[Resolvido!] Log Hijackthis

krika · Janeiro 11, 2010

Tentei desinstalar o Combofix mas entrava a mesma tela dizendo Combofix executar ou salvar e mesmo eu clicando em executar, dava a seguinte mensagem: O aplicativo ou a DLL C:\WINDOWS\system32\DMDGB.DLL não é uma imagem válida para o Windows. Compare com o disco de instalação. Mas depois de um tempo, tentei novamente e deu que o Combofix estava desinstalado. Agora vou baixá-lo novamente e depois posto o log.

PedroN · Janeiro 12, 2010

Aguardando o log do programa na sua próxima resposta;

krika · Janeiro 12, 2010

Sei que você disse para não mexer no mouse mas aquela mensagem que eu falei anteriormente entrava a todo instante e parava o Combofix, daí eu tinha que, com o mouse, ficar fechando para ele poder rodar. Segue o log do Combofix.

ComboFix 10-01-11.01 - Vinicius 11/01/2010 21:34:48.5.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.511.251 [GMT -2:00]

Executando de: c:\documents and settings\Vinicius\Desktop\ComboFix.exe

AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\key2010

c:\windows\system\Instalamos.MANIFEST

c:\windows\system32\ccrpTmr6.dll

c:\windows\system32\libmysql41.dll

c:\windows\system32\msnmsgr.exe

c:\windows\system32\Versão_1.0.0.7.Dll

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-12-12 to 2010-01-12 ))))))))))))))))))))))))))))

.

2010-01-09 00:53 . 2009-10-22 14:54 37392 ----a-w- c:\windows\system32\drivers\95943152.sys

2010-01-09 00:53 . 2009-10-10 00:31 315408 ----a-w- c:\windows\system32\drivers\9594315.sys

2010-01-09 00:53 . 2009-09-25 18:59 128016 ----a-w- c:\windows\system32\drivers\95943151.sys

2010-01-08 10:30 . 2009-10-22 14:54 37392 ----a-w- c:\windows\system32\drivers\44804132.sys

2010-01-08 10:30 . 2009-10-10 00:31 315408 ----a-w- c:\windows\system32\drivers\4480413.sys

2010-01-08 10:30 . 2009-09-25 18:59 128016 ----a-w- c:\windows\system32\drivers\44804131.sys

2010-01-07 19:08 . 2010-01-07 19:08 7168 ----a-w- c:\windows\system32\drivers\uteznjcy.sys

2010-01-07 17:23 . 2009-10-22 14:54 37392 ----a-w- c:\windows\system32\drivers\93876632.sys

2010-01-07 17:23 . 2009-10-10 00:31 315408 ----a-w- c:\windows\system32\drivers\9387663.sys

2010-01-07 17:23 . 2009-09-25 18:59 128016 ----a-w- c:\windows\system32\drivers\93876631.sys

2010-01-07 16:58 . 2009-10-22 14:54 37392 ----a-w- c:\windows\system32\drivers\63661392.sys

2010-01-07 16:58 . 2009-10-10 00:31 315408 ----a-w- c:\windows\system32\drivers\6366139.sys

2010-01-07 16:58 . 2009-09-25 18:59 128016 ----a-w- c:\windows\system32\drivers\63661391.sys

2010-01-07 15:15 . 2009-10-22 14:54 37392 ----a-w- c:\windows\system32\drivers\36322172.sys

2010-01-07 15:15 . 2009-10-10 00:31 315408 ----a-w- c:\windows\system32\drivers\3632217.sys

2010-01-07 15:15 . 2009-09-25 18:59 128016 ----a-w- c:\windows\system32\drivers\36322171.sys

2010-01-07 14:38 . 2010-01-07 14:38 60596304 ----a-w- c:\arquivos de programas\setup_9.0.0.722_07.01.2010_15-15.exe

2010-01-07 12:56 . 2010-01-07 12:58 1069379 --sh--w- c:\windows\system32\iissas.exe

2009-12-21 20:55 . 2009-12-21 20:55 -------- d-----w- c:\documents and settings\Vinicius\Dados de aplicativos\Apple Computer

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-10 03:12 . 2008-08-24 19:26 -------- d-----w- c:\documents and settings\Vinicius\Dados de aplicativos\Orbit

2009-12-03 12:13 . 2004-08-04 03:44 563712 ----a-w- c:\windows\system32\shdoclc.dll

2009-11-27 21:24 . 2009-11-27 21:24 -------- d-----w- c:\arquivos de programas\Alwil Software

2009-11-22 20:50 . 2001-10-28 18:07 49804 ----a-w- c:\windows\system32\perfc016.dat

2009-11-22 20:50 . 2001-10-28 18:07 347648 ----a-w- c:\windows\system32\perfh016.dat

2009-11-22 17:10 . 2005-09-26 19:28 23008 ----a-w- c:\windows\system32\emptyregdb.dat

2009-11-17 10:31 . 2008-06-11 02:59 -------- d-----w- c:\arquivos de programas\Google

2009-10-24 19:15 . 2009-10-24 19:15 3351812 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\msxml6Exec.exe

2009-10-24 19:15 . 2009-10-24 19:15 36864 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\Sleep.exe

2009-10-24 19:15 . 2009-10-24 19:15 3203453 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\Installer\CommonCustomActions\vcredistExec.exe

2009-10-24 19:10 . 2009-10-24 19:22 24424120 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\Installations\{4C911A61-39EA-41CC-AB3C-FE3BFFDB5F78}\NokiaSoftwareUpdaterSetup_pt_br.exe

2009-10-19 22:43 . 2009-10-19 22:43 9232 ----a-w- c:\documents and settings\Vinicius\mqdmmdfl.sys

2009-10-19 22:43 . 2009-10-19 22:43 92064 ----a-w- c:\documents and settings\Vinicius\mqdmmdm.sys

2009-10-19 22:43 . 2009-10-19 22:43 79328 ----a-w- c:\documents and settings\Vinicius\mqdmserd.sys

2009-10-19 22:43 . 2009-10-19 22:43 66656 ----a-w- c:\documents and settings\Vinicius\mqdmbus.sys

2009-10-19 22:43 . 2009-10-19 22:43 6208 ----a-w- c:\documents and settings\Vinicius\mqdmcmnt.sys

2009-10-19 22:43 . 2009-10-19 22:43 5936 ----a-w- c:\documents and settings\Vinicius\mqdmwhnt.sys

2009-10-19 22:43 . 2009-10-19 22:43 4048 ----a-w- c:\documents and settings\Vinicius\mqdmcr.sys

2009-10-19 22:43 . 2009-06-12 13:21 25600 ----a-w- c:\documents and settings\Vinicius\usbsermptxp.sys

2009-10-19 22:43 . 2009-06-12 13:21 22768 ----a-w- c:\documents and settings\Vinicius\usbsermpt.sys

2009-10-19 21:25 . 2009-10-19 21:25 1024 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\BVRP Software\Motorola Phone Tools\faxres.cmd

2005-10-10 16:41 . 2005-10-17 17:40 65 ----a-r- c:\arquivos de programas\amrun.ini

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"updateMgr"="c:\arquivos de programas\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

"NBJ"="c:\arquivos de programas\Ahead\Nero BackItUp\NBJ.exe" [2005-04-14 1957888]

"PC Suite Tray"="c:\arquivos de programas\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-03-20 1312256]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"QuickTime Task"="c:\arquivos de programas\QuickTime\qttask.exe" [2005-10-01 155648]

"Ink Monitor"="c:\arquivos de programas\EPSON\Ink Monitor\InkMonitor.exe" [2004-05-05 262210]

"SunJavaUpdateSched"="c:\arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]

"TkBellExe"="c:\arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" [2009-10-07 198160]

"Malwarebytes Anti-Malware (reboot)"="c:\arquivos de programas\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-04 44544]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\

Adobe Reader Speed Launch.lnk - c:\arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Orbit.lnk]

path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Orbit.lnk

backup=c:\windows\pss\Orbit.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Software Kodak EasyShare.lnk]

path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Software Kodak EasyShare.lnk

backup=c:\windows\pss\Software Kodak EasyShare.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-13 22:21 1695232 ------w- c:\arquivos de programas\Messenger\msmsgs.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\LimeWire\\LimeWire.exe"=

"c:\\Arquivos de programas\\Messenger\\msmsgs.exe"=

"c:\\Arquivos de programas\\Orbitdownloader\\orbitnet.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5642:TCP"= 5642:TCP:piwrauc

R0 36322172;36322172 Boot Guard Driver;c:\windows\system32\drivers\36322172.sys [7/1/2010 13:15 37392]

R0 44804132;44804132 Boot Guard Driver;c:\windows\system32\drivers\44804132.sys [8/1/2010 08:30 37392]

R0 63661392;63661392 Boot Guard Driver;c:\windows\system32\drivers\63661392.sys [7/1/2010 14:58 37392]

R0 93876632;93876632 Boot Guard Driver;c:\windows\system32\drivers\93876632.sys [7/1/2010 15:23 37392]

R0 95943152;95943152 Boot Guard Driver;c:\windows\system32\drivers\95943152.sys [8/1/2010 22:53 37392]

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [20/11/2009 10:51 28552]

R1 36322171;36322171;c:\windows\system32\drivers\36322171.sys [7/1/2010 13:15 128016]

R1 44804131;44804131;c:\windows\system32\drivers\44804131.sys [8/1/2010 08:30 128016]

R1 63661391;63661391;c:\windows\system32\drivers\63661391.sys [7/1/2010 14:58 128016]

R1 93876631;93876631;c:\windows\system32\drivers\93876631.sys [7/1/2010 15:23 128016]

R1 95943151;95943151;c:\windows\system32\drivers\95943151.sys [8/1/2010 22:53 128016]

R1 setup_9.0.0.722_07.01.2010_15-15drv;setup_9.0.0.722_07.01.2010_15-15drv;c:\windows\system32\drivers\9594315.sys [8/1/2010 22:53 315408]

R2 a2free;a-squared Free Service;c:\arquivos de programas\a-squared Free\a2service.exe [4/11/2009 21:45 1858144]

S3 FUTUREX;FUTUREX;\??\f:\aida\aida32.sys --> f:\aida\aida32.sys [?]

S3 nnyckmw;nnyckmw;\??\c:\windows\system32\01.tmp --> c:\windows\system32\01.tmp [?]

S3 uteznjcy;AVZ Kernel Driver;c:\windows\system32\drivers\uteznjcy.sys [7/1/2010 17:08 7168]

.

Conteúdo da pasta 'Tarefas Agendadas'

2009-11-14 c:\windows\Tasks\WGASetup.job

- c:\windows\system32\KB905474\wgasetup.exe [2009-10-30 00:18]

.

------- Scan Suplementar -------

.

uStart Page = hxxp://www.ig.com.br/

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: &Download by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/201

IE: &Grab video by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/204

IE: Do&wnload selected by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/203

IE: Down&load all by Orbit - c:\arquivos de programas\Orbitdownloader\orbitmxt.dll/202

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

Trusted Zone: com.br\www.nppc-brasil

Trusted Zone: com.br\www.vendas-purina

TCP: {B4A3B3AF-C608-467A-A10B-62D80C6AF660} = 200.195.247.216,200.201.133.69

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

FF - ProfilePath - c:\documents and settings\Vinicius\Dados de aplicativos\Mozilla\Firefox\Profiles\lhpete9w.default\

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: browser.startup.homepage - www.ig.com.br

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=vmn&type=vdio5&p=

FF - component: c:\arquivos de programas\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

.

- - - - ORFÃOS REMOVIDOS - - - -

MSConfigStartUp-NeroFilterCheck - c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe

AddRemove-{76E41F43-59D2-4F30-BA42-9A762EE1E8DE} - c:\arquivos de programas\InstallShield Installation Information\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}\Setup.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-01-12 00:27

Windows 5.1.2600 Service Pack 2 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\nnyckmw]

"ImagePath"="\??\c:\windows\system32\01.tmp"

.

Tempo para conclusão: 2010-01-12 00:33:06

ComboFix-quarantined-files.txt 2010-01-12 02:32

Pré-execução: 1.628.782.592 bytes disponíveis

Pós execução: 1.754.820.608 bytes disponíveis

- - End Of File - - F0AF524D6E0F87C21FB30AD1BA10C21C

Tem mais uma coisa, o alerta de segurança do Windows continua dizendo que o meu computador pode estar em risco e cita que o Kaspersky está desatualizado, mas eu já excluí o Kaspersky há muito tempo.

PedroN · Janeiro 12, 2010

Sugiro que imprima ou salve os procedimentos abaixo, e não use a internet até terminado o procedimento.

Selecione e copie o texto dentro do QUOTE (caixa cinza) abaixo. Abra o Bloco de notas e cole o que copiou. Salve então, na área de trabalho, com o nome de CFScript.txt.

File::
c:\windows\system32\iissas.exe

c:\windows\system32\01.tmp

Registry::

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5642:TCP"=-

Esse script foi elaborado somente para este computador, de acordo com os arquivos e chaves presentes não use-o em outro computador, pos pode trazer danos.

Arraste agora o CFScript.txt para o ComboFix conforme a demonstração abaixo.

O ComboFix irá rodar e reiniciará o PC automaticamente para completar o processo de remoção.

IMPORTANTE: Não use o mouse nem o teclado quando o ComboFix estiver rodando.

Quando acabar, será gerado um log, que estará em C:\ComboFix.txt.

Poste-o junto com o novo log do hijackthis

krika · Janeiro 12, 2010

Nao posso mexer no mouse mas aquela figura que eu falei anteriormente aparece na tela e o Combofix nao funciona. Já esperei um tempao e nada. O que faço, mexo no mouse e clico para fechar a tal da janela ou o que?

krika · Janeiro 12, 2010

Tive que mexer no mouse por causa daquela imagem que aparecia. Segue os logs

COMBOFIX

ComboFix 10-01-11.01 - Vinicius 12/01/2010 15:07:47.6.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.55.1046.18.511.251 [GMT -2:00]

Executando de: c:\documents and settings\Vinicius\Desktop\ComboFix.exe

Comandos utilizados :: c:\documents and settings\Vinicius\Desktop\CFScript.txt

AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FILE ::

"c:\windows\system32\01.tmp"

"c:\windows\system32\iissas.exe"

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\iissas.exe