[Resolvido] &nbspInfecção por 0xf04.pac

Charger76 · Dezembro 8, 2010

Sumiram as ultimas dicas que você postou...

wings · Dezembro 8, 2010

Façamos uma coisa:

Eu peço você faz. Nada de enviar post em sequência...OK?

Dessa forma eu fico perdido e não sei qual procedimento você fez.

Por favor...novo log do hijack.

Charger76 · Dezembro 8, 2010

Está aqui um novo log no hijack, queria pedir desculpas... Pois uma hora entrei aqui e havia escrito para eu fazer algo no hijack com o fixed e depois executar outro programa e isso sumiu do tópico, daí fiquei meio confuso.

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 16:10:29, on 08/12/2010

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16671)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe

C:\Program Files (x86)\TweetDeck\TweetDeck.exe

C:\Users\ALexandre\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Hijack\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.cearainfo.com/0xf04.pac

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=userinit.exe,

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL

O2 - BHO: Auxiliar de Conexão do Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKCU\..\Run: [Google Update] "C:\Users\ALexandre\AppData\Local\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [Anti Trojan Elite] C:\Program Files (x86)\Anti Trojan Elite\TJEnder.exe :NO

O8 - Extra context menu item: &Enviar para o OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_7f58c91b65c73836\AESTSr64.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe

O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: KMService - Unknown owner - C:\Windows\system32\srvany.exe

O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe

O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe

O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_7f58c91b65c73836\STacSV64.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 7816 bytes

wings · Dezembro 8, 2010

Não precisa se desculpar...

É preciso nos entendermos para resolver o seu problema...:)

Vamos lá..

1.

*Execute o hijack, clique em [Do a system scan only], selecione a entrada abaixo e clique em [Fix checked]

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://www.cearainfo.com/0xf04.pac

*Feche o hijack

2.

*Mantenha desativado o seu antivírus.

3.

*Baixe o Norman Malware Cleaner e salve-o no desktop

*Execute o Norman_Malware_Cleaner

*Instale o programa

*Clique em [Add] e selecione as partições do seu HD

*Clique em [start Scan]

*Ao finalizar, clique [Quit]

*Caso seja questionado se deseja reiniciar o computador (Do you want restart now?) clique em [Não]

*Cole o relatório NFix_a_m_d (onde a = ano, m = mês e d = dia) criado no desktop.

Charger76 · Dezembro 8, 2010

Segue o Log

Norman Malware Cleaner

Version 1.8.3

Norman Scanner Engine Version: 6.06.07

Nvcbin.def Version: 6.06.00, Date: 2010/12/07 19:59:54, Variants: 8304917

Scan started: 2010/12/08 16:30:43

Running pre-scan cleanup routine:

Operating System: Microsoft Windows 7 6.1.7600

Logged on user: ALexandre-NOTE\ALexandre

Set registry value: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLS = -> ""

Scanning kernel...

Kernel scan complete

Scanning running processes and process memory...

Number of processes/threads found: 1216

Number of processes/threads scanned: 1216

Number of processes/threads not scanned: 0

Number of infected processes/threads terminated: 0

Total scanning time: 46s

Scanning file system...

Scanning: prescan

Scanning: C:\*.*

C:\$Recycle.Bin\S-1-5-21-2976952795-4173151331-1128618455-1000\$RUY13I0.9\Patch.exe (Infected with Suspicious_Gen2.CCQRW)

Deleted file

C:\$Recycle.Bin\S-1-5-21-2976952795-4173151331-1128618455-1000\$RUY13I0.9\Patch.rar/Patch.exe (Infected with Suspicious_Gen2.CCQRW)

Deleted file

C:\$Recycle.Bin\S-1-5-21-2976952795-4173151331-1128618455-1000\$RW0D335.br-\Serial\updat.exe (Infected with W32/Suspicious_Gen2.EONWD)

Deleted file

C:\Downloads\4º Bimestre.rar/GRS INCINERA€ÇO A ATERRRO.ppt (Error whilst scanning file: I/O Error (0x00220005))

C:\Program Files (x86)\Anti Trojan Elite\Patch.exe (Infected with Suspicious_Gen2.CCQRW)

Deleted file

C:\Program Files (x86)\Anti Trojan Elite\updat.exe (Infected with W32/Suspicious_Gen2.EONWD)

Deleted file

C:\Program Files (x86)\TNod User & Password Finder 1.4.0\TNODUP.exe (Infected with W32/Suspicious_Gen2.BZBDD)

Deleted file

C:\System Volume Information\{0347E~1 (Error opening file: Access denied)

C:\System Volume Information\{38088~1 (Error opening file: Access denied)

C:\System Volume Information\{5D7A0~1 (Error opening file: Access denied)

C:\System Volume Information\{5D7A0~2 (Error opening file: Access denied)

C:\System Volume Information\{5D7A0~3 (Error opening file: Access denied)

C:\System Volume Information\{5D7A0~4 (Error opening file: Access denied)

C:\System Volume Information\{8664A~1 (Error opening file: Access denied)

C:\System Volume Information\{89E34~1 (Error opening file: Access denied)

C:\System Volume Information\{89E34~2 (Error opening file: Access denied)

C:\System Volume Information\{89E34~3 (Error opening file: Access denied)

C:\System Volume Information\{89E34~4 (Error opening file: Access denied)

C:\System Volume Information\{C961C~1 (Error opening file: Access denied)

C:\System Volume Information\{C961C~2 (Error opening file: Access denied)

C:\System Volume Information\{C961C~3 (Error opening file: Access denied)

C:\System Volume Information\{CC0FA~1 (Error opening file: Access denied)

C:\System Volume Information\{CC0FB~1 (Error opening file: Access denied)

C:\System Volume Information\{CC0FB~2 (Error opening file: Access denied)

C:\Users\ALexandre\ALe\UEM\4º Ano\Fenotran\3bim\INCROPERA - Fundamentos Transferencia de calor (4 Ed)\WinDjView-0.3.5.exe (Infected with W32/Suspicious_Gen2.PZZP)

Deleted file

C:\Users\ALexandre\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000282/Anti Trojan Elite 5.0.9\Patch.exe (Infected with Suspicious_Gen2.CCQRW)

Deleted file

C:\Users\ALexandre\AppData\Local\Google\Chrome\User Data\Default\Cache\f_000282/Anti Trojan Elite 5.0.9\Patch.rar/Patch.exe (Infected with Suspicious_Gen2.CCQRW)

Deleted file

C:\Users\ALexandre\AppData\Local\Google\Chrome\User Data\Default\Cache\f_0002d3/ISecSoft.Anti.Trojan.Elite.v5.1.2-www.brasildowns.com.br-\Serial\updat.exe (Infected with W32/Suspicious_Gen2.EONWD)

Deleted file

C:\Users\ALexandre\AppData\Local\Temp\Upd7BC.tmp (Infected with W32/Suspicious_Gen2.EONWD)

Deleted file

Scanning: D:\*.*

D:\Instaladores\CXtDVD_3.3.0.96_www.usinavirtual.com.rar/ConvertXtoDVD_3.3.0.96\Keygen\Keygen.exe (Infected with Smalldoor.JJEW)

Deleted file

Running post-scan cleanup routine:

Aborted by user

Number of files found: 374210

Number of archives unpacked: 4574

Number of files scanned: 374128

Number of files not scanned: 82

Number of files skipped due to exclude list: 0

Number of infected files found: 12

Number of infected files repaired/deleted: 12

Number of infections removed: 12

Total scanning time: 1h 43m 35s

wings · Dezembro 8, 2010

Novo log do hijack.

Charger76 · Dezembro 8, 2010

Aqui está amigo:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 19:18:43, on 08/12/2010

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16671)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe