[Arquivado] Será que tem virus ?

The XeoN · Outubro 20, 2009

Ae galera .. mexeram aqui no meu pc e abriram um tal de curr_downs.exe}

Tenho Sygate firewall e avira, atualizado .. e a conta deles era visitante.

Quero saber se meu computador esta infectado, pois mexo muito com senhas e nao posso perde-las =/

agradeço desde ja !

LOG do HJT:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:45:31, on 19/10/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Sygate\SPF\smc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

C:\AppServ\Apache2.2\bin\httpd.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\ARQUIV~1\MICROS~3\MSSQL\binn\sqlservr.exe

C:\AppServ\Apache2.2\bin\httpd.exe

C:\AppServ\MySQL\bin\mysqld-nt.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\sm56hlpr.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe

C:\Arquivos de programas\Free Download Manager\fdm.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Skype\Phone\Skype.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

C:\Arquivos de programas\MessengerDiscovery 2\MessengerDiscovery 2.exe

C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe

C:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe

C:\Arquivos de programas\Windows Media Player\wmplayer.exe

C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\ARQUIV~1\MICROS~4\Office12\GRA8E1~1.DLL

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Arquivos de programas\Free Download Manager\iefdm2.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Arquivos de programas\Arquivos comuns\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [smcService] C:\ARQUIV~1\Sygate\SPF\smc.exe -startgui

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [sMSERIAL] sm56hlpr.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKCU\..\Run: [Free Download Manager] "C:\Arquivos de programas\Free Download Manager\fdm.exe" -autorun

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [skype] "C:\Arquivos de programas\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Global Startup: Service Manager.lnk = C:\Arquivos de programas\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

O8 - Extra context menu item: Baixar com o FDM - file://C:\Arquivos de programas\Free Download Manager\dllink.htm

O8 - Extra context menu item: Baixar tudo com o FDM - file://C:\Arquivos de programas\Free Download Manager\dlall.htm

O8 - Extra context menu item: Download selecionado pelo FDM - file://C:\Arquivos de programas\Free Download Manager\dlselected.htm

O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Arquivos de programas\Free Download Manager\dlfvideo.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~4\Office12\EXCEL.EXE/3000

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~4\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~4\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~4\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1254664948437

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{B24D1E30-DDF1-4FEC-931A-397AD8E86C00}: NameServer = 200.165.132.147 200.165.132.155

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\ARQUIV~1\MICROS~4\Office12\GR99D3~1.DLL

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARQUIV~1\ARQUIV~1\Skype\SKYPE4~1.DLL

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Apache2.2 - Apache Software Foundation - C:\AppServ\Apache2.2\bin\httpd.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: mysql - Unknown owner - C:\AppServ\MySQL\bin\mysqld-nt.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Arquivos de programas\Sygate\SPF\smc.exe

--

End of file - 8576 bytes

Power Max · Outubro 20, 2009

:thumbsup: Olá The Xeon!

:seta: Configure o seu antivirus Avira Antivir seguindo as dicas destes tutoriais:

'>http://dicasetutoriaisparapc.blogspot.com/2009/03/tutorial-de-instalacao-e-configuracao.html"]Tutorial do Avira Antivir 9 free (instalação e configuração)

'>http://dicasetutoriaisparapc.blogspot.com/2009/03/escaneando-seu-computador-com-o-avira.html"]Tutorial do Avira Antivir 9 free (como usá-lo corretamente)

Depois disto faça uma atualização (update) do seu antivirus Avira Antivir e depois faça o seguinte, por gentileza:

Clique com o botão direito do mouse sobre o símbolo do Avira (aquele guarda-chuva vermelho aberto ao lado do relógio do Windows) e escolha a opção Start Antivir > clique na opção Scan system now > e aguarde a conclusão do escaneamento.

_______________________________

:seta: Quando você tiver removido os virus que o Avira Antivir encontrar, reinicie o computador normalmente. Clique com o botão direito do mouse sobre o ícone do Avira (aquele guarda-chuva vermelho aberto ao lado do relógio do Windows) e escolha a opção Start Antivir > clique na opção Reports > dê um duplo clique com o botão esquerdo do mouse sobre o log mais recente e clique no botão Report file > Depois será aberta uma tela com o log, então é só selecionar este Log (Clique no menu: Editar » Selecionar Tudo), depois disso volte novamente no menu: Editar » e clique na opção: Copiar) > Depois disso é só voltar aqui no fórum e postar este log do Avira Antivir juntamente para ser analisado.

_______________________________

:seta: Siga também as dicas deste tutorial para fazer uma limpeza de seu PC com o Malwarebytes:

'>http://dicasetutoriaisparapc.blogspot.com/2009/10/tutorial-do-malwarebytes-anti-malware.html"]Tutorial do Malwarebytes Anti-Malware

Na sua próxima resposta poste este log do Malwarebytes juntamente com o log do Avira Antivir e um novo log do Hijackthis e nos diga como está o seu PC após estes procedimentos.

Ficamos no aguardo.

The XeoN · Outubro 22, 2009

O computador nem tava dando nada de errado .. Mas eu mexo muito com senhas, nao posso arriscar :S

Ta ai o log do avira:

Avira AntiVir Personal

Report file date: quarta-feira, 21 de outubro de 2009 20:31

Scanning for 1812032 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus

Serial number : 0000149996-ADJIE-0000001

Platform : Windows XP

Windows version : (Service Pack 3) [5.1.2600]

Boot mode : Normally booted

Username : SYSTEM

Computer name : HOME

Version information:

BUILD.DAT : 9.0.0.410 18074 Bytes 25/9/2009 11:56:00

AVSCAN.EXE : 9.0.3.7 466689 Bytes 21/7/2009 17:36:14

AVSCAN.DLL : 9.0.3.0 40705 Bytes 27/2/2009 14:58:24

LUKE.DLL : 9.0.3.2 209665 Bytes 20/2/2009 15:35:49

LUKERES.DLL : 9.0.2.0 12033 Bytes 27/2/2009 14:58:52

ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 27/10/2008 16:30:36

ANTIVIR1.VDF : 7.1.4.132 5707264 Bytes 24/6/2009 13:21:42

ANTIVIR2.VDF : 7.1.6.112 4833792 Bytes 15/10/2009 22:23:03

ANTIVIR3.VDF : 7.1.6.133 192512 Bytes 21/10/2009 13:41:50

Engineversion : 8.2.1.42

AEVDF.DLL : 8.1.1.2 106867 Bytes 16/10/2009 22:29:14

AESCRIPT.DLL : 8.1.2.38 487804 Bytes 21/10/2009 13:47:27

AESCN.DLL : 8.1.2.5 127346 Bytes 16/10/2009 22:28:44

AERDL.DLL : 8.1.3.2 479604 Bytes 16/10/2009 22:28:33

AEPACK.DLL : 8.2.0.1 422263 Bytes 21/10/2009 13:47:20

AEOFFICE.DLL : 8.1.0.38 196987 Bytes 23/7/2009 13:59:39

AEHEUR.DLL : 8.1.0.167 2011511 Bytes 16/10/2009 22:27:31

AEHELP.DLL : 8.1.7.0 237940 Bytes 16/10/2009 22:25:31

AEGEN.DLL : 8.1.1.68 364918 Bytes 21/10/2009 13:41:59

AEEMU.DLL : 8.1.1.0 393587 Bytes 16/10/2009 22:24:57

AECORE.DLL : 8.1.8.1 184693 Bytes 16/10/2009 22:24:44

AEBB.DLL : 8.1.0.3 53618 Bytes 9/10/2008 18:32:40

AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 12:47:59

AVPREF.DLL : 9.0.3.0 44289 Bytes 16/10/2009 22:29:17

AVREP.DLL : 8.0.0.3 155905 Bytes 20/1/2009 18:34:28

AVREG.DLL : 9.0.0.0 36609 Bytes 5/12/2008 14:32:09

AVARKT.DLL : 9.0.0.3 292609 Bytes 24/3/2009 19:05:41

AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 30/1/2009 14:37:08

SQLITE3.DLL : 3.6.1.0 326401 Bytes 28/1/2009 19:03:49

SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2/2/2009 12:21:33

NETNT.DLL : 9.0.0.0 11521 Bytes 5/12/2008 14:32:10

RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 15/5/2009 19:39:58

RCTEXT.DLL : 9.0.37.0 86785 Bytes 17/4/2009 14:19:48

Configuration settings for the scan:

Jobname.............................: Complete system scan

Configuration file..................: c:\arquivos de programas\avira\antivir desktop\sysscan.avp

Logging.............................: low

Primary action......................: repair

Secondary action....................: delete

Scan master boot sector.............: on

Scan boot sector....................: on

Boot sectors........................: C:, D:,

Process scan........................: on

Scan registry.......................: on

Search for rootkits.................: on

Integrity checking of system files..: off

Scan all files......................: All files

Scan archives.......................: on

Recursion depth.....................: 20

Smart extensions....................: on

Macro heuristic.....................: on

File heuristic......................: medium

Deviating risk categories...........: +APPL,+GAME,+JOKE,+PCK,+PFS,+SPR,

Start of the scan: quarta-feira, 21 de outubro de 2009 20:31

Starting search for hidden objects.

'67623' objects were checked, '0' hidden objects were found.

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'SkypeNames.exe' - '1' Module(s) have been scanned

Scan process 'firefox.exe' - '1' Module(s) have been scanned

Scan process 'wmplayer.exe' - '1' Module(s) have been scanned

Scan process 'skypePM.exe' - '1' Module(s) have been scanned

Scan process 'wlcomm.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'MessengerDiscovery 2.exe' - '1' Module(s) have been scanned

Scan process 'sqlmangr.exe' - '1' Module(s) have been scanned

Scan process 'Skype.exe' - '1' Module(s) have been scanned

Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned

Scan process 'fdm.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'sm56hlpr.exe' - '1' Module(s) have been scanned

Scan process 'GrooveMonitor.exe' - '1' Module(s) have been scanned

Scan process 'rundll32.exe' - '1' Module(s) have been scanned

Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'wscntfy.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned

Scan process 'wmiapsrv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned

Scan process 'mysqld-nt.exe' - '1' Module(s) have been scanned

Scan process 'httpd.exe' - '1' Module(s) have been scanned

Scan process 'sqlservr.exe' - '1' Module(s) have been scanned

Scan process 'jqs.exe' - '1' Module(s) have been scanned

Scan process 'httpd.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'Smc.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

46 processes with 46 modules were scanned

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Boot sector 'D:\'

[iNFO] No virus was found!

Starting to scan executable files (registry).

The registry was scanned ( '57' files ).

Starting the file scan:

Begin scan in 'C:\'

C:\pagefile.sys

[WARNING] The file could not be opened!

[NOTE] This file is a Windows system file.

[NOTE] This file cannot be opened for scanning.

C:\AppServ\www\Pacotao MP\Website\info\exe\memory.exe

[DETECTION] Is the TR/Spy.Pophot.hmt Trojan

[NOTE] A backup was created as '4b4c8cab.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\BACKUP\TX# Documents\Instaladores\ComboFix.exe

[0] Archive type: RAR SFX (self extracting)

--> 32788R22FWJFW\psexec.cfexe

[1] Archive type: RSRC

--> Object

[DETECTION] Contains recognition pattern of the APPL/PsExec.E application

[NOTE] A backup was created as '4b4c9099.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\BACKUP\TX# Documents\Instaladores\DVD\hfs.new.exe

[DETECTION] Contains recognition pattern of the APPL/HttpFileServer application

[NOTE] A backup was created as '4b52914d.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\BACKUP\TX# Documents\Instaladores\DVD\Adobe CS4\CS4\Fw CS4\Keygen.exe

[DETECTION] Contains recognition pattern of the SPR/Tool.Agent.CB program

[NOTE] A backup was created as '4b589272.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\BACKUP\TX# Documents\Instaladores\DVD\Adobe CS4\CS4\Id CS4\Crack\keygen.exe

[DETECTION] Is the TR/Dldr.BZW Trojan

[NOTE] A backup was created as '4b589273.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\BACKUP\TX# Documents\Instaladores\DVD\Corel Draw X4\Pt\keygen_X4_xpeegah.exe

[DETECTION] Is the TR/Keygen.FG Trojan

[NOTE] A backup was created as '4b5892e2.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\BACKUP\TX# Documents\Variados\SysInternalsBluescreen.scr

[DETECTION] Contains recognition pattern of the JOKE/BlueScreen.A joke

[NOTE] A backup was created as '4b529458.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\Documents and Settings\Denis Lins\Desktop\curr_down.zip

[0] Archive type: ZIP

--> curr_downs.exe

[DETECTION] Is the TR/ATRAPS.Gen Trojan

[NOTE] A backup was created as '4b519561.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\Documents and Settings\Denis Lins\Meus documentos\Downloads\Pacotao_MP.rar

[0] Archive type: RAR

--> Pacotao MP\Website.rar

[1] Archive type: RAR

--> info\exe\memory.exe

[DETECTION] Is the TR/Spy.Pophot.hmt Trojan

[NOTE] A backup was created as '4b429728.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\System Volume Information\_restore{D2325ED9-3CA7-466C-82BF-0575BB77C263}\RP39\A0005886.exe

[DETECTION] Is the TR/Spy.Pophot.hmt Trojan

[NOTE] A backup was created as '4b0f9ab1.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\System Volume Information\_restore{D2325ED9-3CA7-466C-82BF-0575BB77C263}\RP39\A0005892.exe

[0] Archive type: RAR SFX (self extracting)

--> 32788R22FWJFW\psexec.cfexe

[1] Archive type: RSRC

--> Object

[DETECTION] Contains recognition pattern of the APPL/PsExec.E application

[NOTE] A backup was created as '4b0f9ab3.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\System Volume Information\_restore{D2325ED9-3CA7-466C-82BF-0575BB77C263}\RP39\A0005893.exe

[DETECTION] Contains recognition pattern of the APPL/HttpFileServer application

[NOTE] A backup was created as '48656a3c.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\System Volume Information\_restore{D2325ED9-3CA7-466C-82BF-0575BB77C263}\RP39\A0005894.exe

[DETECTION] Contains recognition pattern of the SPR/Tool.Agent.CB program

[NOTE] A backup was created as '4b0f9ab5.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\System Volume Information\_restore{D2325ED9-3CA7-466C-82BF-0575BB77C263}\RP39\A0005895.exe

[DETECTION] Is the TR/Dldr.BZW Trojan

[NOTE] A backup was created as '48656a3e.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\System Volume Information\_restore{D2325ED9-3CA7-466C-82BF-0575BB77C263}\RP39\A0005896.exe

[DETECTION] Is the TR/Keygen.FG Trojan

[NOTE] A backup was created as '4b0f9ab7.qua' ( QUARANTINE )

[NOTE] The file was deleted!

C:\System Volume Information\_restore{D2325ED9-3CA7-466C-82BF-0575BB77C263}\RP39\A0005897.scr

[DETECTION] Contains recognition pattern of the JOKE/BlueScreen.A joke

[NOTE] A backup was created as '48656a30.qua' ( QUARANTINE )

[NOTE] The file was deleted!

Begin scan in 'D:\' <Backup>

D:\TX# Documents\Instaladores\ComboFix.exe

[0] Archive type: RAR SFX (self extracting)

--> 32788R22FWJFW\psexec.cfexe

[1] Archive type: RSRC

--> Object

[DETECTION] Contains recognition pattern of the APPL/PsExec.E application

[NOTE] A backup was created as '4b4c9e0d.qua' ( QUARANTINE )

[NOTE] The file was deleted!

D:\TX# Documents\Instaladores\DVD\hfs.new.exe

[DETECTION] Contains recognition pattern of the APPL/HttpFileServer application

[NOTE] A backup was created as '4b529ef1.qua' ( QUARANTINE )

[NOTE] The file was deleted!

D:\TX# Documents\Instaladores\DVD\Adobe CS4\CS4\Fw CS4\Keygen.exe

[DETECTION] Contains recognition pattern of the SPR/Tool.Agent.CB program

[NOTE] A backup was created as '4b58a034.qua' ( QUARANTINE )

[NOTE] The file was deleted!

D:\TX# Documents\Instaladores\DVD\Adobe CS4\CS4\Id CS4\Crack\keygen.exe

[DETECTION] Is the TR/Dldr.BZW Trojan

[NOTE] A backup was created as '4b58a035.qua' ( QUARANTINE )

[NOTE] The file was deleted!

D:\TX# Documents\Instaladores\DVD\Corel Draw X4\Pt\keygen_X4_xpeegah.exe

[DETECTION] Is the TR/Keygen.FG Trojan

[NOTE] A backup was created as '4b58a0c8.qua' ( QUARANTINE )

[NOTE] The file was deleted!

D:\TX# Documents\Variados\SysInternalsBluescreen.scr

[DETECTION] Contains recognition pattern of the JOKE/BlueScreen.A joke

[NOTE] A backup was created as '4b52a278.qua' ( QUARANTINE )

[NOTE] The file was deleted!

End of the scan: quarta-feira, 21 de outubro de 2009 22:07

Used time: 1:36:22 Hour(s)

The scan has been done completely.

15074 Scanned directories

1160444 Files were scanned

22 Viruses and/or unwanted programs were found

0 Files were classified as suspicious

22 files were deleted

0 Viruses and unwanted programs were repaired

22 Files were moved to quarantine

0 Files were renamed

1 Files cannot be scanned

1160421 Files not concerned

6478 Archives were scanned

1 Warnings

23 Notes

67623 Objects were scanned with rootkit scan

0 Hidden objects were found

E ta aqui o log do MBAM:

Malwarebytes' Anti-Malware 1.41

Versão do banco de dados: 3008

Windows 5.1.2600 Service Pack 3

21/10/2009 23:30:42

mbam-log-2009-10-21 (23-30-42).txt

Tipo de Verificação: Completa (C:\|D:\|)

Objetos verificados: 401697

Tempo decorrido: 1 hour(s), 13 minute(s), 55 second(s)

Processos da Memória infectados: 0

Módulos de Memória Infectados: 0

Chaves do Registro infectadas: 0

Valores do Registro infectados: 0

Ítens do Registro infectados: 0

Pastas infectadas: 0

Arquivos infectados: 3

Processos da Memória infectados:

(Nenhum ítem malicioso foi detectado)

Módulos de Memória Infectados:

(Nenhum ítem malicioso foi detectado)

Chaves do Registro infectadas:

(Nenhum ítem malicioso foi detectado)

Valores do Registro infectados:

(Nenhum ítem malicioso foi detectado)

Ítens do Registro infectados:

(Nenhum ítem malicioso foi detectado)

Pastas infectadas:

(Nenhum ítem malicioso foi detectado)

Arquivos infectados:

C:\BACKUP\TX# Documents\Adobe.Photoshop.CS4.Extended.v11.0.Incl.Keymaker-CORE\KeyGen\keygen.exe (Trojan.Downloader) -> Quarantined

and deleted successfully.

D:\System Volume Information\_restore{D2325ED9-3CA7-466C-82BF-0575BB77C263}\RP39\A0005903.exe (Trojan.Downloader) -> Quarantined

and deleted successfully.

D:\TX# Documents\Adobe.Photoshop.CS4.Extended.v11.0.Incl.Keymaker-CORE\KeyGen\keygen.exe (Trojan.Downloader) -> Quarantined and

deleted successfully.

E ta aqui o log do HJT:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:35:49, on 21/10/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Sygate\SPF\smc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

C:\AppServ\Apache2.2\bin\httpd.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\ARQUIV~1\MICROS~3\MSSQL\binn\sqlservr.exe

C:\AppServ\Apache2.2\bin\httpd.exe

C:\AppServ\MySQL\bin\mysqld-nt.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\sm56hlpr.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe

C:\Arquivos de programas\Free Download Manager\fdm.exe

C:\Arquivos de programas\Skype\Phone\Skype.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

C:\Arquivos de programas\Skype\Plugin Manager\skypePM.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Skype\Toolbars\Shared\SkypeNames.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos

comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\ARQUIV~1\MICROS~4\Office12\GRA8E1~1.DLL

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos

comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Arquivos de programas\Free Download

Manager\iefdm2.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de

programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de

programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Arquivos de programas\Arquivos comuns\Adobe\CS4ServiceManager\CS4ServiceManager.exe"

-launchedbylogin

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [smcService] C:\ARQUIV~1\Sygate\SPF\smc.exe -startgui

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [sMSERIAL] sm56hlpr.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbam.exe"

/runcleanupscript