[Resolvido!] Processos estranhos

igfmachado · Abril 21, 2009

Infelizmente eu presciso compartilhar o meu computador, e hoje eu não pude deixar de notar alguns processos estranhos.

reader_s.exe

wlcomm.xe

csrcs.exe

cmd.exe

net.exe

e um svchost.exe que come 99 da CPU

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:53:08, on 20/4/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\csrcs.exe

C:\Arquivos de programas\Synaptics\SynTP\SynTPEnh.exe

C:\Arquivos de programas\Motorola\SMSERIAL\sm56hlpr.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\WinLogT.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\sistray.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe

C:\WINDOWS\system32\taskmgr.exe

C:\Documents and Settings\Igor Filipe\Meus documentos\Igor\Programas\Anti-vírus\HiJackThis.exe

C:\WINDOWS\system32\cmd.exe

C:\WINDOWS\system32\net.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.codecguide.com/

F2 - REG:system.ini: Shell=Explorer.exe csrcs.exe

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [siSPower] Rundll32.exe SiSPower.dll,ModeAgent

O4 - HKLM\..\Run: [synTPEnh] C:\Arquivos de programas\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [sMSERIAL] C:\Arquivos de programas\Motorola\SMSERIAL\sm56hlpr.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [WinLogT] C:\WINDOWS\WinLogT.exe

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKLM\..\Policies\Explorer\Run: [csrcs] C:\WINDOWS\system32\csrcs.exe

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~1\OFFICE11\REFIEBAR.DLL

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1239824359281

O17 - HKLM\System\CCS\Services\Tcpip\..\{5533DCAE-165D-45D4-995E-77CF18CE1EC3}: NameServer = 200.165.132.155 200.149.55.142

O17 - HKLM\System\CS1\Services\Tcpip\..\{5533DCAE-165D-45D4-995E-77CF18CE1EC3}: NameServer = 200.165.132.155 200.149.55.142

O20 - Winlogon Notify: crypt - C:\WINDOWS\SYSTEM32\crypts.dll

O23 - Service: Serviço de transferência inteligente de plano de fundo (BITS) - Unknown owner - C:\WINDOWS\

O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe

O23 - Service: Atualizações Automáticas (wuauserv) - Unknown owner - C:\WINDOWS\

--

End of file - 4567 bytes

DigRam · Abril 21, 2009

Bom Dia! igfmachado

<@> Baixe: < > ( ...by sUBs )

<@> Salve-o no desktop!

<@> Desabilite as proteções residente de: antivírus,antispywares e firewall. ( Menos o do Windows! )

<@> Feche todas as janelas e execute a ferramenta!

<@> Na solicitação: "Negação de garantia de software" --> Clique em Sim!

<@> Não possuindo o "Console de Recuperação",aceite optar pela instalação do mesmo!

<!> Caso aconteça a notificação de: Aplicativo Win32 inválido,delete a ferramenta e faça,novamente,o download.
<!> Salve-a no desktop,renomeada como: Kombo.exe

<!> Ps: Nomeie durante o salvamento,e não após salvá-la!

<!> Ps: Surgindo alguma mensagem de erro,rode o ComboFix.exe em Modo de Segurança. <-- Link!

<!> Ps: Para completar as remoções,talvez haja necessidade da ferramenta reiniciar o computador. <-- Aguarde!

<!> Ps: Evite executar,voluntariamente,esta ferramenta!

<!> Ps: Para evitar problemas,siga todas as recomendações propostas.

<!> Ps: O ComboFix é uma ferramenta que pode danificar o sistema. Utilize-o,somente,sob supervisão profissional.

<@> Abrir-se-á a janela Auto Scan. --> Aguarde!

<@> Àfim de completar as remoções,o ComboFix poderá reiniciar o computador.

<@> Se houver necessidade,digite a opção para continuar! --> ( 1 ) --> Aperte Enter! --> Aguarde a conclusão!

<@> Durante o scan,evite manusear o mouse ou teclado! <-- Importante!

<@> Para parar ou sair do ComboFix,tecle "N" ou "2" --> Aperte Enter!

<><><><><><><><><><><><>

<@> Terminando,poste os relatórios: C:\ComboFix\ComboFix.txt + HijackThis,atualizado.

Abraços!

igfmachado · Abril 21, 2009

ComboFix 09-04-21.A5 - Igor Filipe 21/04/2009 12:01.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.445.135 [GMT -3:00]

Executando de: c:\documents and settings\Igor Filipe\Desktop\ComboFix.exe

* Criado um novo ponto de restauro

.

ADS - svchost.exe: deleted 53248 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Igor Filipe\reader_s.exe

C:\lsass.exe

c:\windows\dhcp\svchost.exe

c:\windows\system32\6to4v32.dll

c:\windows\system32\afisicx.exe

c:\windows\system32\at1394.sys

c:\windows\system32\AutoRun.inf

c:\windows\system32\comsa32.sys

c:\windows\system32\crypts.dll

c:\windows\system32\csrcs.exe

c:\windows\system32\dpcxool64.sys

c:\windows\system32\reader_s.exe

c:\windows\system32\sopidkc.exe

c:\windows\system32\tdctxte.exe

c:\windows\system32\tpszxyd.sys

c:\windows\system32\tqmhzcu.dll

c:\windows\system32\w.exe

c:\windows\system32\userinit.exe . . . está infetado!!

.

((((((((((((((((((((((((((((((((((((((( Drivers/Serviços )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_6to4

-------\Legacy_afisicx

-------\Legacy_at1394

-------\Legacy_dhcpsrv

-------\Legacy_icf

-------\Legacy_sopidkc

-------\Legacy_tdctxte

-------\Service_6to4

-------\Service_afisicx

-------\Service_at1394

-------\Service_dhcpsrv

-------\Service_ICF

-------\Service_sopidkc

-------\Service_tdctxte

(((((((((((((((( Arquivos/Ficheiros criados de 2009-03-21 to 2009-04-21 ))))))))))))))))))))))))))))

.

2009-04-21 15:10 . 2009-04-21 15:10 -------- d-----w c:\temp\WPDNSE

2009-04-21 15:09 . 2009-04-21 14:58 44544 ----a-w C:\lsass.exe

2009-04-21 14:58 . 2009-04-21 14:58 44544 ----a-w C:\otde.exe

2009-04-21 14:54 . 2009-04-21 14:54 525434 ----a-w c:\windows\system32\cftu.exe

2009-04-21 00:13 . 2009-04-21 15:03 -------- d-sh--w c:\temp\Cookies

2009-04-21 00:13 . 2009-04-21 00:13 -------- d-sh--w c:\temp\History

2009-04-21 00:13 . 2009-04-21 00:13 -------- d-sh--w c:\temp\Temporary Internet Files

2009-04-21 00:10 . 2009-04-21 15:09 111868 ----a-w c:\windows\system32\drivers\44e2825.sys

2009-04-21 00:10 . 2009-04-21 14:58 23040 ----a-w C:\qcjvfvtk.exe

2009-04-21 00:09 . 2009-04-21 14:58 2 ----a-w C:\1621864993

2009-04-20 20:12 . 2009-04-20 21:24 -------- d-----w c:\temp\plugtmp

2009-04-20 03:58 . 2009-04-20 03:58 -------- d-----w c:\documents and settings\Igor Filipe\Dados de aplicativos\teamspeak2

2009-04-20 03:58 . 2009-04-20 03:58 34064 ----a-w c:\windows\system32\lhacm.acm

2009-04-20 03:58 . 2009-04-20 03:58 -------- d-----w c:\arquivos de programas\Teamspeak2_RC2

2009-04-20 03:37 . 2009-04-20 03:37 -------- d-----w c:\documents and settings\Igor Filipe\Configurações locais\Dados de aplicativos\Identities

2009-04-19 23:56 . 2009-04-21 03:01 -------- d-----w c:\arquivos de programas\Garena

2009-04-19 23:36 . 2009-04-20 22:08 86732 ----a-w c:\windows\War3Unin.dat

2009-04-19 23:36 . 2009-04-19 23:43 2829 ----a-w c:\windows\War3Unin.pif

2009-04-19 23:36 . 2009-04-19 23:43 139264 ----a-w c:\windows\War3Unin.exe

2009-04-19 23:32 . 2009-04-21 05:20 -------- d-----w c:\arquivos de programas\Warcraft III

2009-04-19 12:31 . 2009-04-19 12:31 -------- d-----w c:\temp\msohtml1

2009-04-19 12:31 . 2009-04-19 12:31 -------- d-----w c:\temp\msohtml

2009-04-18 21:55 . 2009-04-21 15:03 -------- d-----w c:\temp\AutoRun

2009-04-18 21:53 . 2009-04-18 21:53 -------- d-----w c:\documents and settings\Igor Filipe\Dados de aplicativos\DAEMON Tools Pro

2009-04-18 21:53 . 2009-04-18 21:53 -------- d-----w c:\documents and settings\Igor Filipe\Dados de aplicativos\DAEMON Tools

2009-04-18 21:53 . 2009-04-18 21:53 -------- d-----w c:\documents and settings\All Users\Dados de aplicativos\DAEMON Tools Lite

2009-04-18 21:53 . 2009-04-18 21:53 -------- d-----w c:\arquivos de programas\DAEMON Tools Lite

2009-04-18 21:50 . 2009-04-18 21:50 717296 ----a-w c:\windows\system32\drivers\sptd.sys

2009-04-18 21:50 . 2009-04-18 21:55 -------- d-----w c:\documents and settings\Igor Filipe\Dados de aplicativos\DAEMON Tools Lite

2009-04-17 20:23 . 2009-04-17 21:43 -------- d-----w c:\windows\system32\Adobe

2009-04-17 18:56 . 2009-04-17 18:56 0 ----a-w C:\TP0FF178.$$$

2009-04-16 22:53 . 2009-04-16 22:53 -------- d-----w c:\temp\VBE

2009-04-16 20:39 . 2009-04-16 20:39 0 ----a-w C:\TP11AB11.$$$

2009-04-16 20:16 . 2009-04-16 20:16 -------- d-----w c:\documents and settings\Igor Filipe\.thumbnails

2009-04-16 20:15 . 2009-04-16 20:15 -------- d-----w c:\temp\fontconfig

2009-04-16 20:15 . 2009-04-16 20:23 -------- d-----w c:\documents and settings\Igor Filipe\.gimp-2.6

2009-04-16 20:15 . 2009-04-16 20:15 -------- d-----w c:\documents and settings\Igor Filipe\.gegl-0.0

2009-04-16 19:28 . 2009-04-16 19:28 -------- d-----w c:\arquivos de programas\TP

2009-04-16 18:41 . 1999-03-23 12:12 299520 ----a-w c:\windows\uninst.exe

2009-04-16 18:39 . 2009-04-16 18:39 -------- d-----w c:\documents and settings\Igor Filipe\WINDOWS

2009-04-16 17:57 . 2009-04-16 17:57 1158 --sha-r c:\windows\system32\autorun.i

2009-04-16 17:57 . 2009-04-16 17:57 1036 --sha-r c:\windows\system32\autorun.in

2009-04-16 08:29 . 2004-08-04 02:08 31616 -c--a-w c:\windows\system32\dllcache\usbccgp.sys

2009-04-16 08:29 . 2004-08-04 02:08 31616 ----a-w c:\windows\system32\drivers\usbccgp.sys

2009-04-15 23:36 . 2009-04-19 12:38 -------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Messenger Plus!

2009-04-15 23:03 . 2009-04-15 23:03 -------- d-----w c:\documents and settings\All Users\Dados de aplicativos\GbPlugin

2009-04-15 22:17 . 2009-04-21 14:43 69 ----a-w c:\windows\NeroDigital.ini

2009-04-15 22:16 . 2009-04-15 22:16 -------- d-----w c:\documents and settings\Igor Filipe\Dados de aplicativos\Media Player Classic

2009-04-15 21:48 . 2009-04-15 21:48 -------- d-----w c:\temp\msgpl_5242.tmp

2009-04-15 21:35 . 2009-04-15 21:35 -------- d-----w c:\arquivos de programas\Messenger Plus! Live

2009-04-15 21:29 . 2009-04-20 19:03 -------- d-----w c:\arquivos de programas\DOSBox-0.72

2009-04-15 20:25 . 2009-04-21 11:42 -------- d-----w c:\documents and settings\Igor Filipe\Tracing

2009-04-15 20:25 . 2009-04-21 15:03 -------- d-----w c:\temp\MessengerCache

2009-04-15 20:20 . 2009-04-15 20:20 -------- d-----w c:\arquivos de programas\Microsoft

2009-04-15 20:20 . 2009-04-15 20:20 -------- d-----w c:\arquivos de programas\Windows Live SkyDrive

2009-04-15 20:19 . 2009-04-15 20:20 -------- d-----w c:\arquivos de programas\Windows Live

2009-04-15 20:06 . 2009-04-15 20:06 -------- d-----w c:\arquivos de programas\Arquivos comuns\Windows Live

2009-04-15 19:44 . 2009-04-15 20:02 -------- dcsh--w c:\arquivos de programas\Arquivos comuns\WindowsLiveInstaller

2009-04-15 19:44 . 2009-04-15 19:44 -------- d-----w c:\documents and settings\All Users\Dados de aplicativos\WLInstaller

2009-04-15 19:42 . 2008-10-16 17:09 43544 ----a-w c:\windows\system32\wups2.dll

2009-04-15 19:42 . 2008-10-16 17:09 31768 ----a-w c:\windows\system32\wucltui.dll.mui

2009-04-15 19:42 . 2008-10-16 17:08 27672 ----a-w c:\windows\system32\wuaucpl.cpl.mui

2009-04-15 19:42 . 2008-10-16 17:08 27672 ----a-w c:\windows\system32\wuapi.dll.mui

2009-04-15 19:42 . 2008-10-16 17:07 18968 ----a-w c:\windows\system32\wuaueng.dll.mui

2009-04-15 18:53 . 2009-04-15 19:41 -------- d-----w c:\arquivos de programas\uTorrent

2009-04-15 18:52 . 2009-04-21 14:47 -------- d-----w c:\documents and settings\Igor Filipe\Dados de aplicativos\uTorrent

2009-04-15 18:45 . 2009-04-21 15:03 -------- d-----w c:\temp\WLZC5E6.tmp

2009-04-15 17:23 . 2009-04-15 17:30 -------- d-----w c:\arquivos de programas\Velox

2009-04-15 17:17 . 2009-04-15 17:17 -------- d-----w c:\documents and settings\Igor Filipe\Dados de aplicativos\Nero

2009-04-15 17:17 . 2009-04-15 17:17 -------- d-----w c:\temp\nps.tmp

2009-04-15 17:16 . 2009-04-15 17:16 -------- d-----w c:\temp\nro.log

2009-04-15 17:16 . 2006-03-17 17:49 368640 ----a-w c:\windows\system32\TwnLib4.dll

2009-04-15 17:16 . 2006-03-17 14:45 802816 ----a-w c:\windows\system32\imagXRA7.dll

2009-04-15 17:16 . 2006-03-17 14:45 497296 ----a-w c:\windows\system32\imagXpr7.dll

2009-04-15 17:16 . 2006-03-17 14:45 258048 ----a-w c:\windows\system32\imagXR7.dll

2009-04-15 17:16 . 2009-04-15 17:16 -------- d-----w c:\arquivos de programas\Nero

2009-04-15 17:16 . 2009-04-15 17:16 -------- d-----w c:\arquivos de programas\Arquivos comuns\Nero

2009-04-15 17:16 . 2009-04-15 17:16 -------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Nero

2009-04-15 17:16 . 2006-03-17 14:45 1757184 ----a-w c:\windows\system32\imagX7.dll

2009-04-15 17:10 . 2009-04-15 17:10 -------- d-----w c:\arquivos de programas\KGB Archiver

2009-04-15 17:07 . 2009-04-15 17:07 -------- d-----w c:\arquivos de programas\GIMP-2.0

2009-04-15 17:07 . 2009-04-15 17:07 -------- d-----w c:\arquivos de programas\CDisplay

2009-04-15 16:56 . 2001-09-06 02:20 12288 -c--a-w c:\windows\system32\dllcache\mouhid.sys

2009-04-15 16:56 . 2001-09-06 02:20 12288 ----a-w c:\windows\system32\drivers\mouhid.sys

2009-04-15 16:56 . 2001-08-18 01:02 9600 -c--a-w c:\windows\system32\dllcache\hidusb.sys

2009-04-15 16:56 . 2001-08-18 01:02 9600 ----a-w c:\windows\system32\drivers\hidusb.sys

2009-04-15 16:56 . 2009-04-15 16:56 940794 ----a-w c:\windows\system32\LoopyMusic.wav

2009-04-15 16:56 . 2009-04-15 16:56 146650 ----a-w c:\windows\system32\BuzzingBee.wav

2009-04-15 16:56 . 2009-04-15 16:56 -------- d-----w c:\windows\system32\Lang

2009-04-15 16:55 . 2007-11-14 17:18 553 ------r c:\windows\USetup.iss

2009-04-15 16:50 . 2009-04-17 01:10 -------- d-----w c:\arquivos de programas\VS Revo Group

2009-04-15 16:44 . 2009-04-15 16:44 0 ----a-w c:\windows\nsreg.dat

2009-04-15 16:44 . 2009-04-15 16:44 -------- d-----w c:\documents and settings\Igor Filipe\Configurações locais\Dados de aplicativos\Mozilla

2009-04-15 03:23 . 2009-04-15 20:25 36408 ----a-w c:\documents and settings\Igor Filipe\Configurações locais\Dados de aplicativos\GDIPFONTCACHEV1.DAT

2009-04-15 03:10 . 2005-08-25 15:26 69721 ----a-w c:\windows\system32\SynTPFcs.dll

2009-04-15 03:10 . 2005-08-25 15:28 81920 ----a-w c:\windows\system32\SynTPCo2.dll

2009-04-15 03:10 . 2005-08-25 15:16 90201 ----a-w c:\windows\system32\SynTPAPI.dll

2009-04-15 03:10 . 2005-08-25 15:16 114688 ----a-w c:\windows\system32\SynCtrl.dll

2009-04-15 03:10 . 2005-08-25 15:15 82012 ----a-w c:\windows\system32\SynCOM.dll

2009-04-15 03:10 . 2005-08-25 15:12 191168 ----a-w c:\windows\system32\drivers\SynTP.sys

2009-04-15 03:10 . 2009-04-15 03:10 -------- d-----w c:\arquivos de programas\Synaptics

2009-04-15 03:09 . 2009-04-15 03:09 552 ----a-w c:\windows\system32\d3d8caps.dat

2009-04-15 03:05 . 2007-09-18 18:08 44032 ----a-w c:\windows\system32\drivers\RTSTOR.sys

2009-04-15 03:05 . 2007-08-03 01:09 5624832 ----a-w c:\windows\system\DriveIcon.dll

2009-04-15 03:05 . 2004-06-30 19:24 5430 ----a-w c:\windows\system\MyMulti.ico

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-04-21 15:09 . 2009-04-21 14:58 102652 ----a-w c:\windows\system32\drivers\3195c420.sys

2009-04-21 15:04 . 2009-04-21 15:01 12741 ----a-w c:\windows\system32\F.tmp

2009-04-21 15:04 . 2009-04-15 16:55 450 ----a-w C:\RTHDCPL_Dump.txt

2009-04-21 14:58 . 2004-08-04 03:45 14336 ----a-w c:\windows\system32\svchost.exe

2009-04-21 00:11 . 2004-08-04 02:14 182912 ----a-w c:\windows\system32\drivers\ndis.sys

2009-04-15 21:30 . 2009-04-15 18:23 -------- d-----w c:\documents and settings\Igor Filipe\Dados de aplicativos\Winamp

2009-04-15 18:24 . 2009-04-15 18:23 -------- d-----w c:\arquivos de programas\Winamp

2009-04-15 17:06 . 2009-04-15 17:06 -------- d-----w c:\arquivos de programas\Arquivos comuns\DVDVideoSoft

2009-04-15 17:06 . 2009-04-15 17:06 -------- d-----w c:\arquivos de programas\DVDVideoSoft

2009-04-15 17:06 . 2009-04-15 17:06 -------- d-----w c:\arquivos de programas\K-Lite Codec Pack

2009-04-15 16:55 . 2001-10-28 12:07 71396 ----a-w c:\windows\system32\perfc016.dat

2009-04-15 16:55 . 2001-10-28 12:07 434432 ----a-w c:\windows\system32\perfh016.dat

2009-04-15 16:54 . 2009-04-15 16:54 -------- d-----w c:\arquivos de programas\Motorola

2009-04-15 16:53 . 2009-04-15 16:53 -------- d-----w c:\arquivos de programas\Realtek

2009-04-15 16:53 . 2009-04-15 02:47 -------- d--h--w c:\arquivos de programas\InstallShield Installation Information

2009-04-15 16:53 . 2009-04-15 16:53 315392 ----a-w c:\windows\HideWin.exe

2009-04-15 03:10 . 2009-04-15 02:46 -------- d-----w c:\arquivos de programas\Arquivos comuns\InstallShield

2009-04-15 03:04 . 2009-04-15 02:12 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-04-15 02:48 . 2009-04-15 02:46 -------- d-----w c:\arquivos de programas\SiS VGA Utilities V3.81

2009-04-15 02:47 . 2009-04-15 02:47 -------- d-----w c:\arquivos de programas\sisagp

2009-04-15 02:30 . 2009-04-15 02:30 -------- d-----w c:\arquivos de programas\microsoft frontpage

2009-04-15 02:28 . 2009-04-15 02:28 -------- d-----w c:\arquivos de programas\Microsoft Works

2009-04-15 02:28 . 2009-04-15 02:28 -------- d-----w c:\arquivos de programas\Microsoft.NET

2009-04-15 02:27 . 2009-04-15 02:27 -------- d-----w c:\arquivos de programas\Editpad

2009-04-15 02:27 . 2009-04-15 02:27 -------- d-----w c:\arquivos de programas\Foxit

2009-04-15 02:26 . 2009-04-15 02:26 -------- d-----w c:\arquivos de programas\Java

2009-04-15 02:26 . 2009-04-15 02:26 -------- d-----w c:\arquivos de programas\Arquivos comuns\Java

2009-04-15 02:11 . 2009-04-15 02:11 -------- d-----w c:\arquivos de programas\Serviços on-line

2009-04-15 02:11 . 2009-04-15 02:11 -------- d-----w c:\arquivos de programas\Arquivos comuns\Serviços

2009-04-15 02:10 . 2009-04-15 02:10 21844 ----a-w c:\windows\system32\emptyregdb.dat

2009-02-06 21:52 . 2009-02-06 21:52 49504 ----a-w c:\windows\system32\sirenacm.dll

2004-08-04 15:09 . 2004-08-04 15:09 525434 --sha-r c:\windows\system32\csrcs.exe

.

------- Sigcheck -------

[-] 2004-08-04 03:45 1054720 BC700C707A795F5A1097A3FEE3D4AD4C c:\windows\explorer.exe

[-] 2004-08-04 03:45 1034240 02C689E8FEF1C2D17ACE3FAB81F67CE3 c:\windows\system32\dllcache\explorer.exe

[-] 2004-08-04 03:45 35840 FA4CB3B59FE2EA1B62FB7357C09EBFB7 c:\windows\system32\ctfmon.exe

[-] 2004-08-04 03:45 15360 E1D5015645A3BA33856EB3AD568C14C2 c:\windows\system32\dllcache\ctfmon.exe

[-] 2004-08-04 03:45 45056 3A679290AF0E92FD0D6254C539459C3F c:\windows\system32\userinit.exe

[-] 2004-08-04 03:45 45056 BCE0BE78815E24C452ACA503DDA17930 c:\windows\system32\dllcache\userinit.exe

[-] 2006-11-26 15:19 1548288 0F5D2469220112219572903CC3ED1341 c:\windows\system32\sfcfiles.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"15559"="C:\otde.exe" [2009-04-21 44544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"svchost.exe"="c:\windows\system32\3361\SVCHOST.exe" [2009-04-21 86016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

"cftu"="c:\windows\system32\cftu.exe" [2009-04-21 525434]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 35840]

"svc"="c:\program files\ThunMail\testabd.exe" [2009-04-21 66760]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]

"cftu"="c:\windows\system32\cftu.exe" [2009-04-21 525434]

"csrcs"="c:\windows\system32\csrcs.exe" [2004-08-04 525434]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\

Utility Tray.lnk - c:\windows\system32\sistray.exe [2009-4-14 282624]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoSMMyPictures"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"NoSMMyPictures"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Shell"="Explorer.exe csrcs.exe"

"Userinit"="c:\windows\explorer.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\ThunMail\testabd.dll

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32

"wave1"= serwvdrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\uTorrent\\uTorrent.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

S2 spcasrmx;SiS191/SiS190 Ethernet Device NDIS 5.1 Controller;c:\windows\System32\svchost.exe [2009-04-21 14336]

S3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);c:\windows\system32\DRIVERS\RMSPPPOE.SYS [2002-06-10 31232]

--- ---

*NewlyCreated* - spcasrmx

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

spcasrmx

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d6fae52e-2a0a-11de-819b-00030d9644ac}]

\Shell\AutoRun\command - F:\mjdude.exe

\Shell\explore\Command - F:\mjdude.exe

\Shell\open\Command - F:\mjdude.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d6fae52f-2a0a-11de-819b-00030d9644ac}]

\Shell\AutoRun\command - G:\mjdude.exe

\Shell\explore\Command - G:\mjdude.exe

\Shell\open\Command - G:\mjdude.exe

.

- - - - ORFÃOS REMOVIDOS - - - -

BHO-{5864d4f9-dca8-4bc1-83e2-d2b253f5e0c0} - c:\windows\system32\tqmhzcu.dll

HKU-Default-Run-reader_s - c:\documents and settings\Igor Filipe\reader_s.exe

HKU-Default-RunOnce-nltide3 - rundll32 advpack.dll

Notify-escznpgo - tqmhzcu.dll

.

------- Scan Suplementar -------

.

uInternet Connection Wizard,ShellNext = hxxp://www.codecguide.com/

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

TCP: {5533DCAE-165D-45D4-995E-77CF18CE1EC3} = 200.165.132.155 200.149.55.142

FF - ProfilePath - c:\documents and settings\Igor Filipe\Dados de aplicativos\Mozilla\Firefox\Profiles\dbzzi1vm.default\

FF - component: c:\documents and settings\Igor Filipe\Dados de aplicativos\Mozilla\Firefox\Profiles\dbzzi1vm.default\extensions\{87F8774F-B485-47E2-A755-A40A8A5E8874}\components\GbMzhAbn.dll

FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-04-21 12:09

Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:

ZwOpenFile

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

c:\windows\system32\autorun.inf 1036 bytes

c:\windows\system32\csrcs.exe 525434 bytes executable

Varredura completada com sucesso

arquivos/ficheiros ocultos: 2

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\3195c420]

"ImagePath"="\SystemRoot\System32\drivers\3195c420.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\44e2825]

"ImagePath"="\SystemRoot\System32\drivers\44e2825.sys"

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(796)

c:\windows\system32\tqmhzcu.dll

- - - - - - - > 'Explorer.exe'(3988)

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Outros Processos em Execução ------------------------

.

c:\arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\windows\system32\wscntfy.exe

C:\lsass.exe

.

**************************************************************************

.

Tempo para conclusão: 2009-04-21 12:11 - Máquina reiniciou

ComboFix-quarantined-files.txt 2009-04-21 15:11

Pré-execução: 10 pasta(s) 47.499.116.544 bytes disponíveis

Pós execução: 9 pasta(s) 47.468.318.720 bytes disponíveis

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

320

------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:14:43, on 21/4/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\3361\SVCHOST.exe

C:\WINDOWS\system32\cftu.exe

C:\otde.exe

C:\WINDOWS\system32\sistray.exe

C:\WINDOWS\Explorer.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\cftu.exe

C:\WINDOWS\system32\csrcs.exe

C:\Documents and Settings\Igor Filipe\Meus documentos\Igor\Programas\Anti-vírus\HiJackThis.exe

c:\lsass.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.codecguide.com/

F2 - REG:system.ini: Shell=Explorer.exe csrcs.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\explorer.exe,

O2 - BHO: (no name) - {5864d4f9-dca8-4bc1-83e2-d2b253f5e0c0} - c:\windows\system32\tqmhzcu.dll (file missing)

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [2916] C:\otde.exe

O4 - HKLM\..\RunServices: [cftu] C:\WINDOWS\system32\cftu.exe

O4 - HKLM\..\RunOnce: [svchost.exe] "C:\WINDOWS\system32\3361\SVCHOST.exe"

O4 - HKLM\..\Policies\Explorer\Run: [cftu] C:\WINDOWS\system32\cftu.exe

O4 - HKLM\..\Policies\Explorer\Run: [csrcs] C:\WINDOWS\system32\csrcs.exe

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\Run: [svc] c:\program Files\ThunMail\testabd.exe (User 'Default user')

O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1239824359281

O17 - HKLM\System\CCS\Services\Tcpip\..\{5533DCAE-165D-45D4-995E-77CF18CE1EC3}: NameServer = 200.165.132.155 200.149.55.142

O17 - HKLM\System\CS1\Services\Tcpip\..\{5533DCAE-165D-45D4-995E-77CF18CE1EC3}: NameServer = 200.165.132.155 200.149.55.142

O20 - AppInit_DLLs: c:\progra~1\ThunMail\testabd.dll

O20 - Winlogon Notify: escznpgo - tqmhzcu.dll (file missing)

O23 - Service: Serviço de transferência inteligente de plano de fundo (BITS) - Unknown owner - C:\WINDOWS\

O23 - Service: Atualizações Automáticas (wuauserv) - Unknown owner - C:\WINDOWS\

--

End of file - 4072 bytes

DigRam · Abril 21, 2009

Boa Tarde! igfmachado

<!> A infecção é pelo Sality,que infecta executáveis e de difícil remoção/desinfecção.

<><><><><><><><><><><>

<@> Vá em Iniciar --> Executar --> Digite ou cole: combofix.exe /u --> Clique OK.

<@> Abrir-se-á,a seguinte janela: ( Abrir arquivo - Aviso de Segurança )

<@> Clique em Executar --> Aguarde!

<@> Surgirá,finalmente,a mensagem: "ComboFix está desinstalado" --> Clique OK.

<@> Caso encontre,apague: C:\ComboFix <-- A pasta! + C:\ComboFix.txt <-- Relatório!

<><><><><><><><><><><>

<@> Vá à este endereço,e execute a vacina antisality.

< Win32_Sality >

<@> Execute estas instruções:

Win32/Sality

<!> Baixe os três arquivos,para a pasta: C:\Sality <-- Crie esta pasta!

<1> rmsality.exe

<2> rmsality.nt

<3> rmsality.dos

<@> Execute o arquivo: rmsality.exe

<@> Você também pode especificar os discos,para restaurar,como parâmetro de um comando.

<@> Exemplo: C:\Sality\rmsality C: D:

<@> Se o comando é usado sem parâmetros,será restaurado todos os discos no computador.

<@> Ps: O êxito do removedor,necessita de direitos administrativos.

<@> Para a funcionalidade apropriada do removedor,é necessário salvar o rmsality.nt e o rmsality.dos,na mesma pasta que o rmsality.exe.

<@> Com o userinit.exe,que está infectado,execute o procedimento logo abaixo.

<@> Vá em Iniciar --> Executar --> Digite: c:\Sality\rmsality c:\windows\system32\userinit.exe --> Aperte Enter.

<@> Terminando,reinicie o computador!

<><><><><><><><><><><>

<@> Baixe: < DrWebCureIt >

<@> Salve-o no desktop!

<@> Reinicie o computador em Modo de Segurança.

<@> Inicie a instalação/execução,com um duplo-clique em drweb-cureit.

<@> Na janela que abrir,clique em Iniciar --> OK.

<@> Será dado início a "Verificação rápida" --> Feche a janela de propaganda!

<@> Terminando,marque a caixa de "Verificação Completa".

<@> Click em "Options" --> Em Change settings,desmarque a "Heuristic analysis".

Neste modo são verificados os seguintes objectos:

* Sectores de Arranque de Todos os Discos. <--

* Todas as Unidades Removíveis. <--

* Todos os Discos Locais. <--

<@> Clique em "Iniciar verificação" --> Aguarde!

<@> Surgindo mensagens para mover ou desinfectar arquivos,clique em Sim.

<@> Terminando,clique em "Ficheiro" --> "Guardar lista de relatórios".

<@> Procure salvá-lo em um local adequado. ( DrWeb.csv ) <-- Texto!

<@> Poste: DrWeb.csv + HijackThis,atualizado.

Abraços!

igfmachado · Abril 21, 2009

O computador n inicia mais, vou ter que formatar -_-". desculpa ai o imcomodo.

DigRam · Abril 21, 2009

O computador n inicia mais, vou ter que formatar -_-". desculpa ai o imcomodo.

<><><><><><><><><>

Opa! igfmachado

<!> Infelizmente,em relação ao Sality,a formatação pode não livrá-lo do file infector.

<!> Após a formatação,poste um novo log do HijackThis.

Abraços!

igfmachado · Abril 22, 2009

Apos a formataçao o virus se manifestou novamente

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:25:17, on 22/4/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\dhcp\svchost.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\3361\SVCHOST.exe

C:\WINDOWS\system32\csrcs.exe

C:\gcycr.exe

C:\WINDOWS\System32\reader_s.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\sistray.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\WINDOWS\TEMP\VRT5.tmp

C:\WINDOWS\System32\svchost.exe

C:\Documents and Settings\Igor Filipe\Configurações locais\Dados de aplicativos\websvr.exe

C:\Documents and Settings\Igor Filipe\Meus documentos\Igor\Programas\Anti-Vírus\HiJackThis.exe

c:\lsass.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

F2 - REG:system.ini: Shell=Explorer.exe csrcs.exe

O2 - BHO: (no name) - {235e377d-71aa-4556-b669-e0f06bb1a0bb} - c:\windows\system32\abpeupk.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [14441] C:\gcycr.exe

O4 - HKLM\..\RunOnce: [svchost.exe] "C:\WINDOWS\system32\3361\SVCHOST.exe"

O4 - HKLM\..\Policies\Explorer\Run: [csrcs] C:\WINDOWS\system32\csrcs.exe

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\Run: [svc] c:\program Files\ThunMail\testabd.exe (User 'Default user')

O4 - HKUS\.DEFAULT\..\Run: [reader_s] C:\Documents and Settings\Igor Filipe\reader_s.exe (User 'Default user')

O4 - HKUS\.DEFAULT\..\Run: [VRT5] C:\WINDOWS\TEMP\VRT5.exe (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~1\OFFICE11\REFIEBAR.DLL

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O17 - HKLM\System\CCS\Services\Tcpip\..\{0283DA86-F00F-421D-85AB-535ED47CD29B}: NameServer = 200.165.132.155 200.149.55.142

O17 - HKLM\System\CS1\Services\Tcpip\..\{0283DA86-F00F-421D-85AB-535ED47CD29B}: NameServer = 200.165.132.155 200.149.55.142

O20 - AppInit_DLLs: c:\progra~1\ThunMail\testabd.dll

O20 - Winlogon Notify: escznpgo - C:\WINDOWS\SYSTEM32\abpeupk.dll

O23 - Service: Serviço de transferência inteligente de plano de fundo (BITS) - Unknown owner - C:\WINDOWS\

O23 - Service: Dhcp server (dhcpsrv) - Unknown owner - C:\WINDOWS\dhcp\svchost.exe

O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows\system32\mssrv32.exe

O23 - Service: Atualizações Automáticas (wuauserv) - Unknown owner - C:\WINDOWS\

--

End of file - 4600 bytes

DigRam · Abril 22, 2009

Apos a formataçao o virus se manifestou novamente

<><><><><><><><><><>

Opa! igfmachado

<!> Execute o DrWebCureit,e poste seu relatório.

<><><><><><><><><><>

<@> Baixe: < Kaspersky Virus Removal Tool >

<@> Salve-o em Arquivos de Programas,e instale-o aí mesmo!

<@> Reinicie o computador,em Modo de Segurança! <-- Importante!

<@> Dê início ao exame,clicando em "Scan".

<@> A verificação é muito demorada. <-- Aguarde!

<@> Caso seja encontrada infecções,clique em "disinfect".

<@> Terminando,clique na aba Events.

<@> Desmarque a caixa de seleção "Show all events".

<@> Clique em "Save to file".

<@> Nomeie-o e salve-o no desktop! <-- Relatório para postagem!

<@> Poste,também,HijackThis atualizado.

Abraços!

igfmachado · Abril 23, 2009

Não estou conseguindo fazer o download do kaspersky e do DrWebCureit, vou fazer o download por outra maquina. so conseguirei os programas amanha.

DigRam · Abril 23, 2009

Não estou conseguindo fazer o download do kaspersky e do DrWebCureit, vou fazer o download por outra maquina. so conseguirei os programas amanha.

<><><><><><><><><>

Opa! igfmachado

<!> Veja se consegue o download,após executar o procedimento logo abaixo.

<><><><><><><><><>

<@> Caso possa,dê Fix nestas entradas,em Modo Seguro,com o HijackThis.

F2 - REG:system.ini: Shell=Explorer.exe csrcs.exe

O2 - BHO: (no name) - {235e377d-71aa-4556-b669-e0f06bb1a0bb} - c:\windows\system32\abpeupk.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O4 - HKLM\..\Run: [14441] C:\gcycr.exe

O4 - HKLM\..\RunOnce: [svchost.exe] "C:\WINDOWS\system32\3361\SVCHOST.exe"

O4 - HKLM\..\Policies\Explorer\Run: [csrcs] C:\WINDOWS\system32\csrcs.exe

O4 - HKUS\.DEFAULT\..\Run: [reader_s] C:\Documents and Settings\Igor Filipe\reader_s.exe (User 'Default user')

O4 - HKUS\.DEFAULT\..\Run: [VRT5] C:\WINDOWS\TEMP\VRT5.exe (User 'Default user')

O20 - Winlogon Notify: escznpgo - C:\WINDOWS\SYSTEM32\abpeupk.dll

<!> Terminando,reinicie em Modo Normal.

<><><><><><><><><>

<@> Baixe: < OTMoveIt3 > ( ...by OldTimer Tools )

<@> Salve-o no desktop e,execute-o aí mesmo!

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

:Processes

explorer.exe

:Services

dhcpsrv

msupdate

:Files

C:\Documents and Settings\Igor Filipe\Configurações locais\Dados de aplicativos\websvr.exe

C:\Documents and Settings\Igor Filipe\reader_s.exe

C:\WINDOWS\system32\3361\SVCHOST.exe

C:\WINDOWS\SYSTEM32\abpeupk.dll

C:\WINDOWS\dhcp\svchost.exe

C:\WINDOWS\TEMP\VRT5.exe

C:\WINDOWS\System32\reader_s.exe

c:\windows\system32\mssrv32.exe

C:\WINDOWS\system32\csrcs.exe

C:\WINDOWS\system32\3361

C:\WINDOWS\dhcp

C:\gcycr.exe

:Commands

[purity]

[emptytemp]

[start explorer]

[Reboot]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

<@> Copie e cole estas informações,entre os XXXXX...,para o campo ( clipboard ),da ferramenta.

<@> Ps: Área abaixo de "Paste Instructions for Items to be Moved".

<@> Clique em MoveIt.

<@> Na solicitação de reboot,confirme!

<@> Terminando,verifique o conteúdo texto da pasta: C:\_OTMoveIt\MovedFiles

<@> Copie e poste,seu relatório mais recente: C:\_OTMoveIt\MovedFiles\xxxx2009_xxxxxx.log <--

<@> Ps: Como a ferramenta não sobreescreve seus relatórios,devemos observar o que foi gerado logo após sua execução.

<@> Poste,também,HijackThis atualizado.

Abraços!

igfmachado · Abril 24, 2009

os bowsers estão muito lentos, apos fechar 3 processos svchost eles voltaram ao normal.

========== PROCESSES ==========

Process explorer.exe killed successfully.

========== SERVICES/DRIVERS ==========

Service\Driver dhcpsrv stopped successfully.

Service\Driver dhcpsrv deleted successfully.

Service\Driver dhcpsrv stopped successfully.

Service\Driver msupdate deleted successfully.

========== FILES ==========

C:\Documents and Settings\Igor Filipe\Configurações locais\Dados de aplicativos\websvr.exe moved successfully.

C:\Documents and Settings\Igor Filipe\reader_s.exe moved successfully.

C:\WINDOWS\system32\3361\SVCHOST.EXE moved successfully.

LoadLibrary failed for C:\WINDOWS\SYSTEM32\abpeupk.dll

C:\WINDOWS\SYSTEM32\abpeupk.dll NOT unregistered.

File move failed. C:\WINDOWS\SYSTEM32\abpeupk.dll scheduled to be moved on reboot.

C:\WINDOWS\dhcp\svchost.exe moved successfully.

File/Folder C:\WINDOWS\TEMP\VRT5.exe not found.

C:\WINDOWS\System32\reader_s.exe moved successfully.

File move failed. c:\windows\system32\mssrv32.exe scheduled to be moved on reboot.

C:\WINDOWS\system32\csrcs.exe moved successfully.

C:\WINDOWS\system32\3361 moved successfully.

C:\WINDOWS\dhcp moved successfully.

C:\gcycr.exe moved successfully.

========== COMMANDS ==========

File delete failed. C:\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

File delete failed. C:\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.

File delete failed. C:\Temp\Cookies\index.dat scheduled to be deleted on reboot.

File delete failed. C:\Temp\etilqs_ZGxxJ5vgzpVw5Wl7jnyU scheduled to be deleted on reboot.

User's Temp folder emptied.

User's Internet Explorer cache folder emptied.

File delete failed. C:\Documents and Settings\Igor Filipe\Configurações locais\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.

User's Temporary Internet Files folder emptied.

Windows Temp folder emptied.

File delete failed. C:\Documents and Settings\Igor Filipe\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\bye8t0kp.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Igor Filipe\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\bye8t0kp.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Igor Filipe\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\bye8t0kp.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Igor Filipe\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\bye8t0kp.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Igor Filipe\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\bye8t0kp.default\urlclassifier3.sqlite scheduled to be deleted on reboot.

File delete failed. C:\Documents and Settings\Igor Filipe\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\bye8t0kp.default\XUL.mfl scheduled to be deleted on reboot.

FireFox cache emptied.

Temp folders emptied.

Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04232009_233823

Files moved on Reboot...

LoadLibrary failed for C:\WINDOWS\SYSTEM32\abpeupk.dll

C:\WINDOWS\SYSTEM32\abpeupk.dll NOT unregistered.

File move failed. C:\WINDOWS\SYSTEM32\abpeupk.dll scheduled to be moved on reboot.

c:\windows\system32\mssrv32.exe moved successfully.

File C:\Temp\etilqs_ZGxxJ5vgzpVw5Wl7jnyU not found!

C:\Documents and Settings\Igor Filipe\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\bye8t0kp.default\Cache\_CACHE_001_ moved successfully.

C:\Documents and Settings\Igor Filipe\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\bye8t0kp.default\Cache\_CACHE_002_ moved successfully.

C:\Documents and Settings\Igor Filipe\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\bye8t0kp.default\Cache\_CACHE_003_ moved successfully.

C:\Documents and Settings\Igor Filipe\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\bye8t0kp.default\Cache\_CACHE_MAP_ moved successfully.

C:\Documents and Settings\Igor Filipe\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\bye8t0kp.default\urlclassifier3.sqlite moved successfully.

C:\Documents and Settings\Igor Filipe\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\bye8t0kp.default\XUL.mfl moved successfully.

........

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:56:33, on 23/4/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\explorer.exe

C:\WINDOWS\notepad.exe

C:\WINDOWS\system32\sistray.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Igor Filipe\Meus documentos\Igor\Programas\Anti-Vírus\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: (no name) - {20508254-ad30-4b13-a1e1-8b740f69d160} - C:\WINDOWS\system32\zwhchlss.dll

O2 - BHO: (no name) - {235e377d-71aa-4556-b669-e0f06bb1a0bb} - c:\windows\system32\abpeupk.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe