Por Favor Ajuda!! Virus Indestrutivel

Question

Pessoal &eacute;  o seguinte.....

h&aacute; umas 2 semanas percebi que o meu anti virus avast e o spybot possuiam apenas o atalho. Me parece que isto aconteceu depois de instalar o Webroot Spy sweeper trial, que baixei no emule.
 
Tentei reinstalar eles, so que quando sao instalados, n&atilde;o sei como, os arquivos .exe s&atilde;o excluidos na hora...
 
Ja tentei instalar todos anti virus, o Avast, Avg, Kaspeskay e outros limpadores e nao consigo...Todos acontece um tipo de erro. JA removi o Sweeper, mas nao adianta.
 
O Spy boot tb nao consigo... Somente o Spy sweeper, mas como eh uma versao trial que ja venceu, nao ha como fazer nada...
 
por favor, preciso de ajuda.....n&atilde;o sei mais o que fazer....
 
grato

Answer

Qual exatamente seu problema? t&aacute; um tanto confuso... tem um v&iacute;rus no seu sistema ou o problema &eacute; com os programas anti-v&iacute;rus e spywares?

Answer

deve ter um virus no pc... ele nao deixa instalar nem anti virus, nem spywares....

Answer

Escaneamento do F-secure bl:

09/11/07 20:21:59 [Info]: BlackLight Engine 1.0.64 initialized
09/11/07 20:21:59 [Info]: OS: 5.1 build 2600 (Service Pack 2)
09/11/07 20:21:59 [Note]: 7019 4
09/11/07 20:21:59 [Note]: 7005 0
09/11/07 20:22:10 [Note]: 7006 0
09/11/07 20:22:10 [Note]: 7011 3124
09/11/07 20:22:10 [Note]: 7026 0
09/11/07 20:22:11 [Note]: 7026 0
09/11/07 20:22:14 [Note]: FSRAW library version 1.7.1022
09/11/07 20:23:00 [Info]: Hidden file: c:\Arquivos de programas\Movie Maker\Shared\Empty.txt
09/11/07 20:23:00 [Note]: 10002 3
09/11/07 20:23:00 [Info]: Hidden file: c:\Arquivos de programas\Movie Maker\Shared\Filters.xml
09/11/07 20:23:00 [Note]: 10002 3
09/11/07 20:23:00 [Info]: Hidden file: c:\Arquivos de programas\Movie Maker\Shared
ews.png
09/11/07 20:23:00 [Note]: 10002 3
09/11/07 20:23:00 [Info]: Hidden file: c:\Arquivos de programas\Movie Maker\Shared\paint.png
09/11/07 20:23:00 [Note]: 10002 3
09/11/07 20:23:00 [Info]: Hidden file: c:\Arquivos de programas\Movie Maker\Shared\Profiles\Blank.txt
09/11/07 20:23:00 [Note]: 10002 3
09/11/07 20:23:00 [Info]: Hidden file: c:\Arquivos de programas\Movie Maker\Shared\Sample1.jpg
09/11/07 20:23:00 [Note]: 10002 3
09/11/07 20:23:00 [Info]: Hidden file: c:\Arquivos de programas\Movie Maker\Shared\Sample2.jpg
09/11/07 20:23:00 [Note]: 10002 3
09/11/07 20:23:00 [Note]: 10002 2
09/11/07 20:23:00 [Note]: 10002 2
09/11/07 20:27:16 [Note]: 10002 2
09/11/07 20:27:16 [Note]: 10002 2
09/11/07 20:28:11 [Info]: Hidden file: c:\WINDOWS\system32\drivers\srosa.sys
09/11/07 20:28:11 [Note]: 10002 2

Answer

09/11/07 20:28:11 [Info]: Hidden file: c:\WINDOWS\system32\drivers\srosa.sys
Geisson Lima,

- Fa&ccedil;a o download do [COLOR=blue]ComboFix[/COLOR]
D&ecirc; um duplo-clique no combofix.exe e tecle Y para prosseguir o Fix. Vai durar uma m&eacute;dia de 10 minutos.
O ComboFix reiniciar&aacute; o PC automaticamente para completar o processo de remo&ccedil;&atilde;o.
Quando acabar, ser&aacute; gerado um log, que estar&aacute; em C:\ComboFix.txt.
N&atilde;o clique na Janela do ComboFix, nem o feche clicando no X, enquanto estiver rodando, pois sen&atilde;o ir&aacute; parar e seu desktop ficar&aacute; em branco.
Para parar ou sair do ComboFix, tecle N.- Poste o ComboFix.txt

Answer

scan do hijack
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:46:19, on 11/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\SYSTEM32\odbcasvc.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\slserv.exe
C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\Analog Devices\SoundMAX\SMTray.exe
C:\Arquivos de programas\DAEMON Tools\daemon.exe
C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Arquivos de programas\Oi Internet\DiscaOi.exe
C:\Arquivos de programas\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\slrundll.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Arquivos de programas\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Arquivos de programas\MSN Messenger\msnmsgr.exe
C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://farejador.ig.com.br/ie/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://farejador.ig.com.br
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: XBTP06568 Class - {311F9DE8-6126-4EEE-B15F-65CBB3B4F9F6} - C:\Arquivos de programas\AOL Security Toolbar	buBB\AOL_security_toolbar.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar3.dll
O3 - Toolbar: AOL Security Toolbar - {3BB63FD4-3C00-44D7-94A9-5DE211900DEF} - C:\Arquivos de programas\AOL Security Toolbar	buBB\AOL_security_toolbar.dll
O4 - HKLM\..\Run: [Smapp] C:\Arquivos de programas\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DAEMON Tools] C:\Arquivos de programas\DAEMON Tools\daemon.exe -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C192915-E842-4D9C-8BC7-0E3C14F523C7}: NameServer = 200.202.193.76 200.222.0.35
O17 - HKLM\System\CCS\Services\Tcpip\..\{4DCEC239-139A-4CA0-8A46-2B8E9E7C712A}: NameServer = 10.0.0.155
O17 - HKLM\System\CS1\Services\Tcpip\..\{1C192915-E842-4D9C-8BC7-0E3C14F523C7}: NameServer = 200.202.193.76 200.222.0.35
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe (file missing)
O23 - Service: avast! Antivirus - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe (file missing)
O23 - Service: Display Desktop 32 Service - Unknown owner - C:\WINDOWS\system32\vdesk32.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe
--
End of file - 5764 bytes

Answer

relatorio combo fix
 
ComboFix 07-09-10.6 - User 2007-09-11 20:50:30.1 - NTFS  x86 
Microsoft Windows XP Professional  5.1.2600.2.1252.55.1046.18.198 [GMT -3:00]
 C:\WINDOWS\system32\chkdsk.exe est&aacute; faltando 
 * Created a new restore point
.
(((((((((((((((((((((((((((((((((((((   Outras Exclus&otilde;es   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\folder.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\odbcasvc.exe

(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))

-------\LEGACY_ODBCASVC
-------\odbcasvc

(((((((((((((((((((((((   Ficheiros criados de 2007-08-11 to 2007-09-11  ))))))))))))))))))))))))))))))))
.
2007-09-11 20:49 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-09-11 20:05  d-------- C:\Arquivos de programas\Trend Micro
2007-09-11 19:44  d-------- C:\Muestras
2007-09-11 19:01 2,185,216 --a--c--- C:\WINDOWS\system32\dllcache
toskrnl.exe
2007-09-11 18:32 128,000 --a------ C:\WINDOWS\DesinstWRecnet.exe
2007-09-11 18:32 122,880 --a------ C:\WINDOWS\DesinstRecnet.exe
2007-09-11 18:32  d-------- C:\Recnet
2007-09-11 18:23 57,344 --a------ C:\WINDOWS\system32\signet32.dll
2007-09-11 18:23 162,304 --a------ C:\WINDOWS\system32	dbgpp.dll
2007-09-11 18:23  d-------- C:\Arquivos de programas\Programas RFB
2007-09-10 21:53  d-------- C:\Geisson
2007-09-10 21:49  d-------- C:\Arquivos de programas\eMule
2007-09-10 21:33  d--h----- C:\WINDOWS\system32\GroupPolicy
2007-09-10 20:52  d-------- C:\DOCUME~1\User\DADOSD~1\VSRevoGroup
2007-09-10 20:33  d-------- C:\Arquivos de programas\VS Revo Group
2007-09-07 16:34 111,104 --a------ C:\WINDOWS\system32\uha.exe
2007-08-30 20:00  d-------- C:\DOCUME~1\User\DADOSD~1\Image Zone Express
2007-08-24 18:54  d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\HP
2007-08-24 18:54  d-------- C:\Arquivos de programas\Arquivos comuns\HP
2007-08-24 18:49  d-------- C:\Arquivos de programas\Arquivos comuns\Hewlett-Packard
2007-08-24 18:48 51,120 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys
2007-08-24 18:48 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2007-08-24 18:47 21,744 -ra------ C:\WINDOWS\system32\drivers\HPZius12.sys
2007-08-24 18:45 94,208 --a------ C:\WINDOWS\system32\HPZipt12.dll
2007-08-24 18:45 69,632 --a------ C:\WINDOWS\system32\HPZipm12.exe
2007-08-24 18:45 61,440 --a------ C:\WINDOWS\system32\HPZinw12.exe
2007-08-24 18:45 57,344 --a------ C:\WINDOWS\system32\HPZisn12.dll
2007-08-24 18:45 278,584 --a------ C:\WINDOWS\system32\HPZidr12.dll
2007-08-24 18:45 204,800 --a------ C:\WINDOWS\system32\HPZipr12.dll
2007-08-24 18:44  d-------- C:\Arquivos de programas\HP
2007-08-24 18:43 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2007-08-24 18:43 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-08-24 18:43 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2007-08-24 18:43 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-08-24 18:41  d-------- C:\DOCUME~1\User\DADOSD~1\HP
2007-08-22 22:54 4,608 -ra------ C:\WINDOWS\system32\W95Inf32.DLL
2007-08-22 22:54 2,272 -ra------ C:\WINDOWS\system32\W95Inf16.DLL
.
(((((((((((((((((((((((((((((((((((((   Relat&oacute;rio Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-11 19:27 --------- d-------- C:\Arquivos de programas\Oi Internet
2007-09-10 21:27 --------- d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Spybot - Search & Destroy
2007-09-04 21:32 --------- d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\BVRP Software
2007-08-30 21:29 --------- d-------- C:\Arquivos de programas\UnH Solutions
2007-08-24 21:52 --------- d-------- C:\DOCUME~1\User\DADOSD~1\Ahead
2007-08-20 21:12 --------- d-a------ C:\DOCUME~1\ALLUSE~1\DADOSD~1\TEMP
2007-08-05 20:11 --------- d-------- C:\Arquivos de programas\Winamp
2007-08-02 22:24 --------- d-------- C:\Arquivos de programas\Windows Live Toolbar
2007-08-01 21:02 --------- d-------- C:\DOCUME~1\ALLUSE~1\DADOSD~1\Windows Live Toolbar
2007-08-01 21:00 --------- d-------- C:\Arquivos de programas\MSN Messenger
2007-06-13 10:21 1035264 --a------ C:\WINDOWS\explorer.exe
2006-12-15 14:15:40 189,692 --sha-r C:\WINDOWS\Temp\101927.exe
.
((((((((((((((((((((((((((   Pontos de Carregamento do Registro   )))))))))))))))))))))))))))))))))))))))
.
 
*Nota* entradas vazias & leg&iacute;timas por defeito n&atilde;o s&atilde;o mostradas.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Smapp=C:\Arquivos de programas\Analog Devices\SoundMAX\SMTray.exe [2003-05-05 07:57]
DAEMON Tools=C:\Arquivos de programas\DAEMON Tools\daemon.exe [2006-11-12 07:48]
NvCplDaemon=C:\WINDOWS\system32\NvCpl.dll [2005-11-11 12:47]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
swg=C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-07-27 23:01]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Discador Oi Internet.lnk]
path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Discador Oi Internet.lnk
backup=C:\WINDOWS\pss\Discador Oi Internet.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast!]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
C:\Janderson\DAEMON Tools\daemon.exe -lang 1033
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Detector]
C:\WINDOWS	wain_32\600x1200\Detector.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Discador iG]
C:\Arquivos de programas\iGv6\Discador iG.exe boot
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
C:\Arquivos de programas\Google\Google Talk\googletalk.exe /autostart
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Arquivos de programas\Messenger\msmsgs.exe /background
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe /background
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Arquivos de programas\QuickTime\qttask.exe -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Arquivos de programas\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WatchDog]
C:\Arquivos de programas\mobil\WatchDog.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Arquivos de programas\Winamp\winampa.exe
R0 SiSRaid;SiSRaid;C:\WINDOWS\system32\DRIVERS\SiSRaid.sys
S1 srosa;Megadrv3;\??\C:\WINDOWS\system32\drivers\srosa.sys
S2 Display Desktop 32 Service;Display Desktop 32 Service;C:\WINDOWS\system32\vdesk32.exe
S3 Xgiv3;Xgiv3;C:\WINDOWS\system32\DRIVERS\Xgiv3m.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d812f5fd-e708-11db-9350-0013d4c638de}]
AutoRun\command- certo.exe
.
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-11 20:54:19
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
Completion time: 2007-09-11 20:56:47 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-11 20:56
.
 --- E O F ---

ok galera....
valeu...
parece que o problema foi resolvido....
muito grato msm....
vcs conhecem mto....
abra&ccedil;os...

Answer

[COLOR=Red]1.[/COLOR]

Fa&ccedil;a o download do [COLOR=purple]Avenger (by Swandog46)[/COLOR].

Copie o conte&uacute;do dentro do quote:

File to Delete:
C:\WINDOWS\system32\uha.exe
C:\WINDOWS\Temp\101927.exe

Rode o [COLOR=purple]Avenger[/COLOR]. Selecione Input script manually.

Clique no &iacute;cone http://img183.imageshack.us/img183/822/lupaavengerkp2.png    . Ir&aacute; abrir a janela View/edit script e ent&atilde;o cole o que copiou dentro do QUOTE.

Clique em Done. Agora clique no &iacute;cone http://img105.imageshack.us/img105/8125/sinalverdeavengerxs8.png
  para come&ccedil;ar a execu&ccedil;&atilde;o do script. D&ecirc; o Sim (Yes).

Ao acabar de rodar o script, o PC ser&aacute; reiniciado.

Reinicie seu computador normalmente.
[COLOR=Red]
2.

[/COLOR]Gere novo log do HijackThis, feito em Modo Normal, e cole na sua resposta.

Cole tamb&eacute;m o log do Avenger -> C:\avenger.txt e do F-Secure Blacklight.

Fique com Deus

Answer

apos colar o o quote e clicar lah no icone, e dar ok, aparece uma msg de erro: error: selected file does not appear to to be a valid script.
press okto log a error and continue 
error code 5

Answer

Corrige o quote para:

Files to delete:
C:\WINDOWS\system32\uha.exe
C:\WINDOWS\Temp\101927.exe

[]'s

Answer

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services	fnyiddj
*******************
Script file located at: \??\C:\WINDOWS\dmcvqaaa.txt
Script file opened successfully.
Script file read successfully
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
File C:\WINDOWS\system32\uha.exe deleted successfully.

File C:\WINDOWS\Temp\101927.exe not found!
Deletion of file C:\WINDOWS\Temp\101927.exe failed!
Could not process line:
C:\WINDOWS\Temp\101927.exe
Status: 0xc0000034

Completed script processing.
*******************
Finished!  Terminate.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:40:04, on 11/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\slserv.exe
C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\Analog Devices\SoundMAX\SMTray.exe
C:\Arquivos de programas\DAEMON Tools\daemon.exe
C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32
otepad.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Arquivos de programas\Oi Internet\DiscaOi.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://farejador.ig.com.br/ie/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://farejador.ig.com.br
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: XBTP06568 Class - {311F9DE8-6126-4EEE-B15F-65CBB3B4F9F6} - C:\Arquivos de programas\AOL Security Toolbar	buBB\AOL_security_toolbar.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar3.dll
O3 - Toolbar: AOL Security Toolbar - {3BB63FD4-3C00-44D7-94A9-5DE211900DEF} - C:\Arquivos de programas\AOL Security Toolbar	buBB\AOL_security_toolbar.dll
O4 - HKLM\..\Run: [Smapp] C:\Arquivos de programas\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DAEMON Tools] C:\Arquivos de programas\DAEMON Tools\daemon.exe -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [swg] C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARQUIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4DCEC239-139A-4CA0-8A46-2B8E9E7C712A}: NameServer = 10.0.0.155
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe (file missing)
O23 - Service: avast! Antivirus - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe (file missing)
O23 - Service: Display Desktop 32 Service - Unknown owner - C:\WINDOWS\system32\vdesk32.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) -   - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe
--
End of file - 5683 bytes

Answer

Log Limpo. :ze_bonitinho:

Answer

F-Secure Blacklight
09/11/07 22:45:32 [Info]: BlackLight Engine 1.0.64 initialized
09/11/07 22:45:32 [Info]: OS: 5.1 build 2600 (Service Pack 2)
09/11/07 22:45:32 [Note]: 7019 4
09/11/07 22:45:32 [Note]: 7005 0
09/11/07 22:45:35 [Note]: 7006 0
09/11/07 22:45:35 [Note]: 7011 1244
09/11/07 22:45:35 [Note]: 7026 0
09/11/07 22:45:35 [Note]: 7026 0
09/11/07 22:45:38 [Note]: FSRAW library version 1.7.1022
09/11/07 22:52:29 [Note]: 2000 1012
09/11/07 22:52:29 [Note]: 2000 1012
09/11/07 22:53:01 [Note]: 7007 0

ok...
valeu
conhece mto cara....
grato msm...
abra&ccedil;o

so mais uma coisa... se nao incomodar....
me da so um conselho  ai de anti virus pra eu baixar e instalar....

Answer

valeu........

Ferramentas

Mover Tópico