[Arquivado] &nbspAnalisem meu log veja se estou livre de keylogger ok?

maceno · Abril 19, 2011

ola pessoal bom dia, analisem meu log vejam se tenho keylogger escondido no meu pc.

log HIJACK

--------------------------

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 06:58:03, on 19/4/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Tablet\Pen\Pen_TouchService.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Tablet\Pen\Pen_TouchUser.exe

C:\WINDOWS\Explorer.EXE

D:\Programas\IObit Security 360\IS360tray.exe

C:\Arquivos de programas\PC Tools Security\BDT\FGuard.exe

D:\Programas\OFFICE XP\Office12\GrooveMonitor.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe

C:\Arquivos de programas\Bamboo Dock\BambooCore.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEEB.EXE

C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

C:\Arquivos de programas\PC Tools Security\BDT\BDTUpdateService.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avshadow.exe

D:\Programas\IObit Security 360\IS360srv.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\Arquivos de programas\Arquivos comuns\Protexis\License Service\PsiService_2.exe

C:\Arquivos de programas\CyberLink\Shared files\RichVideo.exe

C:\Arquivos de programas\Tablet\Pen\Pen_Tablet.exe

C:\Arquivos de programas\CyberLink\TV Enhance\Kernel\TV\TVECapSvc.exe

C:\Arquivos de programas\Tablet\Pen\Pen_TabletUser.exe

C:\Arquivos de programas\Tablet\Pen\Pen_Tablet.exe

C:\Arquivos de programas\CyberLink\TV Enhance\Kernel\TV\TVESched.exe

C:\WINDOWS\System32\alg.exe

C:\Documents and Settings\User\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

C:\Arquivos de programas\Evernote\Evernote\EvernoteTray.exe

D:\Programas\IObit Security 360\is360.exe

C:\WINDOWS\system32\WISPTIS.EXE

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Documents and Settings\User\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

C:\hijack\HiJackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R3 - URLSearchHook: BittorrentBar_PT Toolbar - {29acf17c-1713-4286-8f40-bfd05f1e70c8} - C:\Arquivos de programas\BittorrentBar_PT\tbBitt.dll

R3 - URLSearchHook: PC Tools Browser Guard - {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Arquivos de programas\PC Tools Security\BDT\PCTBrowserDefender.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: BittorrentBar_PT Toolbar - {29acf17c-1713-4286-8f40-bfd05f1e70c8} - C:\Arquivos de programas\BittorrentBar_PT\tbBitt.dll

O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Arquivos de programas\PC Tools Security\BDT\PCTBrowserDefender.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Programas\OFFICE XP\Office12\GrooveShellExtensions.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: BittorrentBar_PT Toolbar - {29acf17c-1713-4286-8f40-bfd05f1e70c8} - C:\Arquivos de programas\BittorrentBar_PT\tbBitt.dll

O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Arquivos de programas\PC Tools Security\BDT\PCTBrowserDefender.dll

O4 - HKLM\..\Run: [iObit Security 360] "D:\Programas\IObit Security 360\IS360tray.exe" /autostart

O4 - HKLM\..\Run: [PCTools FGuard] C:\Arquivos de programas\PC Tools Security\BDT\FGuard.exe

O4 - HKLM\..\Run: [GrooveMonitor] "D:\Programas\OFFICE XP\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [avgnt] "C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [bambooCore] C:\Arquivos de programas\Bamboo Dock\BambooCore.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [DIMDownloading your update...1270498514694] "C:\Arquivos de programas\Corel\CorelDRAW Graphics Suite X5\Programs\DIM.exe" "c:\documents and settings\all users\dados de aplicativos\corel\downloads\540215253_610005\1270498514694\dim_params.xml" -Launch=3 -uibase="c:\documents and settings\user\dados de aplicativos\corel\messages\540215253_610005\br\messagecache2\workflow"

O4 - HKCU\..\Run: [DIMBaixando a sua atualização...1285781003180] "C:\Arquivos de programas\Corel\CorelDRAW Graphics Suite X5\Programs\DIM.exe" "c:\documents and settings\all users\dados de aplicativos\corel\downloads\540215253_610005\1285781003180\dim_params.xml" -Launch=3 -uibase="c:\documents and settings\user\dados de aplicativos\corel\messages\540215253_610005\br\messagecache2\workflow"

O4 - HKCU\..\Run: [\\ATHLON\EPSON Stylus Office T33 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEEB.EXE /FU "C:\DOCUME~1\User\CONFIG~1\Temp\E_S3E.tmp" /EF "HKCU"

O4 - HKCU\..\Run: [bamboo Dock] "C:\Arquivos de programas\Bamboo Dock\Bamboo Dock\Bamboo Dock.exe"

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\ARQUIV~1\ARQUIV~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - S-1-5-18 Startup: Dropbox.lnk = C:\Documents and Settings\User\Dados de aplicativos\Dropbox\bin\Dropbox.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: Dropbox.lnk = C:\Documents and Settings\User\Dados de aplicativos\Dropbox\bin\Dropbox.exe (User 'Default user')

O4 - Startup: Dropbox.lnk = C:\Documents and Settings\User\Dados de aplicativos\Dropbox\bin\Dropbox.exe

O8 - Extra context menu item: Add to Evernote 4.0 - res://C:\Arquivos de programas\Evernote\Evernote\EvernoteIE.dll/204

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://D:\PROGRA~1\OFFICE~1\Office12\EXCEL.EXE/3000

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\OFFICE~1\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\OFFICE~1\Office12\ONBttnIE.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\OFFICE~1\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Programas\OFFICE XP\Office12\GrooveSystemServices.dll

O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Avira AntiVir Agendamento (AntiVirSchedulerService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Browser Defender Update Service - Unknown owner - C:\Arquivos de programas\PC Tools Security\BDT\BDTUpdateService.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Arquivos de programas\Arquivos comuns\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: IS360service - IObit - D:\Programas\IObit Security 360\IS360srv.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Arquivos de programas\Arquivos comuns\Protexis\License Service\PsiService_2.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared files\RichVideo.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Arquivos de programas\PC Tools Security\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Arquivos de programas\PC Tools Security\pctsSvc.exe

O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Arquivos de programas\Tablet\Pen\Pen_Tablet.exe

O23 - Service: Wacom Consumer Touch Service (TouchServicePen) - Wacom Technology, Corp. - C:\Arquivos de programas\Tablet\Pen\Pen_TouchService.exe

O23 - Service: TVEnhance Background Capture Service (TBCS) (TVECapSvc) - Unknown owner - C:\Arquivos de programas\CyberLink\TV Enhance\Kernel\TV\TVECapSvc.exe

O23 - Service: TVEnhance Task Scheduler (TTS)) (TVESched) - Unknown owner - C:\Arquivos de programas\CyberLink\TV Enhance\Kernel\TV\TVESched.exe

--

End of file - 11730 bytes

obrigado.

Power Max · Abril 19, 2011

:) Olá Maceno!

:seta: Há programas desnecessários iniciando junto com o Windows, o que torna o seu PC mais lento. Para corrigir isto, siga as dicas deste tutorial:

Escolhendo Programas que Iniciam com o PC

De preferência deixe apenas os programas de segurança (anti-vírus/anti-spywares/firewall) iniciarem junto com o Windows.

Use também o programa Ccleaner, indicado neste tutorial acima, para fazer uma limpeza e otimização do PC agora e de tempos em tempos.

_______________________

:seta: Siga, por gentileza, as dicas deste tutorial para fazer uma limpeza de seu PC com o Malwarebytes:

Tutorial do Malwarebytes Anti-Malware

Na sua próxima resposta poste este log do Malwarebytes juntamente com um novo log do Hijackthis e nos diga como está o seu PC após este procedimento.

Ficamos no aguardo.

maceno · Abril 20, 2011

oi antonio, abaixo os logs:

malware log

---------------------

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Versão da Base de Dados: 6401

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

19/4/2011 22:57:32

mbam-log-2011-04-19 (22-57-32).txt

Tipo de Verificação: Verificação Completa (C:\|)

Objetos escaneados: 213128

Tempo decorrido: 24 minuto(s), 21 segundo(s)

Processos de Memória Infectados: 0

Módulos de Memória Infectados: 0

Chaves de Registro Infectadas: 0

Valores de Registro Infectados: 0

Itens de Dados no Registro Infectados: 0

Pastas Infectadas: 0

Arquivos Infectados: 0

Processos de Memória Infectados:

(Não foram detectados ítens maliciosos)

Módulos de Memória Infectados:

(Não foram detectados ítens maliciosos)

Chaves de Registro Infectadas:

(Não foram detectados ítens maliciosos)

Valores de Registro Infectados:

(Não foram detectados ítens maliciosos)

Itens de Dados no Registro Infectados:

(Não foram detectados ítens maliciosos)

Pastas Infectadas:

(Não foram detectados ítens maliciosos)

Arquivos Infectados:

(Não foram detectados ítens maliciosos)

HIJACK LOG

----------------------------------------

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 23:23:10, on 19/4/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Arquivos de programas\Tablet\Pen\Pen_TouchService.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\sched.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Tablet\Pen\Pen_TouchUser.exe

C:\WINDOWS\Explorer.EXE

D:\Programas\IObit Security 360\IS360tray.exe

C:\Arquivos de programas\PC Tools Security\BDT\FGuard.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avguard.exe

D:\Programas\OFFICE XP\Office12\GrooveMonitor.exe

C:\Arquivos de programas\Avira\AntiVir Desktop\avgnt.exe

C:\Arquivos de programas\PC Tools Security\BDT\BDTUpdateService.exe

C:\Arquivos de programas\Bamboo Dock\BambooCore.exe

D:\Programas\IObit Security 360\IS360srv.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Messenger\msmsgs.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEEB.EXE

C:\Arquivos de programas\Avira\AntiVir Desktop\avshadow.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\Arquivos de programas\Arquivos comuns\Protexis\License Service\PsiService_2.exe

C:\Arquivos de programas\CyberLink\Shared files\RichVideo.exe

C:\Arquivos de programas\Tablet\Pen\Pen_Tablet.exe

C:\Arquivos de programas\CyberLink\TV Enhance\Kernel\TV\TVECapSvc.exe

C:\Arquivos de programas\Tablet\Pen\Pen_TabletUser.exe

C:\Arquivos de programas\Tablet\Pen\Pen_Tablet.exe

C:\Arquivos de programas\CyberLink\TV Enhance\Kernel\TV\TVESched.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\WISPTIS.EXE

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Evernote\Evernote\EvernoteTray.exe

C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbam.exe

D:\Programas\IObit Security 360\is360.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Documents and Settings\User\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

C:\Arquivos de programas\Windows Live\Messenger\msnmsgr.exe

C:\Arquivos de programas\Windows Live\Contacts\wlcomm.exe