Salve o arquivo como CFScript.txt;

3. Tal como exemplificado na foto abaixo, arraste o arquivo CFScript.txt para o ComboFix.exe.

4. Ao término do processo a ferramenta irá gerar um log. Poste-o (C:\ComboFix.txt) em sua próxima resposta, juntamente com um novo log do HijackThis.

Abraços.

roberta alana · Fevereiro 15, 2009

ComboFix 09-02-12.03 - Administrador 2009-02-15 10:37:26.12 - NTFSx86

Executando de: c:\documents and settings\Administrador\Desktop\ComboFix.exe

Comandos utilizados :: c:\documents and settings\Administrador\Desktop\CFScript.txt

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-01-15 to 2009-02-15 ))))))))))))))))))))))))))))

.

2009-02-15 10:20 . 2009-02-15 10:20 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\ashampoo

2009-02-14 16:50 . 2009-02-14 21:08 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\Messenger Plus!

2009-02-14 16:42 . 2009-02-14 16:42 <DIR> d-------- c:\arquivos de programas\Messenger Plus! Live

2009-02-14 16:39 . 2009-02-14 16:43 <DIR> d-------- c:\arquivos de programas\MSN Messenger

2009-02-14 16:30 . 2009-02-14 16:30 <DIR> d-------- c:\arquivos de programas\CE6

2009-02-14 16:29 . 2009-02-14 16:29 <DIR> d-------- C:\CEPB

2009-02-14 16:23 . 2003-10-03 15:28 45,056 --a------ c:\windows\system32\vusetup.dll

2009-02-14 16:23 . 2005-06-06 16:51 11,264 --a------ c:\windows\system32\drivers\vulfntr.sys

2009-02-14 16:23 . 2005-01-05 17:02 6,912 --a------ c:\windows\system32\drivers\vulfnth.sys

2009-02-14 16:22 . 1998-11-13 12:18 308,224 --a------ c:\windows\IsUn0416.exe

2009-02-14 16:15 . 2009-02-14 16:15 <DIR> d-------- c:\arquivos de programas\S3

2009-02-14 14:36 . 2009-02-14 14:37 <DIR> d-------- c:\documents and settings\Administrador\Dados de aplicativos\MessengerDiscovery 2

2009-02-14 14:36 . 2009-02-14 14:40 <DIR> d-------- c:\arquivos de programas\MessengerDiscovery 2

2009-02-14 14:22 . 2009-02-14 14:22 <DIR> d-------- c:\documents and settings\Administrador\WINDOWS

2009-02-14 14:22 . 2001-09-24 00:10 306,688 --a------ c:\windows\IsUninst.exe

2009-02-14 14:22 . 2001-09-19 12:28 9,728 --a------ c:\windows\system32\drivers\viausb1.sys

2009-02-13 09:09 . 2009-02-13 09:09 <DIR> d-------- c:\arquivos de programas\Real Alternative

2009-02-11 10:33 . 2009-02-11 10:39 <DIR> d-------- c:\documents and settings\Administrador\Dados de aplicativos\VoipRaider

2009-02-09 23:17 . 2009-02-14 16:43 <DIR> d-------- c:\arquivos de programas\MessengerDiscovery

2009-02-07 18:51 . 2009-02-07 18:51 <DIR> d-------- c:\documents and settings\Administrador\Pavark

2009-02-07 18:50 . 2009-02-07 18:50 <DIR> d-------- c:\arquivos de programas\CCleaner

2009-02-06 20:01 . 2009-02-07 18:51 <DIR> d-------- c:\arquivos de programas\Ares

2009-02-05 10:05 . 2009-02-14 14:42 <DIR> d-------- c:\arquivos de programas\Windows Live

2009-02-04 22:37 . 2009-02-04 22:37 <DIR> d-------- c:\documents and settings\Administrador\Dados de aplicativos\Auslogics

2009-02-04 22:37 . 2009-02-04 22:37 <DIR> d-------- c:\arquivos de programas\Auslogics

2009-02-03 23:18 . 2009-02-07 18:50 <DIR> d-------- c:\arquivos de programas\Windows Installer 4.5 SDK

2009-02-03 15:12 . 2009-02-03 15:12 <DIR> d-------- c:\windows\SxsCaPendDel

2009-02-03 15:12 . 2009-02-03 15:12 <DIR> d-------- C:\09a0c4922fb6dd159cfa

2009-02-02 21:50 . 2009-02-03 15:11 <DIR> d-------- C:\RECYCLER(3)

2009-01-31 23:08 . 2006-06-29 12:07 14,048 --------- c:\windows\system32\spmsg2.dll

2009-01-31 22:47 . 2009-02-03 15:12 <DIR> d-------- c:\windows\system32\XPSViewer

2009-01-31 22:47 . 2009-01-31 22:47 <DIR> d-------- c:\arquivos de programas\Reference Assemblies

2009-01-31 22:46 . 2008-07-06 09:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll

2009-01-31 22:46 . 2008-07-06 09:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll

2009-01-31 22:46 . 2008-07-06 07:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2009-01-31 22:46 . 2008-07-06 09:06 575,488 --------- c:\windows\system32\xpsshhdr.dll

2009-01-31 22:46 . 2008-07-06 09:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll

2009-01-31 22:46 . 2008-07-06 09:06 117,760 --------- c:\windows\system32\prntvpt.dll

2009-01-31 22:46 . 2008-07-06 09:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll

2009-01-30 21:54 . 2009-01-30 22:06 <DIR> d-------- c:\documents and settings\Administrador\Dados de aplicativos\IObit

2009-01-19 13:00 . 2009-02-07 18:51 <DIR> d-------- c:\arquivos de programas\Google

2009-01-18 21:36 . 2009-01-18 21:36 <DIR> d-------- c:\windows\Downloaded Installations

2009-01-17 14:29 . 2009-01-17 14:29 <DIR> d-------- c:\documents and settings\Administrador\Dados de aplicativos\Malwarebytes

2009-01-17 14:27 . 2009-01-17 14:27 <DIR> d-------- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes

2009-01-17 14:10 . 2009-01-17 14:10 <DIR> d-------- c:\windows\system32\VIRepair

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-15 13:30 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\WLInstaller

2009-02-14 19:15 --------- dc-h--w c:\arquivos de programas\InstallShield Installation Information

2009-02-14 19:09 --------- dc----w c:\arquivos de programas\Arquivos comuns\InstallShield

2009-02-09 22:06 --------- dc----w c:\arquivos de programas\Arquivos comuns\Real

2009-02-08 04:20 --------- d-----w c:\documents and settings\Administrador\Dados de aplicativos\SecondLife

2009-02-07 21:51 --------- dc----w c:\arquivos de programas\LimeWire

2009-02-07 21:50 --------- d-----w c:\documents and settings\Administrador\Dados de aplicativos\LimeWire

2009-02-03 19:36 5,632 ----a-w c:\windows\system32\wmi.dll

2009-02-03 19:36 5,632 ----a-w c:\windows\system32\dllcache\wmi.dll

2009-02-01 01:47 --------- dc----w c:\arquivos de programas\MSBuild

2009-01-29 01:22 --------- d-----w c:\documents and settings\Administrador\Dados de aplicativos\gtk-2.0

2009-01-23 16:16 --------- dc----w c:\arquivos de programas\IObit

2009-01-17 17:47 --------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Microsoft Help

2009-01-17 17:03 --------- dc----w c:\arquivos de programas\Total Video Converter

2009-01-17 17:02 --------- d-----w c:\arquivos de programas\SimilarImages

2009-01-12 17:45 --------- d-----w c:\documents and settings\Administrador\Dados de aplicativos\avidemux

2009-01-10 21:44 --------- d-----w c:\arquivos de programas\Secway

2008-12-30 15:21 --------- d---a-w c:\documents and settings\All Users\Dados de aplicativos\TEMP

2008-12-22 03:37 --------- d-----w c:\arquivos de programas\GIMP-2.0

2008-12-21 19:11 --------- d-----w c:\arquivos de programas\PluginLetras

2008-12-21 19:10 --------- d-----w c:\arquivos de programas\Paint.NET

2008-12-17 00:56 293,376 ----a-w c:\windows\system32\WISPTIS.EXE

2008-12-13 06:37 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll

2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys

.

------- Sigcheck -------

2001-02-20 13:09 8192 d36a33c21eeed5a6c1daecb7c80a1909 c:\windows\system32\CTFMON.EXE

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="ctfmon.exe" [2001-02-20 c:\windows\system32\CTFMON.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avast!"="c:\arquivos de programas\Alwil Software\Avast4\ashDisp.exe" [2009-02-05 81000]

"VTTimer"="VTTimer.exe" [2006-09-14 c:\windows\system32\VTTimer.exe]

"VTTrayp"="VTtrayp.exe" [2007-04-25 c:\windows\system32\VTTrayp.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nltide_3"="advpack.dll" [2008-10-16 c:\windows\system32\advpack.dll]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"DisableCAD"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"= 1 (0x1)

"NoSMMyPictures"= 1 (0x1)

"NoSMConfigurePrograms"= 1 (0x1)

"NoResolveTrack"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"= 1 (0x1)

"NoSMMyPictures"= 1 (0x1)

"NoSMHelp"= 1 (0x1)

"NoSMConfigurePrograms"= 1 (0x1)

"NoResolveTrack"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]

2008-09-17 08:05 210168 c:\arquivos de programas\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Orbit.lnk]

backup=c:\windows\pss\Orbit.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

--a--c--- 2008-06-12 02:38 34672 c:\arquivos de programas\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\domino]

--a------ 2006-07-04 14:16 49152 c:\windows\domino.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]

--a--c--- 2007-08-24 07:00 33648 c:\arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

--a--c--- 2008-05-27 10:50 413696 c:\arquivos de programas\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

-ra--c--- 2008-06-14 18:28 26992424 c:\arquivos de programas\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

--a--c--- 2008-06-10 04:27 144784 c:\arquivos de programas\Java\jre1.6.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VMSnap1]

--a------ 2006-07-17 11:27 49152 c:\windows\VMSnap1.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

--a------ 2001-02-20 13:09 8192 c:\windows\system32\CTFMON.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"WMPNetworkSvc"=3 (0x3)

"WLSetupSvc"=3 (0x3)

"VideoAcceleratorService"=2 (0x2)

"UPS"=3 (0x3)

"ose"=3 (0x3)

"odserv"=3 (0x3)

"NMIndexingService"=3 (0x3)

"Microsoft Office Groove Audit Service"=3 (0x3)

"MDM"=2 (0x2)

"McAfee SiteAdvisor Service"=2 (0x2)

"iPod Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\iTunes\\iTunes.exe"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Arquivos de programas\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"=

"c:\\Arquivos de programas\\Mozilla Firefox\\firefox.exe"=

"c:\\Arquivos de programas\\LimeWire\\LimeWire.exe"=

"c:\\Arquivos de programas\\Ares\\Ares.exe"=

"c:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\MSN Messenger\\livecall.exe"=

"c:\\Arquivos de programas\\MessengerDiscovery\\MessengerDiscovery Live.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"9921:TCP"= 9921:TCP:BitCometBeta 9921 TCP

"9921:UDP"= 9921:UDP:BitCometBeta 9921 UDP

R3 2d91D;2d91D; [x]

R3 s916bus;Sony Ericsson Device 916 driver (WDM);c:\windows\system32\DRIVERS\s916bus.sys [2007-11-02 83496]

R3 s916mdfl;Sony Ericsson Device 916 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s916mdfl.sys [2007-11-02 15016]

R3 s916mdm;Sony Ericsson Device 916 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s916mdm.sys [2007-11-02 109992]

R3 s916mgmt;Sony Ericsson Device 916 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s916mgmt.sys [2007-11-02 103976]

R3 s916obex;Sony Ericsson Device 916 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s916obex.sys [2007-11-02 100008]

R3 viafilter;VIA USB Filter;c:\windows\System32\Drivers\viausb1.sys [2001-09-19 9728]

S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]

S1 aswSP;avast! Self Protection; [x]

S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]

S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]

S3 slnt;Realtek RTL8139 PCI Fast Ethernet Adapter;c:\windows\system32\DRIVERS\slnt.sys [2005-12-07 17999]

--- ---

*Deregistered* - Aavmker4

*Deregistered* - AFD

*Deregistered* - ALG

*Deregistered* - aswFsBlk

*Deregistered* - aswMon2

*Deregistered* - aswRdr

*Deregistered* - aswSP

*Deregistered* - aswTdi

*Deregistered* - aswUpdSv

*Deregistered* - AudioSrv

*Deregistered* - audstub

*Deregistered* - avast! Antivirus

*Deregistered* - avast! Mail Scanner

*Deregistered* - avast! Web Scanner

*Deregistered* - Beep

*Deregistered* - Cdfs

*Deregistered* - CryptSvc

*Deregistered* - Dhcp

*Deregistered* - dmio

*Deregistered* - dmload

*Deregistered* - dmserver

*Deregistered* - Dnscache

*Deregistered* - EventSystem

*Deregistered* - Fips

*Deregistered* - FltMgr

*Deregistered* - Ftdisk

*Deregistered* - Gpc

*Deregistered* - helpsvc

*Deregistered* - HTTP

*Deregistered* - HTTPFilter

*Deregistered* - IpNat

*Deregistered* - IPSec

*Deregistered* - kl1

*Deregistered* - klbg

*Deregistered* - KSecDD

*Deregistered* - LanmanServer

*Deregistered* - MountMgr

*Deregistered* - MRxSmb

*Deregistered* - Msfs

*Deregistered* - MSIServer

*Deregistered* - mssmbios

*Deregistered* - Mup

*Deregistered* - NDIS

*Deregistered* - NdisTapi

*Deregistered* - Ndisuio

*Deregistered* - NdisWan

*Deregistered* - NDProxy

*Deregistered* - NetBIOS

*Deregistered* - NetBT

*Deregistered* - Netman

*Deregistered* - Nla

*Deregistered* - Npfs

*Deregistered* - Ntfs

*Deregistered* - Null

*Deregistered* - PartMgr

*Deregistered* - ParVdm

*Deregistered* - PptpMiniport

*Deregistered* - ProtectedStorage

*Deregistered* - PSched

*Deregistered* - RasAcd

*Deregistered* - RasAuto

*Deregistered* - Rasl2tp

*Deregistered* - RasMan

*Deregistered* - RasPppoe

*Deregistered* - Raspti

*Deregistered* - Rdbss

*Deregistered* - RDPCDD

*Deregistered* - rdpdr

*Deregistered* - RpcSs

*Deregistered* - SamSs

*Deregistered* - SENS

*Deregistered* - SharedAccess

*Deregistered* - ShellHWDetection

*Deregistered* - Spooler

*Deregistered* - sr

*Deregistered* - srservice

*Deregistered* - Srv

*Deregistered* - SSDPSRV

*Deregistered* - swenum

*Deregistered* - TapiSrv

*Deregistered* - Tcpip

*Deregistered* - TermDD

*Deregistered* - TermService

*Deregistered* - Themes

*Deregistered* - TrkWks

*Deregistered* - Update

*Deregistered* - upnphost

*Deregistered* - VgaSave

*Deregistered* - VolSnap

*Deregistered* - W32Time

*Deregistered* - Wanarp

*Deregistered* - winmgmt

*Deregistered* - wuauserv

*Deregistered* - WudfPf

*Deregistered* - WZCSVC

.

Conteúdo da pasta 'Tarefas Agendadas'

2008-11-17 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\arquivos de programas\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-12-07 c:\windows\Tasks\GoogleUpdateTaskUser.job

- c:\documents and settings\Administrador\Configura []

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.terra.com.br/

uInternet Settings,ProxyOverride = *.local

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949}

DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab

FF - ProfilePath - c:\documents and settings\Administrador\Dados de aplicativos\Mozilla\Firefox\Profiles\cgu85kv7.default\

FF - prefs.js: browser.startup.homepage - www.orkut.com.br

FF - plugin: c:\arquivos de programas\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\arquivos de programas\Mozilla Firefox\plugins\npzylomgamesplayer.dll

FF - plugin: c:\arquivos de programas\Opera\program\plugins\nppl3260.dll

FF - plugin: c:\arquivos de programas\Opera\program\plugins\nprpjplug.dll

FF - plugin: c:\documents and settings\All Users\Dados de aplicativos\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-15 10:40:11

Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•6~*]

"6140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(720)

c:\arquivos de programas\Stardock\Object Desktop\WindowBlinds\wbsrv.dll

.

Tempo para conclusão: 2009-02-15 10:42:34

ComboFix-quarantined-files.txt 2009-02-15 13:42:28

ComboFix2.txt 2009-02-14 15:59:51

ComboFix3.txt 2009-02-14 02:08:22

ComboFix4.txt 2009-02-03 00:30:42

Pré-execução: 23 pasta(s) 34.694.590.464 bytes disponíveis

Pós execução: 23 pasta(s) 34,813,558,784 bytes disponíveis

316 --- E O F --- 2009-01-17 17:48:02

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:51:06, on 15/2/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\msiexec.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashDisp.exe

C:\WINDOWS\system32\VTTimer.exe

C:\WINDOWS\system32\VTtrayp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.terra.com.br/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O3 - Toolbar: FreshDownload Bar - {ED0E8CA5-42FB-4B18-997B-769E0408E79D} - C:\ARQUIV~1\FreshDevices\FreshDownload\fdiebar.dll

O4 - HKLM\..\Run: [avast!] "C:\Arquivos de programas\Alwil Software\Avast4\ashDisp.exe"

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe

O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe

O4 - HKUS\S-1-5-21-448539723-1645522239-1801674531-500\..\Run: [ctfmon.exe] ctfmon.exe (User '?')

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User '?')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\WINDOWS\system32\shdocvw.dll

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Arquivos de programas\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab56986.cab

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/PT-BR/a-UNO1/GAME_UNO1.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1221510508703

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD44/JSCDL/jdk/6u...ows-i586-jc.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/Optimize2/pcpitstop2.dll

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\Skype4COM.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: iPod Service - Apple Inc. - C:\Arquivos de programas\iPod\bin\iPodService.exe

O23 - Service: Uninterruptible Power Supply (UPS) - Unknown owner - C:\WINDOWS\System32\ups.exe (file missing)

--

End of file - 6732 bytes

jgarcia · Fevereiro 17, 2009

Opa roberta alana,

1. Baixe o BankerFix 3.0.

2. Desative o seu anti-vírus temporariamente.

3. Dê um duplo-clique sobre o bankerfix.exe. A janela do Banker Fix 3.0 abrir-se-á com a seguinte pergunta Instalar o BankerFix 3.0 / Install BankerFix 3.0 ? >> clique em SIM.

4. Uma janela informando que o BankerFix 3.0 será baixado via internet abrir-se-á >> clique sobre OK e aguarde. Na próxima janela clique em OK mais uma vez, a fim de que o BankerFix 3.0 seja iniciado.

5. Pressione qualquer tecla para dar continuidade ao processo e aguarde até que a varredura se complete. Tenha paciência, pois ela pode demorar alguns minutos.

6. Terminado o scan, leia a mensagem na tela e aperte Enter.

7. Habilite o seu anti-vírus.

8. Retorne com o relatorio.txt do BankerFix (ele estará em C:\LinhaDefensiva\).

9. Depois de postar a sua resposta você poderá deletar a pasta LinhaDefensiva contida no C.

Abraços.

PS.: Caso apareça a seguinte mensagem: Site denunciado como foco de ataques!, não se preocupe e clique sobre Ignorar este alerta.

roberta alana · Fevereiro 17, 2009

BankerFix 3.0 VALKYRIE - Removedor de Bankers

Linha Defensiva | http://www.linhadefensiva.org

http://www.linhadefensiva.org/bankerfix/

-------------------------------------------------------

Data: 2009-02-17 - 00:41

-------------------------------------------------------

Lista de Definição: 2009-01-21-2 | CORE: 2009-01-21-1

=======================================================

Arquivo infectado detectado: C:\cleanup.bat