[Arquivado] Browser travando ao abrir tópico

josé pimpolho · Dezembro 8, 2009

Olá, criei este post: http://forum.imasters.com.br/index.php?/topic/374106-trojan-no-atapi-sys/

porém, depois que postei o log do hijack, sempre que abro o tópico o browser trava e não consigo vê-lo. Já tentei abrir com outros browsers, mas acontece a mesma coisa.

Se possível, eu gostaria que fosse postado novamente aqui o que foi postado lá no outro tópico após o envio do log

Obrigado

wings · Dezembro 8, 2009

Olá, criei este post: http://forum.imasters.com.br/index.php?/topic/374106-trojan-no-atapi-sys/

porém, depois que postei o log do hijack, sempre que abro o tópico o browser trava e não consigo vê-lo. Já tentei abrir com outros browsers, mas acontece a mesma coisa.

Se possível, eu gostaria que fosse postado novamente aqui o que foi postado lá no outro tópico após o envio do log

Obrigado

Concordo plenamente...seu tópico está travando o browser.

Vamos continuar por aqui.

*Desative temporariamente seu antivírus

Iniciar > Programas > AVG
Abra a Interface do usuário do AVG

Clique duas vezes na Proteção Residente

Desmarque a opção "Proteção Residente ativa"

Salve as alterações

*Baixe o ComboFix e salve-o no desktop

*Duplo-clique no arquivo Combofix.exe

*Aceite o contrato

*Se o console de recuperação do Windows já estiver instalado, o ComboFix irá continuar o processo automaticamente. Caso não esteja uma janela, conforme abaixo, será aberta. Clique em [sIM] para aceitar a instalação do mesmo.

*Após a instalação, clique em [sIM] para continuar.

*Importante: enquanto o ComboFix estiver em execução, não use o mouse nem o teclado!!..... Para interromper o procedimento tecle N ou 2 e depois ENTER.

*O programa será fechado automaticamente

*Cole o relatório criado em C:\combofix.txt

josé pimpolho · Dezembro 9, 2009

ComboFix 09-12-08.03 - adm 08/12/2009 23:00:11.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.2047.1408 [GMT -3:00]

Executando de: c:\documents and settings\adm\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\java\jre1.6.0\bin\applet\jvm\services.exe

c:\windows\java\jre1.6.0\bin\jbroker.exe

c:\windows\system32\2158743776.dat

c:\windows\system32\av_md.exe

c:\windows\system32\config\systemprofile\av_md.exe

c:\windows\system32\config\systemprofile\oashdihasidhasuidhiasdhiashdiuasdhasd

c:\windows\system32\tmp62.tmp

c:\windows\system32\tmp63.tmp

c:\windows\system32\vbbho.tlb

c:\windows\Sysvxd.exe

E:\install.exe

A cópia de c:\windows\system32\Drivers\atapi.sys foi encontrada e desinfectada

Cópia restaurada de - c:\windows\ServicePackFiles\i386\atapi.sys

.

((((((((((((((((((((((((((((((((((((((( Drivers/Serviços )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_AVG8WDPOLICYAGENT

-------\Service_avg8wdPolicyAgent

(((((((((((((((( Arquivos/Ficheiros criados de 2009-11-09 to 2009-12-09 ))))))))))))))))))))))))))))

.

2009-12-08 14:52 . 2009-12-08 14:53 -------- d-----w- C:\HiJack

2009-12-07 00:11 . 2009-12-07 00:12 -------- d-----w- c:\arquivos de programas\hijack

2009-12-06 08:48 . 2009-12-06 08:48 164 ----a-w- c:\windows\system32\fjhdyfhsn.bat

2009-12-04 21:19 . 2009-12-08 19:24 -------- d-----w- c:\documents and settings\adm\Dados de aplicativos\Bioshock

2009-12-04 21:04 . 2009-12-04 21:04 -------- d-----w- c:\arquivos de programas\2K Games

2009-11-26 14:54 . 2009-11-26 14:54 -------- d-----w- C:\BrowserPlusPlugins

2009-11-26 12:19 . 2009-11-10 11:19 2064152 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg8\update\backup\avgcorex.dll

2009-11-20 15:28 . 2009-11-20 15:28 85012 ----a-w- c:\windows\system32\Nuncalev.zip

2009-11-20 00:58 . 2009-11-20 00:58 53760 ----a-w- c:\windows\system32\zlib.dll

2009-11-20 00:58 . 2009-11-20 00:58 45056 --sh--w- c:\windows\system32\Mdtc.exe

2009-11-20 00:58 . 2009-11-20 00:58 40960 ----a-w- c:\windows\system32\shdocwv.dll

2009-11-20 00:58 . 2009-10-30 05:51 249856 ----a-w- c:\windows\system32\Nuncalev.exe

2009-11-11 03:28 . 2009-11-11 03:28 247280 ----a-w- c:\documents and settings\adm\Dados de aplicativos\Mozilla\plugins\npgoogletalk.dll

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-12-09 02:06 . 2009-03-06 05:03 -------- d-----w- c:\arquivos de programas\Steam

2009-12-08 19:48 . 2009-10-27 15:22 -------- d-----w- c:\documents and settings\adm\Dados de aplicativos\HPAppData

2009-12-06 08:48 . 2009-12-06 08:48 16 ----a-w- c:\documents and settings\NetworkService\Dados de aplicativos\fvgqad.dat

2009-12-06 08:48 . 2009-12-06 08:48 4 ----a-w- c:\documents and settings\adm\Dados de aplicativos\avdrn.dat

2009-12-06 08:02 . 2009-03-07 05:07 -------- d-----w- c:\documents and settings\adm\Dados de aplicativos\uTorrent

2009-12-04 21:04 . 2009-04-28 04:13 -------- d--h--w- c:\arquivos de programas\InstallShield Installation Information

2009-12-02 23:12 . 2009-03-10 00:23 -------- d-----w- c:\documents and settings\adm\Dados de aplicativos\Skype

2009-12-02 19:02 . 2009-03-26 09:46 -------- d-----w- c:\documents and settings\adm\Dados de aplicativos\skypePM

2009-12-01 22:29 . 2009-12-01 22:27 -------- d-----w- c:\arquivos de programas\K-Lite Codec Pack

2009-11-21 23:50 . 2009-03-25 09:31 -------- d-----w- c:\documents and settings\adm\Dados de aplicativos\Audacity

2009-11-14 23:32 . 2009-03-07 06:28 -------- d-----w- c:\arquivos de programas\SystemRequirementsLab

2009-11-10 23:05 . 2009-09-18 20:20 -------- d-----w- c:\arquivos de programas\Windows Live

2009-11-10 18:31 . 2009-05-06 18:24 -------- d-----w- c:\documents and settings\adm\Dados de aplicativos\U3

2009-11-09 18:00 . 2009-12-01 22:27 85504 ----a-w- c:\windows\system32\ff_vfw.dll

2009-11-04 02:07 . 2009-11-04 02:07 -------- d-----w- c:\documents and settings\adm\Dados de aplicativos\runic games

2009-11-04 02:02 . 2009-11-04 02:02 -------- d-----w- c:\arquivos de programas\Runic Games

2009-11-03 12:38 . 2001-10-28 12:07 77558 ----a-w- c:\windows\system32\perfc016.dat

2009-11-03 12:38 . 2001-10-28 12:07 466718 ----a-w- c:\windows\system32\perfh016.dat

2009-10-30 17:26 . 2009-10-30 17:26 -------- d-----w- c:\arquivos de programas\DIFX

2009-10-30 17:26 . 2009-07-10 04:32 -------- d-----w- c:\arquivos de programas\Arquivos comuns\Wise Installation Wizard

2009-10-26 21:13 . 2009-10-26 21:13 -------- d-----w- c:\documents and settings\adm\Dados de aplicativos\HP

2009-10-26 21:00 . 2009-10-26 21:00 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\WEBREG

2009-10-26 21:00 . 2009-10-26 20:42 167933 ----a-w- c:\windows\hphins27.dat

2009-10-26 20:52 . 2009-10-26 20:52 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\HP

2009-10-26 20:52 . 2009-10-26 20:52 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\HP Product Assistant

2009-10-26 20:52 . 2009-05-09 15:35 -------- d-----w- c:\arquivos de programas\HP

2009-10-26 20:51 . 2009-10-26 20:51 -------- d-----w- c:\arquivos de programas\Arquivos comuns\HP

2009-10-26 20:49 . 2009-10-26 20:49 -------- d-----w- c:\documents and settings\All Users\Dados de aplicativos\Hewlett-Packard

2009-10-15 22:51 . 2009-10-13 01:07 -------- d-----w- c:\arquivos de programas\Max Payne

2009-10-14 21:53 . 2009-10-14 18:27 -------- d-----w- c:\documents and settings\adm\Dados de aplicativos\GetRightToGo

2009-10-06 00:15 . 2009-10-06 00:11 1925024 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\NOS\Adobe_Downloads\install_flash_player.exe

2009-09-23 16:11 . 2009-09-23 16:11 152576 ----a-w- c:\documents and settings\adm\Dados de aplicativos\Sun\Java\jre1.6.0_15\lzma.dll

2009-09-18 15:15 . 2009-09-18 15:15 15240 ----a-w- c:\documents and settings\adm\Dados de aplicativos\Microsoft\IdentityCRL\ppcrlconfig.dll

.

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1F6667A8-BA4F-4F9E-BBB0-4F8AB0988C80}]

2009-11-20 00:58 40960 ----a-w- c:\windows\system32\shdocwv.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]

"MsnMsgr"="c:\arquivos de programas\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]

"Steam"="c:\arquivos de programas\Steam\Steam.exe" [2009-10-26 1217808]

"DAEMON Tools Lite"="c:\arquivos de programas\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]

"Google Update"="c:\documents and settings\adm\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe" [2009-08-05 133104]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-07-27 61952]

"RTHDCPL"="RTHDCPL.EXE" [2008-09-09 16851968]

"NeroFilterCheck"="c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

"AVG8_TRAY"="c:\arquiv~1\AVG\AVG8\avgtray.exe" [2009-11-26 2029336]

"RoxWatchTray"="c:\arquivos de programas\Arquivos comuns\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-04-23 228088]

"QuickTime Task"="c:\arquivos de programas\QuickTime\QTTask.exe" [2009-05-26 413696]

"iTunesHelper"="c:\arquivos de programas\iTunes\iTunesHelper.exe" [2009-06-05 292136]

"nwiz"="c:\arquivos de programas\NVIDIA Corporation\nView\nwiz.exe" [2009-08-13 1657376]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-17 13877248]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-08-17 86016]

"SunJavaUpdateSched"="c:\arquivos de programas\Java\jre6\bin\jusched.exe" [2009-07-25 149280]

"HP Software Update"="c:\arquivos de programas\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]

"hpqSRMon"="c:\arquivos de programas\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]

"MessengerPlus10"="c:\windows\system32\Mdtc.exe" [2009-11-20 45056]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\

Adobe Reader Speed Launch.lnk - c:\arquivos de programas\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

HP Digital Imaging Monitor.lnk - c:\arquivos de programas\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]

Microsoft Office.lnk - c:\arquivos de programas\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-08-20 13:27 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgemc.exe"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgupd.exe"=

"c:\\Arquivos de programas\\AVG\\AVG8\\avgnsx.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Arquivos de programas\\uTorrent\\uTorrent.exe"=

"c:\\Arquivos de programas\\Mozilla Firefox\\firefox.exe"=

"c:\\WINDOWS\\system32\\dplaysvr.exe"=

"c:\\Arquivos de programas\\Bonjour\\mDNSResponder.exe"=

"c:\\Arquivos de programas\\iTunes\\iTunes.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"c:\\Arquivos de programas\\alaplaya\\S4League\\S4Client.exe"=

"c:\\Documents and Settings\\adm\\Configurações locais\\Dados de aplicativos\\Google\\Google Talk Plugin\\googletalkplugin.dll"=

"c:\\Documents and Settings\\adm\\Configurações locais\\Dados de aplicativos\\Google\\Google Talk Plugin\\googletalkplugin.exe"=

"c:\\Arquivos de programas\\Pando Networks\\Media Booster\\PMB.exe"=

"c:\\Documents and Settings\\adm\\Desktop\\Worms Armageddon Final Rip by KirA\\Worms Armageddon Full 36290 by KirA\\WA.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Arquivos de programas\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Arquivos de programas\\Java\\jre6\\bin\\javaw.exe"=

"c:\\Arquivos de programas\\Steam\\Steam.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Arquivos de programas\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Arquivos de programas\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"59014:TCP"= 59014:TCP:Pando Media Booster

"59014:UDP"= 59014:UDP:Pando Media Booster

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6/4/2009 15:19 717296]

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [4/3/2009 19:52 335240]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [4/3/2009 19:52 108552]

R2 ASTRA32;ASTRA32 Kernel Driver 5.2.1.0;c:\arquivos de programas\ASTRA32\astra32.sys [22/2/2007 11:28 30864]

R2 avg8emc;AVG Free8 E-mail Scanner;c:\arquiv~1\AVG\AVG8\avgemc.exe [7/3/2009 14:09 908056]

R2 avg8wd;AVG Free8 WatchDog;c:\arquiv~1\AVG\AVG8\avgwdsvc.exe [7/3/2009 14:09 297752]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

------- Scan Suplementar -------

.

uDefault_Search_URL = hxxp://www.google.com/ie

uInternet Settings,ProxyServer = 193.171.32.6:80

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xportar para o Microsoft Excel - c:\arquiv~1\MICROS~2\Office10\EXCEL.EXE/3000

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

FF - ProfilePath - c:\documents and settings\adm\Dados de aplicativos\Mozilla\Firefox\Profiles\kewugjr1.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.diginet.com.br/

FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=

FF - plugin: c:\arquivos de programas\Google\Picasa3\npPicasa3.dll

FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

FF - plugin: c:\arquivos de programas\Microsoft\Office Live\npOLW.dll

FF - plugin: c:\arquivos de programas\Mozilla Firefox\plugins\npPandoWebInst.dll

FF - plugin: c:\browserplusplugins\86bc4f9b9ecf7af66ff436884d6f1650\npybrowserplus_2.4.21.dll

FF - plugin: c:\documents and settings\adm\Dados de aplicativos\Mozilla\Firefox\Profiles\kewugjr1.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll

FF - plugin: c:\documents and settings\adm\Dados de aplicativos\Mozilla\plugins\npgoogletalk.dll

---- FIREFOX POLICIES ----

c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");

.

- - - - ORFÃOS REMOVIDOS - - - -

BHO-{A3BC75A2-1F87-4686-AA43-5347D756017C} - c:\arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - c:\arquivos de programas\AVG\AVG8\Toolbar\IEToolbar.dll

AddRemove-LimitRO Small Client - c:\arquivos de programas\Gravity\Cópia de RO\uninst.exe

AddRemove-Soldat_is1 - c:\soldat\unins000.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-12-08 23:06

Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully

user: MBR read successfully

called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys spdl.sys >>UNKNOWN [0x89E05938]<<

kernel: MBR read successfully

detected MBR rootkit hooks:

\Driver\Disk -> CLASSPNP.SYS @ 0xb80ecf28

\Driver\ACPI -> ACPI.sys @ 0xb7e67cb8

\Driver\atapi -> atapi.sys @ 0xb7dfcb40

IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8

ParseProcedure -> ntkrnlpa.exe @ 0x805827e8

\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8

ParseProcedure -> ntkrnlpa.exe @ 0x805827e8

NDIS: Realtek RTL8169/8110 Family Gigabit Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xb7d05bb0

PacketIndicateHandler -> NDIS.sys @ 0xb7d12a21

SendHandler -> NDIS.sys @ 0xb7cf087b

user & kernel MBR OK

**************************************************************************

.

--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------

[HKEY_USERS\S-1-5-21-1659004503-1644491937-1801674531-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:4f,4c,97,2b,8d,d2,aa,a7,f1,e0,a0,4a,94,f6,c2,d2,6d,db,90,5c,71,5e,f0,

e0,0e,1a,58,45,7a,69,ce,d5,31,22,a7,cd,2c,b3,c9,78,e0,b6,cd,06,16,63,5b,fa,\

"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50

[HKEY_USERS\S-1-5-21-1659004503-1644491937-1801674531-1003\Software\SecuROM\License information*]

"datasecu"=hex:40,87,fe,12,31,0c,2a,0a,86,a8,fc,97,4b,74,60,c5,78,51,ff,e5,09,

e8,da,a5,ca,88,e7,e7,8f,42,b8,fd,de,8a,29,8f,2b,af,4c,c9,c4,b0,72,71,88,77,\

"rkeysecu"=hex:57,52,1d,79,5f,2e,e8,36,07,d5,58,f9,cd,9b,02,4c

.

------------------------ Outros Processos em Execução ------------------------

.

c:\windows\system32\nvsvc32.exe

c:\arquivos de programas\Arquivos comuns\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\arquivos de programas\Bonjour\mDNSResponder.exe

c:\arquivos de programas\Java\jre6\bin\jqs.exe

c:\arquivos de programas\Arquivos comuns\Microsoft Shared\VS7Debug\mdm.exe

c:\windows\system32\PnkBstrA.exe

c:\windows\system32\PnkBstrB.exe

c:\windows\system32\wdfmgr.exe

c:\arquivos de programas\RealVNC\VNC4\WinVNC4.exe

c:\arquiv~1\AVG\AVG8\avgrsx.exe

c:\arquiv~1\AVG\AVG8\avgnsx.exe

c:\arquivos de programas\AVG\AVG8\avgcsrvx.exe

c:\windows\RTHDCPL.EXE

c:\windows\system32\RUNDLL32.EXE

c:\arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe

c:\windows\system32\wscntfy.exe

c:\arquivos de programas\iPod\bin\iPodService.exe

c:\arquivos de programas\HP\Digital Imaging\bin\hpqSTE08.exe

c:\arquivos de programas\HP\Digital Imaging\bin\hpqbam08.exe

c:\arquivos de programas\HP\Digital Imaging\bin\hpqgpc01.exe

.

**************************************************************************

.

Tempo para conclusão: 2009-12-08 23:09:26 - Máquina reiniciou

ComboFix-quarantined-files.txt 2009-12-09 02:09

Pré-execução: 11 pasta(s) 19.219.292.160 bytes disponíveis

Pós execução: 14 pasta(s) 20.025.442.304 bytes disponíveis

WindowsXP-KB310994-SP2-Pro-BootDisk-PTG.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - BB71040510E48F5320EC259F10298110

wings · Dezembro 9, 2009

Bom dia josé pimpolho

Envie os arquivos abaixo, um por vez, para análise em http://virscan.org

c:\windows\system32\Nuncalev.exe
c:\windows\system32\Mdtc.exe

Cole os links contendo os resultados.

josé pimpolho · Dezembro 9, 2009

http://virscan.org/report/24be84d0a0abfefbc7a596a4d11ecd7d.html

o c:\windows\system32\Mdtc.exe eu procurei em system32 e não achei nenhum Mdtc.exe

wings · Dezembro 9, 2009

Boa noite jose pimpolho

1.

*Abra o bloco de notas, selecione, copie e cole nele todo o conteúdo do código abaixo:

File::
c:\windows\system32\fjhdyfhsn.bat

c:\windows\system32\Nuncalev.zip

c:\windows\system32\Nuncalev.exe

c:\documents and settings\NetworkService\Dados de aplicativos\fvgqad.dat

c:\documents and settings\adm\Dados de aplicativos\avdrn.dat

FileLook::

c:\windows\system32\Mdtc.exe

*Salve o arquivo no desktop como CFScript.txt

*Arraste o arquivo para o Combofix conforme ilustração abaixo:

*Importante: enquanto o combofix estiver em execução, não use o mouse nem o teclado!!..para interromper o processo tecle N ou 2.

*Cole o relatório criado em C:\combofix.txt e novo log do hijack

josé pimpolho · Dezembro 10, 2009

primeiro postarei o log do combofix para o post n ficar tão grande, em seguida, postarei o do hijack:

ComboFix 09-12-09.04 - adm 10/12/2009 2:52.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.55.1046.18.2047.1611 [GMT -3:00]

Executando de: c:\documents and settings\adm\Desktop\ComboFix.exe

Comandos utilizados :: c:\documents and settings\adm\Desktop\CFScript.txt

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::

"c:\documents and settings\adm\Dados de aplicativos\avdrn.dat"

"c:\documents and settings\NetworkService\Dados de aplicativos\fvgqad.dat"

"c:\windows\system32\fjhdyfhsn.bat"

"c:\windows\system32\Nuncalev.exe"

"c:\windows\system32\Nuncalev.zip"

.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\adm\Dados de aplicativos\avdrn.dat

c:\documents and settings\NetworkService\Dados de aplicativos\fvgqad.dat

c:\windows\system32\fjhdyfhsn.bat

c:\windows\system32\Nuncalev.exe

c:\windows\system32\Nuncalev.zip

.

(((((((((((((((( Arquivos/Ficheiros criados de 2009-11-10 to 2009-12-10 ))))))))))))))))))))))))))))

.

2009-12-10 05:33 . 2009-12-10 05:33 -------- d-----w- C:\Nostale(UK)

2009-12-09 02:12 . 2009-08-06 22:23 274288 ----a-w- c:\windows\system32\mucltui.dll

2009-12-09 02:12 . 2009-08-06 22:23 215920 ----a-w- c:\windows\system32\muweb.dll

2009-12-08 14:52 . 2009-12-08 14:53 -------- d-----w- C:\HiJack

2009-12-07 00:11 . 2009-12-07 00:12 -------- d-----w- c:\arquivos de programas\hijack

2009-12-04 21:19 . 2009-12-10 00:25 -------- d-----w- c:\documents and settings\adm\Dados de aplicativos\Bioshock

2009-12-04 21:04 . 2009-12-04 21:04 -------- d-----w- c:\arquivos de programas\2K Games

2009-11-26 14:54 . 2009-11-26 14:54 -------- d-----w- C:\BrowserPlusPlugins

2009-11-26 12:19 . 2009-11-10 11:19 2064152 ----a-w- c:\documents and settings\All Users\Dados de aplicativos\avg8\update\backup\avgcorex.dll

2009-11-20 00:58 . 2009-11-20 00:58 53760 ----a-w- c:\windows\system32\zlib.dll

2009-11-20 00:58 . 2009-11-20 00:58 45056 --sh--w- c:\windows\system32\Mdtc.exe

2009-11-20 00:58 . 2009-11-20 00:58 40960 ----a-w- c:\windows\system32\shdocwv.dll

2009-11-11 03:28 . 2009-11-11 03:28 247280 ----a-w- c:\documents and settings\adm\Dados de aplicativos\Mozilla\plugins\npgoogletalk.dll

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-12-10 05:49 . 2009-03-06 05:03 -------- d-----w- c:\arquivos de programas\Steam

2009-12-09 02:52 . 2009-10-27 15:22 -------- d-----w- c:\documents and settings\adm\Dados de aplicativos\HPAppData