Ir ao conteúdo
  • Comunicados

    • diego_moicano

      Gostaria de se tornar um analista em Remoção de Malware?   07-12-2015

      Gostaria de se tornar um analista em Remoção de Malware? O Fórum Clube do Hardware deu início a um programa de treinamento em análises de log. Os interessados deverão enviar um email para aprendizes (arroba) clubedohardware (ponto) com (ponto) br respondendo as seguintes perguntas: Por que você gostaria de aprender a analisar logs? Possui tempo hábil para o treinamento? Tem conhecimentos em informática? Se sim descreva-os. Possui inglês para leitura? Qual seu objetivo após completar o treinamento?   Não se esqueça de incluir no e-mail o seu nome de usuário (fornecer o link também), idade e cidade onde vive. Adicione também qualquer experiência e/ou razão sobre o porquê você seria um bom Analista. É digno de nota que apenas os que forem selecionados receberão resposta por MP (Mensagem Pessoal), não existe um padrão na escolha dos futuros aprendizes, todos os e-mails serão lidos e serão analisados de forma imparcial, portanto não será permitido reclamações neste aspecto. O treinamento é dado no próprio fórum. Quando um aprendiz é selecionado ele é movido para um novo grupo, onde terá acesso a fóruns fechados para os demais usuários onde poderá dar inicio ao seu treinamento. Importante: A cada 30 dias os e-mails não selecionados serão apagados, portanto você pode enviar um novo e-mail após 1 mês, e-mails enviados antes serão desconsiderados.  
    • Gabriel Torres

      Seja um moderador do Clube do Hardware!   12-02-2016

      Prezados membros do Clube do Hardware, Está aberto o processo de seleção de novos moderadores para diversos setores ou áreas do Clube do Hardware. Os requisitos são:   Pelo menos 500 posts e um ano de cadastro; Boa frequência de participação; Ser respeitoso, cordial e educado com os demais membros; Ter bom nível de português; Ter razoável conhecimento da área em que pretende atuar; Saber trabalhar em equipe (com os moderadores, coordenadores e administradores).   Os interessados deverão enviar uma mensagem privada para o usuário @Equipe Clube do Hardware com o título "Candidato a moderador". A mensagem deverá conter respostas às perguntas abaixo:   Qual o seu nome completo? Qual sua data de nascimento? Qual sua formação/profissão? Já atuou como moderador em algo outro fórum, se sim, qual? De forma sucinta, explique o porquê de querer ser moderador do fórum e conte-nos um pouco sobre você.   OBS: Não se trata de função remunerada. Todos que fazem parte do staff são voluntários.
Entre para seguir isso  
nefertari_seth

Problemas com Rootkit (?)

Recommended Posts

Olá!

Como sou bem leiga nesses assuntos de computadores, vim pedir ajuda a vocês.

Uma amiga instalou o Anti-Rootkit da AVG para mim e aconselhou que eu passasse ao menos uma vez por semana no micro. Disse também que toda vez que aparecesse algo na lista, que eu deletasse porque era "coisa feia".

O fato é que eu fiz o scan a uma semana atrás e apareceu algo assim:

C:/WINDOWS/System32/Drivers/ e no fim uma "palavra" com nºs e letras.SYS. Eu deletei e reiniciei o micro. Para ter certeza que tinha sido deletado fiz o scan novamente. E APARECEU de novo, sendo que a única coisa que mudou foi a última palavra.

O Anti-Vírus e o Anti-Spyware não acusam nada. Só no Anti-Rootkit mesmo. Passei hoje novamente e lá está o C:/WINDOWS/System32/Drivers/av6v9nr2.SYS

Meu computador está infectado? O que eu faço?

Aguardo ansiosa por uma resposta.

Obrigada!

Gaby

Ps: Ah...em C:\Documents and Settings\Administrator tem uma pasta "tracing" com outra pasta chamada "WPPMedia" e um arquivo chamado "WindowsLiveMessenger-uccapi-0.uccapilog" ...nunca havia visto antes e achei estranho..é do messenger mesmo ou é algum tipo de vírus? =/

Obrigada novamente..

Compartilhar este post


Link para o post
Compartilhar em outros sites

- Faça o download do HijackThis

  • Coloque o arquivo numa pasta própria em C:\;
  • Dê um duplo clique no HijackThis e clique em Do a system scan and save a logfile;
  • Copie o conteúdo do bloco de notas cole na sua resposta.

- Faça o download do ComboFix

  • Desative, temporariamente, o antivírus;
  • Feche todas as janelas abertas;
  • Dê um duplo-clique no combofix.exe e tecle "1" para prosseguir o Fix. Pode demorar algum tempo.
  • O ComboFix poderá reiniciar o PC automaticamente para completar o processo de remoção.
  • Quando acabar, será gerado um log, que estará em C:\ComboFix.txt.
  • Não clique na Janela do ComboFix, nem o feche clicando no X, enquanto estiver rodando, não mova o mouse e não use o teclado, pois senão irá parar e seu desktop ficará em branco.
  • Para parar ou sair do ComboFix, tecle "N".
  • Cole o ComboFix.txt na sua resposta.

Compartilhar este post


Link para o post
Compartilhar em outros sites
  • Autor do tópico
  • Olá José, obrigada!

    Fiz tudo e aqui estão as respostas:

    Logfile of HijackThis v1.99.1

    Scan saved at 13:49:37, on 24/2/2008

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\Explorer.EXE

    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

    C:\WINDOWS\system32\GSICON.EXE

    C:\WINDOWS\system32\dslagent.exe

    C:\WINDOWS\system32\devldr32.exe

    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

    C:\Program Files\Last.fm\LastFMHelper.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\Program Files\eMule\emule.exe

    C:\Program Files\Windows NT\Accessories\wordpad.exe

    C:\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

    O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

    O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE

    O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB

    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe"

    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

    O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://img2.orkut.com/activex/10035/photouploader.cab

    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1201022692456

    O17 - HKLM\System\CCS\Services\Tcpip\..\{97971BD6-23C1-425E-B917-E9EAB649D199}: NameServer = 200.175.89.139 200.175.182.139

    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

    ComboFix 08-02-24.4 - Administrator 2008-02-24 13:57:33.1 - NTFSx86

    Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe

    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    .

    ((((((((((((((((((((((((( Files Created from 2008-01-24 to 2008-02-24 )))))))))))))))))))))))))))))))

    .

    2008-02-24 13:36 . 2008-02-24 13:36 218,112 --a------ C:\HijackThis.exe

    2008-02-23 16:16 . 2008-02-23 16:16 <DIR> d-------- C:\Program Files\CCleaner

    2008-02-23 02:17 . 2008-02-23 02:17 5,120 --ahs---- C:\WINDOWS\system32\Thumbs.db

    2008-02-19 13:25 . 2004-08-04 01:56 221,184 --a------ C:\WINDOWS\system32\wmpns.dll

    2008-02-19 13:16 . 2008-02-19 13:18 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Media Player Classic

    2008-02-19 13:12 . 2008-02-19 13:13 <DIR> d-------- C:\Program Files\K-Lite Codec Pack

    2008-02-18 00:45 . 2008-02-19 13:20 <DIR> d-------- C:\Program Files\Winamp

    2008-02-18 00:45 . 2008-02-18 00:46 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Winamp

    2008-02-17 00:27 . 2008-02-19 13:32 69 --a------ C:\WINDOWS\NeroDigital.ini

    2008-02-05 14:30 . 2004-07-20 15:24 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll

    2008-02-05 14:30 . 2004-07-20 15:24 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll

    2008-02-05 14:30 . 2004-07-20 15:24 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll

    2008-02-05 14:30 . 2004-07-09 07:43 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll

    2008-02-05 14:30 . 2004-07-20 15:24 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll

    2008-02-05 14:30 . 2001-07-09 09:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe

    2008-02-05 14:30 . 2000-06-26 09:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll

    2008-02-05 14:30 . 2001-06-26 06:15 38,912 --------- C:\WINDOWS\system32\picn20.dll

    2008-02-04 09:09 . 2007-07-30 18:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll

    2008-02-04 09:09 . 2007-07-30 18:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll

    2008-02-04 09:09 . 2007-07-30 18:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui

    2008-02-03 23:19 . 2008-02-03 23:19 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller

    2008-02-03 23:18 . 2008-02-03 23:22 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller

    2008-02-03 11:47 . 2008-02-03 11:47 <DIR> dr-h----- C:\Documents and Settings\Administrator\Application Data\SecuROM

    2008-02-03 11:47 . 2008-02-03 11:47 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll

    2008-02-01 19:20 . 2004-08-03 22:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys

    2008-02-01 19:20 . 2001-08-17 12:56 7,552 --a------ C:\WINDOWS\system32\drivers\SONYPVU1.SYS

    2008-02-01 19:20 . 2001-08-17 12:56 7,552 --a--c--- C:\WINDOWS\system32\dllcache\sonypvu1.sys

    2008-01-31 02:14 . 2006-03-22 12:53 337,320 --a------ C:\WINDOWS\difxapi.dll

    2008-01-31 02:14 . 2006-04-28 00:56 49,152 --a------ C:\WINDOWS\InstFunc.exe

    2008-01-31 02:14 . 2007-01-23 03:33 12,288 --a------ C:\WINDOWS\InstFunc.dll

    2008-01-31 01:57 . 2008-01-31 01:57 <DIR> d-------- C:\Program Files\NovaLogic

    2008-01-31 01:56 . 2008-01-31 01:56 <DIR> d-------- C:\Documents and Settings\Administrator\WINDOWS

    2008-01-31 01:56 . 1997-08-26 11:06 315,904 --a------ C:\WINDOWS\IsUninst.exe

    2008-01-31 01:32 . 2007-10-12 14:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll

    2008-01-31 01:31 . 2006-09-28 15:05 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll

    2008-01-31 01:26 . 2008-01-31 01:31 <DIR> d--h----- C:\WINDOWS\msdownld.tmp

    2008-01-30 15:57 . 2008-01-30 15:57 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Last.fm

    2008-01-30 15:42 . 2008-02-02 22:22 <DIR> d-------- C:\Program Files\Last.fm

    2008-01-30 13:50 . 2008-01-30 13:50 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft

    2008-01-30 13:50 . 2007-05-30 09:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys

    2008-01-30 13:44 . 2007-01-18 09:00 3,968 --a------ C:\WINDOWS\system32\drivers\AvgArCln.sys

    2008-01-30 12:45 . 2008-01-30 12:45 <DIR> d-------- C:\Westwood

    2008-01-30 11:50 . 2008-01-30 11:50 <DIR> d-------- C:\Program Files\DAEMON Tools Lite

    2008-01-30 11:50 . 2008-01-30 11:50 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\DAEMON Tools

    2008-01-30 11:42 . 2008-01-30 11:42 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys

    2008-01-28 12:59 . 2008-01-28 12:59 <DIR> d--hs---- C:\WINDOWS\ftpcache

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2008-02-24 11:00 --------- d-----w C:\Documents and Settings\Administrator\Application Data\AVG7

    2008-02-24 06:02 --------- d-----w C:\Program Files\eMule

    2008-02-23 05:12 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\avg7

    2008-02-05 17:30 --------- d-----w C:\Program Files\Ahead

    2008-02-04 02:18 --------- d-----w C:\Program Files\Windows Live

    2008-01-23 05:20 --------- d-----w C:\Program Files\Java

    2008-01-23 05:16 --------- d-----w C:\Program Files\Common Files\Java

    2008-01-22 19:07 --------- d-----w C:\Program Files\MSN MESSENGER

    2008-01-22 18:39 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll

    2008-01-22 18:39 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll

    2008-01-22 18:39 --------- d-----w C:\Documents and Settings\LocalService.NT AUTHORITY.000\Application Data\AVG7

    2008-01-22 18:38 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft

    2008-01-22 16:26 --------- d-----w C:\Program Files\ECI Telecom

    2008-01-22 16:26 --------- d-----w C:\Program Files\Common Files\InstallShield

    2008-01-15 20:49 --------- d--h--w C:\Program Files\InstallShield Installation Information

    2008-01-14 20:21 --------- d-----w C:\Program Files\SiSLan

    2008-01-10 16:16 159,839 ----a-w C:\WINDOWS\system32\xvidvfw.dll

    2008-01-10 16:15 755,027 ----a-w C:\WINDOWS\system32\xvidcore.dll

    2008-01-04 02:37 --------- d-----w C:\Documents and Settings\Maurício & Gaby\Application Data\MSNInstaller

    2008-01-04 01:48 --------- d-----w C:\Program Files\On-line Help Console

    2007-12-26 21:32 --------- d-----w C:\Program Files\kX Project

    2007-12-24 16:49 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll

    2007-12-04 05:33 682,496 ----a-w C:\WINDOWS\system32\divx.dll

    2007-12-04 04:08 129,784 ------w C:\WINDOWS\system32\pxafs.dll

    2007-12-04 04:08 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe

    2007-12-04 04:08 118,056 ------w C:\WINDOWS\system32\pxcpyi64.exe

    2007-11-30 02:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll

    2007-11-30 02:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll

    .

    <pre>
    ----a-w 97,892 2004-05-31 11:34:56 C:\Documents and Settings\Administrator\My Documents\Músicas Gaby\QUEEN\Queen - 1989-2 - At The Beeb\[u]0[/u]0 MPC Format Plugin for Winamp ver. 0.96 .exe
    </pre>

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-11-07 14:34 3739672]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 23:32 208952]

    "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 23:32 455168]

    "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 23:32 455168]

    "GSICONEXE"="GSICON.EXE" [2002-01-22 20:01 90112 C:\WINDOWS\system32\gsicon.exe]

    "DSLAGENTEXE"="dslagent.exe" [2002-01-22 20:01 16384 C:\WINDOWS\system32\dslagent.exe]

    "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-22 15:38 579072]

    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]

    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 06:25 6731312]

    "Adobe Photo Downloader"="C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe" [2007-12-04 01:07 61440]

    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50 155648]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:56 15360]

    "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-22 15:39 219136]

    C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\

    Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2008-01-30 15:56:25 106496]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

    "%windir%\\system32\\sessmgr.exe"=

    "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=

    "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=

    "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=

    "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

    "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

    "C:\\Program Files\\eMule\\emule.exe"=

    S2 gafwload;ECI Telecom USB ADSL Loader;C:\WINDOWS\system32\DRIVERS\gafwload.sys [2002-01-22 20:01]

    S3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys [2006-02-14 15:02]

    .

    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

    Rootkit scan 2008-02-24 14:01:24

    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully

    hidden files: 0

    **************************************************************************

    .

    Completion time: 2008-02-24 14:03:05

    .

    2008-02-01 16:53:05 --- E O F ---

    Compartilhar este post


    Link para o post
    Compartilhar em outros sites

    - Selecione o texto abaixo e copie para o bloco de notas. Salve-o como CFScript.txt;


    File::
    C:\malware.exe

    RENV::
    C:\Documents and Settings\Administrator\My Documents\Músicas Gaby\QUEEN\Queen - 1989-2 - At The Beeb\00 MPC Format Plugin for Winamp ver. 0.96 .exe

    Folder::
    C:\Test

    - Arraste o CFScript.txt para o ComboFix conforme a imagem abaixo:

    CF_Script.gif

    O ComboFix irá rodar e reiniciará o PC automaticamente para completar o processo de remoção.

    Não use o mouse nem o teclado quando o ComboFix estiver rodando.

    Quando terminar, será gerado um log, que estará em C:\ComboFix.txt.

    Obs: Se o Combofix não reiniciar seu computador automaticamente, faça-o manualmente.

    Na sua próxima resposta, cole o ComboFix.txt e um novo log do HijackThis.

    Compartilhar este post


    Link para o post
    Compartilhar em outros sites
  • Autor do tópico
  • Olá José!

    Aqui estão os novos logs:

    ComboFix 08-02-24.4 - Administrator 2008-02-26 21:59:15.2 - NTFSx86

    Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe

    Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt

    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::

    C:\malware.exe

    .

    ((((((((((((((((((((((((( Files Created from 2008-01-27 to 2008-02-27 )))))))))))))))))))))))))))))))

    .

    2008-02-24 14:22 . 2008-02-24 14:22 <DIR> d-------- C:\Programas de limpeza e anti-rootkits

    2008-02-23 16:16 . 2008-02-23 16:16 <DIR> d-------- C:\Program Files\CCleaner

    2008-02-23 02:17 . 2008-02-23 02:17 5,120 --ahs---- C:\WINDOWS\system32\Thumbs.db

    2008-02-19 13:25 . 2004-08-04 01:56 221,184 --a------ C:\WINDOWS\system32\wmpns.dll

    2008-02-19 13:16 . 2008-02-19 13:18 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Media Player Classic

    2008-02-19 13:12 . 2008-02-19 13:13 <DIR> d-------- C:\Program Files\K-Lite Codec Pack

    2008-02-18 00:45 . 2008-02-19 13:20 <DIR> d-------- C:\Program Files\Winamp

    2008-02-18 00:45 . 2008-02-18 00:46 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Winamp

    2008-02-17 00:27 . 2008-02-19 13:32 69 --a------ C:\WINDOWS\NeroDigital.ini

    2008-02-05 14:30 . 2004-07-20 15:24 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll

    2008-02-05 14:30 . 2004-07-20 15:24 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll

    2008-02-05 14:30 . 2004-07-20 15:24 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll

    2008-02-05 14:30 . 2004-07-09 07:43 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll

    2008-02-05 14:30 . 2004-07-20 15:24 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll

    2008-02-05 14:30 . 2001-07-09 09:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe

    2008-02-05 14:30 . 2000-06-26 09:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll

    2008-02-05 14:30 . 2001-06-26 06:15 38,912 --------- C:\WINDOWS\system32\picn20.dll

    2008-02-04 09:09 . 2007-07-30 18:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll

    2008-02-04 09:09 . 2007-07-30 18:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll

    2008-02-04 09:09 . 2007-07-30 18:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui

    2008-02-03 23:19 . 2008-02-03 23:19 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller

    2008-02-03 23:18 . 2008-02-03 23:22 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller

    2008-02-03 11:47 . 2008-02-03 11:47 <DIR> dr-h----- C:\Documents and Settings\Administrator\Application Data\SecuROM

    2008-02-03 11:47 . 2008-02-03 11:47 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll

    2008-02-01 19:20 . 2004-08-03 22:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys

    2008-02-01 19:20 . 2001-08-17 12:56 7,552 --a------ C:\WINDOWS\system32\drivers\SONYPVU1.SYS

    2008-02-01 19:20 . 2001-08-17 12:56 7,552 --a--c--- C:\WINDOWS\system32\dllcache\sonypvu1.sys

    2008-01-31 02:14 . 2006-03-22 12:53 337,320 --a------ C:\WINDOWS\difxapi.dll

    2008-01-31 02:14 . 2006-04-28 00:56 49,152 --a------ C:\WINDOWS\InstFunc.exe

    2008-01-31 02:14 . 2007-01-23 03:33 12,288 --a------ C:\WINDOWS\InstFunc.dll

    2008-01-31 01:57 . 2008-01-31 01:57 <DIR> d-------- C:\Program Files\NovaLogic

    2008-01-31 01:56 . 2008-01-31 01:56 <DIR> d-------- C:\Documents and Settings\Administrator\WINDOWS

    2008-01-31 01:56 . 1997-08-26 11:06 315,904 --a------ C:\WINDOWS\IsUninst.exe

    2008-01-31 01:32 . 2007-10-12 14:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll

    2008-01-31 01:31 . 2006-09-28 15:05 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll

    2008-01-31 01:26 . 2008-01-31 01:31 <DIR> d--h----- C:\WINDOWS\msdownld.tmp

    2008-01-30 15:57 . 2008-01-30 15:57 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Last.fm

    2008-01-30 15:42 . 2008-02-02 22:22 <DIR> d-------- C:\Program Files\Last.fm

    2008-01-30 13:50 . 2008-01-30 13:50 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft

    2008-01-30 13:50 . 2007-05-30 09:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys

    2008-01-30 13:44 . 2007-01-18 09:00 3,968 --a------ C:\WINDOWS\system32\drivers\AvgArCln.sys

    2008-01-30 12:45 . 2008-01-30 12:45 <DIR> d-------- C:\Westwood

    2008-01-30 11:50 . 2008-01-30 11:50 <DIR> d-------- C:\Program Files\DAEMON Tools Lite

    2008-01-30 11:50 . 2008-01-30 11:50 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\DAEMON Tools

    2008-01-30 11:42 . 2008-01-30 11:42 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys

    2008-01-28 12:59 . 2008-01-28 12:59 <DIR> d--hs---- C:\WINDOWS\ftpcache

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2008-02-26 17:33 --------- d-----w C:\Program Files\eMule

    2008-02-26 11:00 --------- d-----w C:\Documents and Settings\Administrator\Application Data\AVG7

    2008-02-23 05:12 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\avg7

    2008-02-05 17:30 --------- d-----w C:\Program Files\Ahead

    2008-02-04 02:18 --------- d-----w C:\Program Files\Windows Live

    2008-01-23 05:20 --------- d-----w C:\Program Files\Java

    2008-01-23 05:16 --------- d-----w C:\Program Files\Common Files\Java

    2008-01-22 18:39 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll

    2008-01-22 18:39 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll

    2008-01-22 18:39 --------- d-----w C:\Documents and Settings\LocalService.NT AUTHORITY.000\Application Data\AVG7

    2008-01-22 18:38 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft

    2008-01-22 16:26 --------- d-----w C:\Program Files\ECI Telecom

    2008-01-22 16:26 --------- d-----w C:\Program Files\Common Files\InstallShield

    2008-01-15 20:49 --------- d--h--w C:\Program Files\InstallShield Installation Information

    2008-01-14 20:21 --------- d-----w C:\Program Files\SiSLan

    2008-01-10 16:16 159,839 ----a-w C:\WINDOWS\system32\xvidvfw.dll

    2008-01-10 16:15 755,027 ----a-w C:\WINDOWS\system32\xvidcore.dll

    2008-01-04 02:37 --------- d-----w C:\Documents and Settings\Maurício & Gaby\Application Data\MSNInstaller

    2008-01-04 01:48 --------- d-----w C:\Program Files\On-line Help Console

    2007-12-24 16:49 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll

    2007-12-04 05:33 682,496 ----a-w C:\WINDOWS\system32\divx.dll

    2007-12-04 04:08 129,784 ------w C:\WINDOWS\system32\pxafs.dll

    2007-12-04 04:08 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe

    2007-12-04 04:08 118,056 ------w C:\WINDOWS\system32\pxcpyi64.exe

    2007-11-30 02:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll

    2007-11-30 02:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-11-07 14:34 3739672]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 23:32 208952]

    "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 23:32 455168]

    "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 23:32 455168]

    "GSICONEXE"="GSICON.EXE" [2002-01-22 20:01 90112 C:\WINDOWS\system32\gsicon.exe]

    "DSLAGENTEXE"="dslagent.exe" [2002-01-22 20:01 16384 C:\WINDOWS\system32\dslagent.exe]

    "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-22 15:38 579072]

    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]

    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 06:25 6731312]

    "Adobe Photo Downloader"="C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe" [2007-12-04 01:07 61440]

    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50 155648]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 01:56 15360]

    "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-22 15:39 219136]

    C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\

    Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2008-01-30 15:56:25 106496]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

    "%windir%\\system32\\sessmgr.exe"=

    "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=

    "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=

    "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=

    "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

    "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

    "C:\\Program Files\\eMule\\emule.exe"=

    S2 gafwload;ECI Telecom USB ADSL Loader;C:\WINDOWS\system32\DRIVERS\gafwload.sys [2002-01-22 20:01]

    S3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys [2006-02-14 15:02]

    .

    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

    Rootkit scan 2008-02-26 22:03:24

    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully

    hidden files: 0

    **************************************************************************

    .

    Completion time: 2008-02-26 22:05:20

    .

    2008-02-01 16:53:05 --- E O F ---

    Logfile of HijackThis v1.99.1

    Scan saved at 22:14:11, on 26/2/2008

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

    C:\WINDOWS\Explorer.EXE

    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

    C:\WINDOWS\system32\GSICON.EXE

    C:\WINDOWS\system32\dslagent.exe

    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

    C:\WINDOWS\system32\devldr32.exe

    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

    C:\Program Files\Last.fm\LastFMHelper.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\Programas de limpeza e anti-rootkits\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

    O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

    O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE

    O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB

    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe"

    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

    O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://img2.orkut.com/activex/10035/photouploader.cab

    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1201022692456

    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL

    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

    E agora? Tá tudo ok? :)

    Aguardo resposta! ^^

    Gaby;)

    Compartilhar este post


    Link para o post
    Compartilhar em outros sites

    - Ok, o log está limpo :)

    - Digite no Executar combofix /u e clique em Ok. Na próxima janela clique em "Executar" e aguarde a remoção do programa;

    - Atualize o Internet Explorer:

    http://www.microsoft.com/downloads/details.aspx?FamilyId=9AE91EBE-3385-447C-8A30-081805B2F90B&displaylang=pt-br

    - Recomendo uma manutenção no computador para exclusão dos arquivos temporários, desnecessários e entradas inválidas no registro. Faça o download do CCleaner:

    • Abra o programa e clique em Executar Limpeza;
    • Após isto, clique em Registro > Procurar > Corrigir erros selecionados

    - Desative e ative novamente a Restauração do Sistema

    - Leia o artigo Proteja seu PC para mais informações sobre como evitar infecções.

    Compartilhar este post


    Link para o post
    Compartilhar em outros sites
  • Autor do tópico
  • Olá José!

    Muito obrigada pela ajuda :lol:

    Só tenho mais duas perguntas:

    1ª- Desculpe se a pergunta é *****..mas e esse arquivo.uccapilog que tem no micro? Gostaria apenas de saber se é do messenger mesmo, porque está numa pasta que nunca tinha visto em C:\Documents and Settings\Administrator..desculpe a insistência..

    2ª- É realmente necessário atualizar o IE? Pois só usamos o Mozilla :)

    Mais uma vez agradeço a ajuda ;)

    Gaby

    Compartilhar este post


    Link para o post
    Compartilhar em outros sites
    Desculpe se a pergunta é *****..mas e esse arquivo.uccapilog que tem no micro?

    O arquivo é criado pelo Messenger e é protegido pelo sistema.

    É realmente necessário atualizar o IE?

    Questão de segurança para quando usar o navegador.

    Compartilhar este post


    Link para o post
    Compartilhar em outros sites
    Entre para seguir isso  





    Sobre o Clube do Hardware

    No ar desde 1996, o Clube do Hardware é uma das maiores, mais antigas e mais respeitadas publicações sobre tecnologia do Brasil. Leia mais

    Direitos autorais

    Não permitimos a cópia ou reprodução do conteúdo do nosso site, fórum, newsletters e redes sociais, mesmo citando-se a fonte. Leia mais

    ×