Ir para conteúdo

POWERED BY:

Arquivado

Este tópico foi arquivado e está fechado para novas respostas.

carola

[Resolvido!] Hotmail com vírus

Por , em Tópicos Resolvidos (Seguranca & Malwares)

Recommended Posts

carola    0

carola
Postado

Bom dia,

 

meu hotmail envia e-mails sozinho. Tentei mudar a senha do Windows Live, estou usando o Kasper, passei o Combofix, o MalwareBytes anti-malware e o Bankerfix. Também formatei o PC, sem sucesso. Tentei passar o NOD32 online, mas depois que clico que concordo com o EULA, a janela seguinte aparece apenas com uma figura "quebrada", uma figura que não pode ser lida.

Envio abaixo os logs do hijack this, do combofix e do malware e peço por favor, ajuuuuuuuuda, porque não quero ter que fazer outro e-mail.

Hijack

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:06:46, on 27/07/2010

Platform: Unknown Windows (WinNT 6.01.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16385)

Boot mode: Normal

 

Running processes:

C:\Windows\system32\taskhost.exe

C:\Users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\Dwm.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe

C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe

C:\Program Files\Palm\Hotsync.exe

C:\Program Files\LimeWire\LimeWire.exe

C:\Windows\Explorer.exe

C:\Windows\system32\notepad.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe

C:\Users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Users\Lôla\Desktop\HiJackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\Program Files\GbPlugin\gbieh.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [btTray] "C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe"

O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\ComboFix\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\ComboFix\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKCU\..\Run: [Google Update] "C:\Users\Lôla\AppData\Local\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe

O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe

O4 - Global Startup: Hotsync Manager.lnk = C:\Program Files\Palm\Hotsync.exe

O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000

O8 - Extra context menu item: Send by Bluetooth - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm

O8 - Extra context menu item: Send via &Message... - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm

O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll

O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll

O15 - Trusted Zone: http://www.bancobrasil.com.br

O15 - Trusted Zone: www14.bancobrasil.com.br

O15 - Trusted Zone: www2.bancobrasil.com.br

O15 - Trusted Zone: www.bb.com.br

O15 - Trusted Zone: http://www.bb.com.br

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Windows\system32\skype4com.dll

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll

O20 - Winlogon Notify: GbPluginBb - C:\Program Files\GbPlugin\gbieh.dll

O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe

O23 - Service: BlueSoleilCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe

O23 - Service: BsHelpCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe

O23 - Service: BsMobileCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe

O23 - Service: Gbp Service (GbpSv) - - C:\PROGRA~1\GbPlugin\GbpSv.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

 

--

End of file - 6969 bytes

 

Combofix

ComboFix 10-07-26.04 - Lôla 27/07/2010 12:28:45.2.2 - x86 MINIMAL

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.55.1046.18.2038.1404 [GMT -3:00]

Executando de: c:\users\Lôla\Desktop\ComboFix.exe

.

 

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\setup.exe

 

.

((((((((((((((((((((((((((((((((((((((( Drivers/Serviços )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Service_osppsvc

 

 

(((((((((((((((( Arquivos/Ficheiros criados de 2010-06-27 to 2010-07-27 ))))))))))))))))))))))))))))

.

 

2010-07-27 15:39 . 2010-07-27 15:39 -------- d-----w- C:\Device

2010-07-27 15:37 . 2010-07-27 15:37 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-07-27 15:27 . 2010-07-27 15:27 -------- d-----w- C:\32788R22FWJFW

2010-07-27 14:51 . 2010-07-27 14:57 -------- d-----w- C:\LinhaDefensiva

2010-07-23 23:31 . 2010-07-23 23:31 -------- d-----w- c:\program files\DIFX

2010-07-23 23:31 . 2010-07-23 23:31 104960 ----a-w- c:\windows\system32\drivers\ZTEusbser6k.sys

2010-07-23 23:31 . 2010-07-23 23:31 104960 ----a-w- c:\windows\system32\drivers\ZTEusbnmea.sys

2010-07-23 23:31 . 2010-07-23 23:31 104960 ----a-w- c:\windows\system32\drivers\ZTEusbmdm6k.sys

2010-07-23 23:31 . 2010-07-23 23:31 -------- d-----w- c:\program files\Oi

2010-07-23 23:28 . 2009-02-17 23:38 112128 ----a-w- c:\windows\system32\drivers\ewusbnet.sys

2010-07-23 23:28 . 2008-12-30 14:57 103040 ----a-w- c:\windows\system32\drivers\ewusbfake.sys

2010-07-23 23:28 . 2008-12-13 14:27 102784 ----a-w- c:\windows\system32\drivers\ewusbmdm.sys

2010-07-23 23:28 . 2008-04-14 12:36 621056 ----a-w- c:\windows\system32\drivers\mod7700.sys

2010-07-23 23:28 . 2007-08-09 07:06 23424 ----a-w- c:\windows\system32\drivers\ewdcsc.sys

2010-07-23 23:27 . 2010-07-23 23:28 -------- d-----w- c:\program files\VIVO INTERNET

2010-07-21 01:56 . 2009-05-28 14:01 702728 ----a-w- C:\Resetter.exe

2010-06-30 01:25 . 2010-06-30 01:25 -------- d-----w- c:\program files\Microsoft

2010-06-30 01:25 . 2010-06-30 01:25 -------- d-----w- c:\program files\Windows Live SkyDrive

2010-06-30 01:24 . 2010-06-30 01:26 -------- d-----w- c:\program files\Windows Live

2010-06-30 01:14 . 2010-06-30 01:14 -------- d-----w- c:\program files\Common Files\Windows Live

 

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-27 15:43 . 2010-06-17 19:06 -------- d-----w- c:\programdata\Kaspersky Lab

2010-07-26 21:47 . 2009-07-17 18:48 654470 ----a-w- c:\windows\system32\prfh0416.dat

2010-07-26 21:47 . 2009-07-17 18:48 124922 ----a-w- c:\windows\system32\prfc0416.dat

2010-07-21 03:02 . 2010-06-17 19:02 -------- d-----w- c:\program files\Documents To Go

2010-06-23 21:52 . 2010-06-23 21:51 -------- d-----w- c:\program files\LimeWire

2010-06-23 19:37 . 2010-06-18 22:29 -------- d-----w- c:\programdata\Microsoft Help

2010-06-23 19:27 . 2010-06-23 19:27 -------- d-----w- c:\program files\Microsoft.NET

2010-06-23 19:18 . 2010-06-23 19:18 -------- d-----w- c:\program files\Microsoft Analysis Services

2010-06-18 22:53 . 2010-06-17 18:33 -------- d-----w- c:\program files\Palm

2010-06-18 18:02 . 2010-06-18 18:02 -------- d-----w- c:\program files\IVT Corporation

2010-06-18 16:09 . 2010-06-18 16:09 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf

2010-06-18 14:01 . 2010-06-18 14:01 -------- d-----w- c:\program files\Common Files\Java

2010-06-18 14:00 . 2010-06-18 14:00 411368 ----a-w- c:\windows\system32\deployJava1.dll

2010-06-18 14:00 . 2010-06-18 14:00 -------- d-----w- c:\program files\Java

2010-06-18 13:51 . 2010-06-18 13:51 932368 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\profiles-1-6.dll

2010-06-18 13:51 . 2010-06-18 13:51 678416 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\content_interpreter-1-1.dll

2010-06-18 13:51 . 2010-06-18 13:51 604688 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\gsg-3-9.dll

2010-06-18 13:51 . 2010-06-18 13:51 522768 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\database-1-5.dll

2010-06-18 13:51 . 2010-06-18 13:51 1096208 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\filtration-4-6.dll

2010-06-18 13:51 . 2010-06-18 13:51 80400 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.736\fssync.dll

2010-06-18 13:51 . 2010-06-18 13:51 133648 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.736\mmpprtc.dll

2010-06-18 13:51 . 2010-06-17 19:07 97549 ----a-w- c:\windows\system32\drivers\klick.dat

2010-06-18 13:51 . 2010-06-17 19:07 113933 ----a-w- c:\windows\system32\drivers\klin.dat

2010-06-18 13:51 . 2010-06-18 13:51 133720 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.736\mmpprtc.dll

2010-06-18 13:51 . 2010-06-18 13:51 80400 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.736\fssync.dll

2010-06-17 21:26 . 2010-06-17 18:12 -------- d-----w- c:\programdata\GbPlugin

2010-06-17 21:22 . 2010-06-17 21:22 -------- d-----w- c:\program files\Google

2010-06-17 19:22 . 2010-06-17 19:02 -------- d-----w- c:\program files\Common Files\DataViz

2010-06-17 19:06 . 2010-06-17 19:06 -------- d-----w- c:\program files\Kaspersky Lab

2010-06-17 19:04 . 2010-06-17 19:04 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files

2010-06-17 19:02 . 2010-06-17 19:02 -------- d-----w- c:\programdata\DataViz

2010-06-17 18:33 . 2010-06-17 18:33 -------- d-----w- c:\programdata\HotSync

2010-06-17 18:31 . 2010-06-17 18:31 -------- d-----w- c:\program files\GIMP-2.0

2010-06-17 18:31 . 2010-06-17 18:31 -------- d-----w- c:\program files\Common Files\InstallShield

2010-06-17 18:17 . 2010-06-17 18:17 -------- d-----w- c:\program files\Common Files\Adobe

2010-06-17 18:12 . 2010-06-17 18:12 -------- d-----w- c:\program files\GbPlugin

2010-06-17 17:46 . 2010-06-17 17:46 -------- d-sh--we c:\programdata\Modelos

2010-06-17 17:46 . 2010-06-17 17:46 -------- d-sh--we c:\programdata\Menu Iniciar

2010-06-17 17:46 . 2010-06-17 17:46 -------- d-sh--we c:\programdata\Favoritos

2010-06-17 17:46 . 2010-06-17 17:46 -------- d-sh--we c:\programdata\Documentos

2010-06-17 17:46 . 2010-06-17 17:46 -------- d-sh--we c:\programdata\Dados de aplicativos

2010-06-17 17:46 . 2010-06-17 17:46 -------- d-sh--we c:\program files\Common Files\Sistema

2010-06-17 17:46 . 2010-06-17 17:46 -------- d-sh--we c:\program files\Arquivos Comuns

2010-05-28 12:01 . 2010-06-17 18:12 1676520 ----a-w- c:\programdata\Temp\gbplugin_ie_bb_setup.exe

2010-05-26 13:48 . 2010-06-17 18:12 45472 ----a-w- c:\windows\system32\drivers\gbpkm.sys

2010-05-21 17:14 . 2010-06-17 18:09 221568 ------w- c:\windows\system32\MpSigStub.exe

2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat

2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

.

 

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

.

.

*Nota* entradas vazias e legítimas por defeito não são mostradas.

REGEDIT4

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]

2010-02-28 05:20 561552 ----a-w- c:\progra~1\MICROS~2\Office14\URLREDIR.DLL

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Google Update"="c:\users\Lôla\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-06-17 136176]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-17 3872080]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

"BtTray"="c:\program files\IVT Corporation\BlueSoleil\BtTray.exe" [2008-06-05 231424]

"avp"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-10-20 340456]

 

c:\users\L“la\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2010-6-22 503808]

 

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

DataViz Inc Messenger.lnk - c:\program files\Common Files\DataViz\DvzIncMsgr.exe [2010-6-17 28672]

Hotsync Manager.lnk - c:\program files\Palm\Hotsync.exe [2008-1-3 1392640]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginBb]

2010-05-26 13:47 335136 ----a-w- c:\program files\GbPlugin\gbieh.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

 

S0 BtHidBus;Bluetooth HID Bus Service;c:\windows\System32\Drivers\BtHidBus.sys [2008-01-21 21512]

S0 GbpKm;Gbp KernelMode;c:\windows\system32\drivers\gbpkm.sys [2010-05-26 45472]

S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-14 36880]

S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2009-11-03 21520]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

S2 BsMobileCS;BsMobileCS;c:\program files\IVT Corporation\BlueSoleil\BsMobileCS.exe [2008-06-04 143467]

S2 GbpSv;Gbp Service;c:\progra~1\GbPlugin\GbpSv.exe [2010-05-26 55072]

S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\Drivers\IvtBtBus.sys [2008-01-21 26248]

S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-10-02 19472]

S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x86.sys [2009-07-13 50688]

 

.

Conteúdo da pasta 'Tarefas Agendadas'

.

.

------- Scan Suplementar -------

.

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xportar para o Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000

IE: Send by Bluetooth - c:\program files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm

IE: Send via &Message... - c:\program files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm

Trusted Zone: bancobrasil.com.br\www

Trusted Zone: bancobrasil.com.br\www14

Trusted Zone: bancobrasil.com.br\www2

Trusted Zone: bb.com.br\www

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL

.

- - - - ORFÃOS REMOVIDOS - - - -

 

HKLM-Run-HotSync - c:\program files\PalmSource\Desktop\HotSync.exe

 

 

.

--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

 

- - - - - - - > 'Explorer.exe'(2712)

c:\windows\system32\BsMobileSDK.dll

c:\windows\system32\BsLangInDepRes.dll

c:\windows\system32\Bs2Res.dll

c:\program files\GbPlugin\gbieh.dll

.

------------------------ Outros Processos em Execução ------------------------

.

c:\windows\system32\taskhost.exe

c:\program files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe

c:\program files\IVT Corporation\BlueSoleil\BsHelpCS.exe

c:\windows\system32\sppsvc.exe

c:\windows\system32\WUDFHost.exe

c:\users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

c:\windows\system32\conhost.exe

c:\users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

c:\users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

c:\users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

c:\users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\program files\Windows Live\Contacts\wlcomm.exe

.

**************************************************************************

.

Tempo para conclusão: 2010-07-27 12:58:06 - Máquina reiniciou

ComboFix-quarantined-files.txt 2010-07-27 15:58

 

Pré-execução: 110.365.855.744 bytes disponíveis

Pós execução: 110.192.623.616 bytes disponíveis

 

- - End Of File - - D790E9651DAE4A725D421F5EB2FF9E13

Malwarebytes

 

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

 

Versão da Base de Dados: 4360

 

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

 

27/07/2010 23:01:43

mbam-log-2010-07-27 (23-01-43).txt

 

Tipo de Verificação: Verificação Completa (C:\|D:\|F:\|)

Objetos escaneados: 216692

Tempo decorrido: 1 hora(s), 4 minuto(s), 6 segundo(s)

 

Processos de Memória Infectados: 0

Módulos de Memória Infectados: 0

Chaves de Registro Infectadas: 0

Valores de Registro Infectados: 0

Itens de Dados no Registro Infectados: 0

Pastas Infectadas: 0

Arquivos Infectados: 1

 

Processos de Memória Infectados:

(Não foram detectados ítens maliciosos)

 

Módulos de Memória Infectados:

(Não foram detectados ítens maliciosos)

 

Chaves de Registro Infectadas:

(Não foram detectados ítens maliciosos)

 

Valores de Registro Infectados:

(Não foram detectados ítens maliciosos)

 

Itens de Dados no Registro Infectados:

(Não foram detectados ítens maliciosos)

 

Pastas Infectadas:

(Não foram detectados ítens maliciosos)

 

Arquivos Infectados:

C:\Resetter.exe (Trojan.Agent.CK) -> No action taken.

 

Obrigadaaaaaaaaaa

 

Muitíssimo obrigada à pessoa de bom coração que se dispuser a ajudar.

Compartilhar este post

Link para o post
Compartilhar em outros sites

Power Max    54

Power Max
Postado

:) Oi Carola!

 

Arquivos Infectados:

C:\Resetter.exe (Trojan.Agent.CK) -> No action taken.

:seta: No seu log do Malwarebytes está constando que ele detectou um trojan, mas que ele ainda não foi removido (veja que aparece a frase no action taken, isto é: nenhuma ação foi tomada.

 

Faça uma nova verificação completa com o Malwarebytes e remova todos os problemas que ele encontrar, você encontra um tutorial sobre ele neste site abaixo:

 

'>http://dicasetutoriaisparapc.blogspot.com/2009/10/tutorial-do-malwarebytes-anti-malware.html"]Tutorial do Malwarebytes Anti-Malware

_______________________________

 

:seta: Abra o HijackThis, clique em Do a system scan only, marque a entrada abaixo e clique em Fix checked:

 

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

______________________________

 

:seta: Siga também estas dicas:

 

'>http://dicasetutoriaisparapc.blogspot.com/2009/11/tutorial-do-norman-malware-cleaner.html"]Tutorial do Norman Malware Cleaner

 

Tutorial do Spyware Doctor Starter Edition

 

Tutorial do Dr. Web CureIt

______________________________

 

:seta: Na sua próxima resposta poste o log do Dr. Web CureIt juntamente com um novo log do Hijackthis, o novo log do Malwarebytes, o log do Spyware Doctor, o log do Norman Malware Cleaner e nos diga como está o seu Pc depois disto.

 

Ficamos no aguardo.

Compartilhar este post

Link para o post
Compartilhar em outros sites

carola    0

carola
Postado

Bom dia,

 

fiz tudo o que foi orientado e funcionou, muito obrigada!!!

Demorei para postar porque estou tentando passar os programas pra conseguir os logs, mas o meu netbook trava no meio das execuções, acho que por falta de memória mesmo. Desde a semana da dica tenho tentado e não consigo, portanto vou apenas mandar o log do Hijack, que deu pra passar.

Novamente, agradeço a boa vontade, obrigada de verdade!!!

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 15:33:55, on 31/07/2010

Platform: Unknown Windows (WinNT 6.01.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16385)

Boot mode: Normal

 

Running processes:

C:\Windows\System32\smss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\PROGRA~1\GbPlugin\GbpSv.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\svchost.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe

C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe

C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe

C:\Windows\system32\svchost.exe

C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\System32\svchost.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe

C:\Users\Lôla\AppData\Local\Google\Update\GoogleUpdate.exe

C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

C:\Users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Users\Lôla\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Users\Lôla\Desktop\HiJackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\Program Files\GbPlugin\gbieh.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [btTray] "C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe"

O4 - HKLM\..\Run: [avp] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"

O4 - HKCU\..\Run: [Google Update] "C:\Users\Lôla\AppData\Local\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe

O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe

O4 - Global Startup: Hotsync Manager.lnk = C:\Program Files\Palm\Hotsync.exe

O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000

O8 - Extra context menu item: Send by Bluetooth - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tsinfo.htm

O8 - Extra context menu item: Send via &Message... - C:\Program Files\IVT Corporation\BlueSoleil\TransSend\IE\tssms.htm

O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll

O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll

O15 - Trusted Zone: http://www.bancobrasil.com.br

O15 - Trusted Zone: www14.bancobrasil.com.br

O15 - Trusted Zone: www2.bancobrasil.com.br

O15 - Trusted Zone: www.bb.com.br

O15 - Trusted Zone: http://www.bb.com.br

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Windows\system32\skype4com.dll

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll

O20 - Winlogon Notify: GbPluginBb - C:\Program Files\GbPlugin\gbieh.dll

O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe

O23 - Service: BlueSoleilCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exe

O23 - Service: BsHelpCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exe

O23 - Service: BsMobileCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsMobileCS.exe

O23 - Service: Gbp Service (GbpSv) - - C:\PROGRA~1\GbPlugin\GbpSv.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\ComboFix\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\ComboFix\Spyware Doctor\pctsSvc.exe

 

--

End of file - 7680 bytes

Compartilhar este post

Link para o post
Compartilhar em outros sites

wings    22

wings
Postado

Antonio Vieira está ocupado com monografia na faculdade e solicitou-me via MP para dar continuidade aos seus casos.

 

O log está limpo....

 

*Clique em [iniciar] > [Executar] > digite: Combofix /uninstall

*Clique [OK]

 

92674490.jpg

 

*Clique em [Executar]

*Aguarde surgir a mensagem: "ComboFix está desinstalado"

*Clique [OK]

 

Um abraço.

Compartilhar este post

Link para o post
Compartilhar em outros sites

wings    22

wings
Postado

PROBLEMA RESOLVIDO!

 

Caso o autor necessite que o tópico seja reaberto basta enviar uma Mensagem Privada para um Moderador com um link para o tópico.

Compartilhar este post

Link para o post
Compartilhar em outros sites
Ir para a lista de tópicos Tópicos Resolvidos (Seguranca & Malwares)
×

Informação importante

Ao usar o fórum, você concorda com nossos Termos e condições.

  Aceito