[Resolvido!] Não estou conseguindo instalar um Anti-vírus

PabloRhuan · Maio 18, 2010

Boa noite!

Estou com uma maquina que de uns tempos pra ca vem min dando dor de cabeça, recentemente apareceu um malware esquisito. Ele abre uma janela com os dizeres "Apakah Anda Seorang Muslim?", dando duas opções, algo como sim ou não, suspeito que esse processo windowsmp.exe tenha algo com isso, e depois desse dia venho tendo problemas para instalar um anti-vírus ele simplismente impede a instalaçao .

OBS: Formatei a maquina esta semana e o virus continua no pc, formatei so a partiçao C: não a D: pode ser que a partiçao D: esteja contaminada?.

LOG.

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 20:03:50, on 18/5/2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

C:\Arquivos de programas\ThreatFire\TFTray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\IObit\Advanced SystemCare 3\AWC.exe

C:\Arquivos de programas\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe

C:\Arquivos de programas\PC Tools AntiVirus\PCTAVSvc.exe

C:\Arquivos de programas\ThreatFire\TFService.exe

C:\WINDOWS\System32\svchost.exe

D:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbam.exe

C:\Documents and Settings\HP\Meus documentos\Downloads\HiJackThis.exe

C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,,C:\WINDOWS\system32\init.exe,

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll

O4 - HKLM\..\Run: [siSRaid] C:\Arquivos de programas\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

O4 - HKLM\..\Run: [siSPower] Rundll32.exe SiSPower.dll,ModeAgent

O4 - HKLM\..\Run: [PCTAVApp] "C:\Arquivos de programas\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN

O4 - HKLM\..\Run: [windowsmp] C:\WINDOWS\windowsmp.exe

O4 - HKLM\..\Run: [ThreatFire] C:\Arquivos de programas\ThreatFire\TFTray.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Arquivos de programas\IObit\Advanced SystemCare 3\AWC.exe" /startup

O4 - HKCU\..\Run: [smartRAM] "C:\Arquivos de programas\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Arquivos de programas\Adobe\Reader 8.0\Reader\reader_sl.exe

O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Arquivos de programas\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - Unknown owner - C:\Arquivos de programas\PC Tools AntiVirus\PCTAVSvc.exe

O23 - Service: ThreatFire - PC Tools - C:\Arquivos de programas\ThreatFire\TFService.exe

--

End of file - 4075 bytes

wings · Maio 19, 2010

Boa noite...

1.

*Baixe o RegUnlocker e salve-o no desktop

*Execute o programa e na aba "A - Restricciones", selecione a opção:

1 - Elimina las restricciones del Sistema

*Clique em [Aplicar]

2.

*Baixe o USBFix e salve-o no desktop

*Espete o Pendrive no PC

*Duplo clique em UsbFix

*Tecle P > [ENTER]

*Tecle 1 > [ENTER] e aguarde o término

*Remova o Pendrive

*Cole o relatório criado em C:\UsbFix.txt

PabloRhuan · Maio 19, 2010

Boa noite...

1

Baixei o RegUnlocker executei e selecionei a primeira opçao (1 - Elimina las restricciones del Sistema)Creio que não tenha resolvido.

2

Baixei o USBFix espetei o pendrive Apertei P ... Depois 1 ...

LOG.

############################## | UsbFix V6.114 |

User : HP (Administradores) # HP-QASA39F02BWH

Update on 17/05/2010 by El Desaparecido , C_XX & Chimay8

Start at: 22:28:43 | 18/5/2010

Website : http://pagesperso-orange.fr/NosTools/index.html

Contact : FindyKill.Contact@gmail.com

Intel® Celeron® CPU 2.80GHz

Microsoft Windows XP Professional (5.1.2600 32-bit) # Service Pack 2

Internet Explorer 6.0.2900.2180

Windows Firewall Status : Disabled

AV : PC Tools AntiVirus 6.1.0.25 6.1.0.25 [ (!) Disabled | Updated ]

A:\ -> Unidade de disquete de 3 1/2 polegadas

C:\ -> Disco fixo local # 11,72 Go (8,29 Go free) # NTFS

D:\ -> Disco fixo local # 25,54 Go (19,77 Go free) # NTFS

E:\ -> Disco CD-ROM

F:\ -> Disco removível # 954,05 Mo (474,86 Mo free) [PAULO] # FAT

################## | Ficheiros # pastas infeciosos |

C:\WINDOWS\windowsmp.exe

C:\WINDOWS\System32\init.exe

C:\autorun.inf

C:\explorer.exe

D:\autorun.inf

D:\explorer.exe

F:\autorun.inf -> ficheiro chamado : "F:\dfdvo.cmd" ( Presente ! )

F:\autorun.inf

F:\explorer.exe

F:\vffg.pif

F:\ykqiv.pif

F:\mekjue.pif

F:\Recycler\S-1-5-21-1482476501-1644491937-682003330-1013\sys32.exe

F:\Recycler\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini

F:\Recycler\S-1-5-21-1482476501-1644491937-682003330-1013

F:\Recycler\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx

F:\Recycler\S-5-3-42-2819952290-8240758988-879315005-3665

################## | Registro |

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run] "windowsmp"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\policies\System] "DisableRegistryTools"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\policies\System] "DisableTaskMgr"

[HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\policies\System] "DisableRegistryTools"

[HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\policies\System] "DisableTaskMgr"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"

[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoResolveSearch"

################## | Mountpoints2 |

HKCU\..\..\Explorer\MountPoints2\{58f39be9-62c5-11df-8337-000feaa536ed}

sheLl\AUtoPlAY\COmMand =F:\dfdvo.cmd

sheLl\AutoRun\command =F:\dfdvo.cmd

sheLl\eXploRE\cOmmanD =F:\dfdvo.cmd

sheLl\opEn\cOMmand =F:\dfdvo.cmd

HKCU\..\..\Explorer\MountPoints2\{f551cf40-61f7-11df-832d-000feaa536ed}

sHElL\aUTOPlay\Command =F:\ppqeqr.exe

sHElL\AutoRun\command =F:\ppqeqr.exe

sHElL\eXpLore\ComManD =F:\ppqeqr.exe

sHElL\OpeN\ComMand =F:\ppqeqr.exe

################## | Vaccin |

################## | ! Fim do relatório # UsbFix V6.114 ! |

wings · Maio 19, 2010

1.

*Delete o RegUnlocker

2.

*Espete novamente o Pendrive no PC

*Duplo clique em UsbFix

*Tecle P > [ENTER]

*Tecle 2 > [ENTER] e aguarde o término

*Remova o Pendrive

*Cole o relatório criado em C:\UsbFix.txt

PabloRhuan · Maio 19, 2010

Intão..

Fiz oque você pedio.

"1.

*Delete o RegUnlocker

2.

*Espete novamente o Pendrive no PC

*Duplo clique em UsbFix

*Tecle P > [ENTER]

*Tecle 2 > [ENTER] e aguarde o término"

Depois o Pc Reiniciou e iniciou normalmente não apareceu nenhum relatorio do UsobFix.

Aqui vai um Relatorio com o hijackthis

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 00:01:14, on 19/5/2010

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\PC Tools AntiVirus\PCTAVSvc.exe

C:\Arquivos de programas\ThreatFire\TFService.exe

C:\Arquivos de programas\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

C:\Arquivos de programas\ThreatFire\TFTray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\IObit\Advanced SystemCare 3\AWC.exe

C:\Arquivos de programas\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

D:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Documents and Settings\HP\Meus documentos\Downloads\HiJackThis.exe

C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Arquivos de programas\Spybot - Search & Destroy\SDHelper.dll

O4 - HKLM\..\Run: [siSRaid] C:\Arquivos de programas\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe

O4 - HKLM\..\Run: [siSPower] Rundll32.exe SiSPower.dll,ModeAgent

O4 - HKLM\..\Run: [PCTAVApp] "C:\Arquivos de programas\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN

O4 - HKLM\..\Run: [windowsmp] C:\WINDOWS\windowsmp.exe

O4 - HKLM\..\Run: [ThreatFire] C:\Arquivos de programas\ThreatFire\TFTray.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Arquivos de programas\IObit\Advanced SystemCare 3\AWC.exe" /startup

O4 - HKCU\..\Run: [smartRAM] "C:\Arquivos de programas\IObit\Advanced SystemCare 3\Sup_SmartRAM.exe" /m

O4 - HKCU\..\Run: [Gadwin PrintScreen] C:\Arquivos de programas\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash