[Resolvido!] Suspicious Heuristic Virus !

DaniieL™ · Novembro 19, 2009

Olá!

meu Avira AntiVir

detectou algo estranho ...

não sei bem se é um virus mesmo

mais quando ele detecta um virus aparece as opções

[ ] Repair

[ ] Move to quarantine

[ ] Delete

[ ] Rename

[ ] Deny access

[ ] Ignore

mas, quando ele detectou esse virus presente na imagem abaixo:

ele só me deu as opções

[ ] Move to quarantine

[ ] Rename

[ ] Deny access

achei estranho é a primera vez que isso aconteceu ...

entretanto se houver algum problema

abaixo eis o log do HijackThis!

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:36:08, on 19/11/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Arquivos de programas\Bonjour\mDNSResponder.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

c:\ARQUIV~1\mcafee\SITEAD~1\mcsacore.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Arquivos de programas\PC Tools Firewall Plus\FWService.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Arquivos de programas\Spyware Doctor\pctsAuxs.exe

C:\Arquivos de programas\Spyware Doctor\pctsSvc.exe

C:\Arquivos de programas\System Protect\SysProtect_srv.exe

C:\Arquivos de programas\Spyware Doctor\pctsTray.exe

C:\Arquivos de programas\ThreatFire\TFService.exe

C:\WINDOWS\system32\WgaTray.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\alg.exe

C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\Arquivos de programas\ThreatFire\TFTray.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Arquivos de programas\PC Tools Firewall Plus\FirewallGUI.exe

C:\Arquivos de programas\System Protect\SysProtect_Tray.exe

C:\Arquivos de programas\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Documents and Settings\Administrador\Bluebirds\BlueBirds.exe

C:\Documents and Settings\Administrador\Configurações locais\Dados de aplicativos\Google\Update\1.2.183.13\GoogleCrashHandler.exe

C:\Arquivos de programas\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\WINDOWS\system32\oobe\sample\tclock.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

C:\ARQUIV~1\Magentic\bin\MgApp.exe

C:\Arquivos de programas\Orbitdownloader\orbitdm.exe

C:\Arquivos de programas\Orbitdownloader\orbitnet.exe

C:\Arquivos de programas\iPod\bin\iPodService.exe

C:\DOCUME~1\ADMINI~1\CONFIG~1\Temp\{2FD0B3D0-DE17-431F-A11A-4350DF1BAF69}\VistaBTSe7en.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\ARQUIV~1\Crawler\Toolbar\CToolbar.exe

C:\WINDOWS\system32\svchost.exe

C:\HiJackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60075

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60075

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60075

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60075

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60075

R3 - URLSearchHook: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\ARQUIV~1\Crawler\Toolbar\ctbr.dll

R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\ARQUIV~1\mcafee\SITEAD~1\mcieplg.dll

O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Arquivos de programas\Orbitdownloader\orbitcth.dll

O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\ARQUIV~1\Crawler\Toolbar\ctbr.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Arquivos de programas\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\ARQUIV~1\mcafee\SITEAD~1\mcieplg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Arquivos de programas\Orbitdownloader\GrabPro.dll

O3 - Toolbar: Barra de Ferramentas &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\ARQUIV~1\Crawler\Toolbar\ctbr.dll

O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\ARQUIV~1\mcafee\SITEAD~1\mcieplg.dll

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Nero\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [NBKeyScan] "C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [ThreatFire] C:\Arquivos de programas\ThreatFire\TFTray.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [00PCTFW] "C:\Arquivos de programas\PC Tools Firewall Plus\FirewallGUI.exe" -s

O4 - HKLM\..\Run: [systemProtect] C:\Arquivos de programas\System Protect\SysProtect_Tray.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Arquivos de programas\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [iSTray] "C:\Arquivos de programas\Spyware Doctor\pctsTray.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrador\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [Magentic] C:\ARQUIV~1\Magentic\bin\Magentic.exe /c

O4 - HKCU\..\Run: [bluebirds] C:\Documents and Settings\Administrador\Bluebirds\BlueBirds.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Arquivos de programas\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')

O4 - Startup: is-2IM2M.lnk = C:\Documents and Settings\Administrador\Desktop\Virus Removal Tool\is-2IM2M\startup.exe

O4 - Startup: is-BTLFB.lnk = C:\Documents and Settings\Administrador\Desktop\Virus Removal Tool1\Virus Removal Tool\is-BTLFB\startup.exe

O4 - Startup: is-DNHML.lnk = C:\Arquivos de programas\Virus Removal Tool\is-DNHML\startup.exe

O4 - Startup: is-H8NG8.lnk = C:\Documents and Settings\Administrador\Desktop\Virus Removal Tool1\is-H8NG8\startup.exe

O4 - Startup: is-U4SAE.lnk = C:\Arquivos de programas\Virus Removal Tool\is-U4SAE\startup.exe

O4 - Global Startup: Atalho para tclock.lnk = C:\WINDOWS\system32\oobe\sample\tclock.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Orbit.lnk = C:\Arquivos de programas\Orbitdownloader\orbitdm.exe

O4 - Global Startup: VistaBTSe7en.exe

O8 - Extra context menu item: &Download by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/201

O8 - Extra context menu item: &Grab video by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/204

O8 - Extra context menu item: Crawler Search - tbr:iemenu

O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/203

O8 - Extra context menu item: Down&load all by Orbit - res://C:\Arquivos de programas\Orbitdownloader\orbitmxt.dll/202

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{B9E3C1E1-5D68-4A93-97CC-B3B5897C9527}: NameServer = 200.184.26.9 200.184.26.14

O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\ARQUIV~1\mcafee\SITEAD~1\mcieplg.dll

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\ARQUIV~1\mcafee\SITEAD~1\mcieplg.dll

O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\ARQUIV~1\Crawler\Toolbar\ctbr.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Arquivos de programas\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Dispositivo Celular da Apple (Apple Mobile Device) - Apple Inc. - C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Arquivos de programas\Bonjour\mDNSResponder.exe

O23 - Service: Google Update Service (gupdate1ca5ff389694b52) (gupdate1ca5ff389694b52) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe

O23 - Service: iPod Service - Apple Inc. - C:\Arquivos de programas\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - c:\ARQUIV~1\mcafee\SITEAD~1\mcsacore.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Arquivos de programas\PC Tools Firewall Plus\FWService.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Arquivos de programas\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Arquivos de programas\Spyware Doctor\pctsSvc.exe

O23 - Service: System Protect Deletion Prevention Service (SP_Service) - Xacti Corporation - C:\Arquivos de programas\System Protect\SysProtect_srv.exe

O23 - Service: ThreatFire - PC Tools - C:\Arquivos de programas\ThreatFire\TFService.exe

--

End of file - 14512 bytes

DigRam · Novembro 21, 2009

Boa Tarde! w.storm

<!> Hipoteticamente,podemos estar diante de um 'belo' falso positivo. rsrs...

<!> Ps: O Avira está configurado,em sua heurística,dentro dos padrões?

<!> Ps: Seguiu religiosamente o tutorial do Antonio V. Sobrinho,em sua configuração?

Abraços!

DaniieL™ · Novembro 21, 2009

Boa Tarde! DigRam

corrija-me se estiver errado

'>http://dicasetutoriaisparapc.blogspot.com/2009/03/tutorial-de-instalacao-e-configuracao.html"]Tutorial do Avira 9 free (instalação e configuração)

'>http://dicasetutoriaisparapc.blogspot.com/2009/03/escaneando-seu-computador-com-o-avira.html"]Tutorial do Avira 9 free (como usá-lo corretamente)

meu Avira AntiVir está instalado conforme as instruções

dos Tutoriais acima, no qual o Analista Antonio V. Sobrinho

me indicou ...

<!> Como saber se é de fato um Falso dispositivo e não um virus real ?

<!> o Log está Limpo ?

Abraços!

DigRam · Novembro 21, 2009

Boa Tarde! w.storm

Como saber se é de fato um Falso dispositivo e não um virus real ?

<!> Submete-lo à uma pesquisa online,seria recomendável.

o Log está Limpo ?

<!> Se voçê possui bons hábitos ao navegar ou acessar e-mails,dificilmente serás infectado por 'vírus'.

<!> O relatório do HJT não apresenta entradas ruins.

Abraços!

DaniieL™ · Novembro 21, 2009

Boa Noite! DigRam

eu estou querendo restaura-lo

da quarentena pra mim ta parecendo mesmo

um Falso Positivo

mas, quero ter certeza antes de qualquer coisa

eu estive pensando no VirScan

mas, não sei ...

que site você me indica pra fazer essa pesquisa Online ?

Abraços!

DigRam · Novembro 22, 2009

Boa Noite! DigRam

eu estou querendo restaura-lo

da quarentena pra mim ta parecendo mesmo

um Falso Positivo

mas, quero ter certeza antes de qualquer coisa

eu estive pensando no VirScan

mas, não sei ...

que site você me indica pra fazer essa pesquisa Online ?

Abraços!

<><><><><><><><><><>

Boa Noite! w.storm

<!> VirSCAN.org está ótimo. Pode executar!

<!> < VirSCAN.org >

<!> Outra boa opção está em Sunbelt Sandbox.

<><><><><><><><><><>

<@> Submeta o ficheiro detectado pelo Avira,à uma análise em: < CWSandbox >

<@> No campo,digite o seu E-Mail.

<@> Escolha o relatório,dessa verificação,no formato texto!

<@> Clique em: Submit sample for analysis,após indicar o caminho ao ficheiro para upload.

<@> Ps: Tendo êxito,teremos a seguinte mensagem:

Success: Your file has been submitted to the processing queue. You will receive an email in a few minutes with the analysis. Sunbelt Sandbox ID: 10075243

<@> Poste o relatório,dessa análise,que lhe será enviada por E-Mail.

Abraços!

DaniieL™ · Novembro 22, 2009

Bom dia! DigRam

VirSCAN.org Scanned Report :

Scanned time : 2009/11/22 00:40:21 (ACT)

Scanner results: Todos os softwares reportaram que não encontraram códigos maliciosos!

File Name : _CACHE_003_

File Size : 16907772 byte

File Type : data

MD5 : 26a48109071bfd0a47e8d7a4d110789e

SHA1 : 67345b8cf8509e1fb7dbd3ec56358aa88432b9fd

Online report : http://virscan.org/report/3409ea5e331d6d2dee23f21abc276b26.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result

a-squared 4.5.0.8 20091121040123 2009-11-21 8.19 -

AhnLab V3 2009.11.21.00 2009.11.21 2009-11-21 1.00 -

AntiVir 8.2.1.72 7.10.1.43 2009-11-20 0.28 -

Antiy 2.0.18 20091120.3284132 2009-11-20 0.12 -

Arcavir 2009 200911201251 2009-11-20 0.02 -

Authentium 5.1.1 200911211439 2009-11-21 1.20 -

AVAST! 4.7.4 091121-1 2009-11-21 0.67 -

AVG 8.5.288 270.14.76/2518 2009-11-22 0.30 -

BitDefender 7.81008.4570843 7.29070 2009-11-22 3.87 -

CA (VET) 35.1.0 7132 2009-11-19 7.53 -

ClamAV 0.95.2 10055 2009-11-21 1.07 -

Comodo 3.12 2993 2009-11-22 0.79 -

CP Secure 1.3.0.5 2009.11.22 2009-11-22 2.77 -

Dr.Web 4.44.0.9170 2009.11.22 2009-11-22 7.18 -

F-Prot 4.4.4.56 20091121 2009-11-21 1.20 -

F-Secure 7.02.73807 2009.11.22.01 2009-11-22 10.20 -

Fortinet 2.81-3.120 11.79 2009-11-21 0.15 -

GData 19.8937/19.576 20091122 2009-11-22 5.55 -

ViRobot 20091120 2009.11.20 2009-11-20 0.41 -

Ikarus T3.1.01.74 2009.11.22.74570 2009-11-22 4.29 -

JiangMin 11.0.800 2009.11.21 2009-11-21 5.35 -

Kaspersky 5.5.10 2009.11.22 2009-11-22 0.04 -

KingSoft 2009.2.5.15 2009.11.21.23 2009-11-21 0.51 -

McAfee 5.3.00 5809 2009-11-21 7.01 -

Microsoft 1.5302 2009.11.22 2009-11-22 6.72 -

Norman 6.01.09 6.01.00 2009-11-21 4.00 -

Panda 9.05.01 2009.11.21 2009-11-21 1.84 -

Trend Micro 9.000-1003 6.643.00 2009-11-21 0.00 -

Quick Heal 10.00 2009.11.21 2009-11-21 13.65 -

Rising 20.0 22.22.06.01 2009-11-22 0.28 -

Sophos 3.01.0 4.47 2009-11-22 2.91 -

Sunbelt 5518 5518 2009-11-18 1.98 -

Symantec 1.3.0.24 20091121.004 2009-11-21 0.18 -

nProtect 20091122.01 6284843 2009-11-22 3.72 -

The Hacker 6.5.0.2 v00011 2009-09-18 0.75 -

VBA32 3.12.12.0 20091121.2052 2009-11-21 2.21 -

VirusBuster 4.5.11.10 10.113.25/2000688 2009-11-21 3.82 -

<@> Não consegui fazer o esquema do CWSandbox

<@> Está provado realmente que é um falso positivo ?

Abraços!

DigRam · Novembro 22, 2009

Bom Dia! w.storm

Não consegui fazer o esquema do CWSandbox
Está provado realmente que é um falso positivo ?

<!> Sim! Pois na análise em VirSCAN.org,temos AntiVir e Sunbelt sem detecções de códigos maliciosos. ( Ps: Indiquei-os em azul )

Abraços!

DaniieL™ · Novembro 22, 2009

Boa Tarde! DigRam

Ok, eu ja o restaurei da quarentena

por fim eu estive fazeno uns downloads esses dias

quero ter certeza de que continuo Limpo

analise mais 1 veiz esse Log do HJT

pra finalizarmos o assunTo .

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:49:12, on 22/11/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

C:\Arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Arquivos de programas\Bonjour\mDNSResponder.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

c:\ARQUIV~1\mcafee\SITEAD~1\mcsacore.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Arquivos de programas\PC Tools Firewall Plus\FWService.exe

C:\WINDOWS\system32\WgaTray.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Spyware Doctor\pctsAuxs.exe

C:\Arquivos de programas\Spyware Doctor\pctsSvc.exe

C:\Arquivos de programas\Microsoft Office\Office12\GrooveMonitor.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe

C:\Arquivos de programas\Java\jre6\bin\jusched.exe

C:\Arquivos de programas\ThreatFire\TFTray.exe

C:\Arquivos de programas\Arquivos comuns\Real\Update_OB\realsched.exe

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Arquivos de programas\PC Tools Firewall Plus\FirewallGUI.exe

C:\Arquivos de programas\System Protect\SysProtect_Tray.exe

C:\Arquivos de programas\iTunes\iTunesHelper.exe

C:\Arquivos de programas\Spyware Doctor\pctsTray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Documents and Settings\Administrador\Bluebirds\BlueBirds.exe

C:\Arquivos de programas\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Documents and Settings\Administrador\Configurações locais\Dados de aplicativos\Google\Update\1.2.183.13\GoogleCrashHandler.exe

C:\WINDOWS\system32\oobe\sample\tclock.exe

C:\Arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe

C:\Arquivos de programas\Orbitdownloader\orbitdm.exe

C:\Arquivos de programas\System Protect\SysProtect_srv.exe

C:\ARQUIV~1\Magentic\bin\MgApp.exe

C:\Arquivos de programas\Orbitdownloader\orbitnet.exe

C:\DOCUME~1\ADMINI~1\CONFIG~1\Temp\{2648B99B-CED6-4157-95E3-C62EBBF04E87}\VistaBTSe7en.exe