Problema com virus intell.dll

Question

Bom, meu amigo estava instalando aqui um jogo... e quando abriu o keygen, o mesmo infectou o pc(ou o kaspersky esta pegando como virus)
O caminho para o arquivo q ele pega como virus eh c:\arquivos de programas\intel\intell.DLL, fazendo um scan no http://virusscan.jotti.org/, vi q realmente estou infectado, ja tentei apagar, mas nao consigo, ja usei o killbox e ele nao ajudou, usei o combofix e tambem nada :\ aqui vai 1 log dos arquivos:

c:\arquivos de programas\intel\intell.dll:
Scan taken on 17 Feb 2008 11:13:42 (GMT)    A-Squared   Found nothing
  AntiVir   Found BDS/Hupigon.Gen  
  ArcaVir   Found nothing
  Avast   Found nothing
  AVG Antivirus   Found BackDoor.Hupigon3.ALMR  
  BitDefender   Found Generic.Graybird.83F97D9A 
  ClamAV   Found nothing
  CPsecure   Found Troj.PSW.W32.QQRob.1028 
  Dr.Web   Found nothing
  F-Prot Antivirus   Found Possibly a new variant of  W32/Threat-HLLPEM-based!Maximus 
  F-Secure Anti-Virus   Found nothing
  Fortinet   Found nothing
  Ikarus   Found Virus.Win32.Agent.OJX  
  Kaspersky Anti-Virus   Found nothing
  NOD32   Found nothing
  Norman Virus Control   Found Hupigon.gen131  
  Panda Antivirus   Found nothing
  Rising Antivirus   Found nothing
  Sophos Antivirus   Found Mal/EncPk-AP  
  VirusBuster   Found nothing
  VBA32   Found nothing

c:\arquivos de programas\intel\intell.exe:
       A-Squared                      Found  nothing
                                        AntiVir                      Found BDS/Hupigon.arlg 
                                        ArcaVir                      Found  nothing
                                        Avast                      Found  nothing
                                        AVG Antivirus                      Found BackDoor.Hupigon3.ALMS 
                                        BitDefender                      Found  nothing
                                        ClamAV                      Found  nothing
                                        CPsecure                      Found BackDoor.W32.Hupigon.arlg 
                                        Dr.Web                      Found  nothing
                                        F-Prot Antivirus                      Found Possibly a new variant of W32/Threat-HLLPEM-based!Maximus 
                                        F-Secure Anti-Virus                      Found Backdoor.Win32.Hupigon.arlg 
                                        Fortinet                      Found  nothing
                                        Ikarus                      Found Backdoor.Win32.Hupigon.arlg 
                                        Kaspersky Anti-Virus                      Found Backdoor.Win32.Hupigon.arlg 
                                        NOD32                      Found  nothing
                                        Norman Virus Control                      Found Hupigon.gen130 
                                        Panda Antivirus                      Found  nothing
                                        Rising Antivirus                      Found  nothing
                                        Sophos Antivirus                      Found Mal/EncPk-AP 
                                        VirusBuster                      Found  nothing
                                        VBA32                      Found Backdoor.Win32.Hupigon.arlg

Passei o hijackthis e vou tentar remover por ele agora, segue o log:
Logfile of HijackThis v1.99.1
Scan saved at 08:06:28, on 17/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe
C:\Arquivos de programas\ASUS\ASUS DH Remote\AsRc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Arquivos de programas\Winamp\winampa.exe
C:\Arquivos de programas\Java\jre1.6.0_03\bin\jusched.exe
C:\Arquivos de programas\Analog Devices\Core\smax4pnp.exe
C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe
C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe
C:\arquivos de programas\steam\steam.exe
C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\DAEMON Tools Pro\DTProAgent.exe
C:\Arquivos de programas\ASUS\ASUS DH Remote\AsDhRemote.exe
C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexStoreSvr.exe
C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe
C:\Arquivos de programas\Intel\Intell.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\ARQUIV~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Documents and Settings\Erikson\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Arquivos de programas\BitComet	ools\BitCometBHO_1.2.1.2.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [RemoteControl] C:\Arquivos de programas\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [LanguageShortcut] C:\Arquivos de programas\CyberLink\PowerDVD\Language\Language.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [Ai Quicker Help] C:\Arquivos de programas\ASUS\ASUS DH Remote\AsRc.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Arquivos de programas\Winamp\winampa.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Arquivos de programas\Java\jre1.6.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Arquivos de programas\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Arquivos de programas\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe
O4 - HKCU\..\Run: [Steam] c:\arquivos de programas\steam\steam.exe -silent
O4 - HKCU\..\Run: [MsnMsgr] C:\Arquivos de programas\Windows Live\Messenger\MsnMsgr.Exe /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] C:\Arquivos de programas\DAEMON Tools Pro\DTProAgent.exe
O8 - Extra context menu item: &amp;D&amp;ownload &amp;with BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &amp;D&amp;ownload all video with BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &amp;D&amp;ownload all with BitComet - res://C:\Arquivos de programas\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Arquivos de programas\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &amp;Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Arquivos de programas\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Arquivos de programas\BitComet	ools\BitCometBHO_1.2.1.2.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: SEARCH_PAGE_URL=&amp;http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1202991478339
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Arquivos de programas\Windows Live\Mail\mailcomm.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe -r (file missing)
O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exe

Answer

Bem, se quase nenhum antiv&iacute;rus e nem o ComboFix funciona:
V&aacute; em Iniciar - Executar - cmd
Primeiro: cd %programfiles%
Depois: rd /s /q Intel

Answer

Recebo esta mensagem:

Answer

VeX,

Fa&ccedil;a o download da ferramenta  The Avenger (by Swandog46)

Salve-o e descompacte na sua &Aacute;rea de trabalho;

Selecione e copie (CTRL+C) o texto abaixo indicado (inclusive a linha que onde diz &ldquo;Files to delete&rdquo;):

Files to delete:
C:\Arquivos de programas\Intel\Intell.dll
C:\Arquivos de programas\Intel\Intell.exe

Aten&ccedil;&atilde;o: O c&oacute;digo acima foi criado especificamente para este usu&aacute;rio. Se voc&ecirc; n&atilde;o for ele, N&Atilde;O siga estas orienta&ccedil;&otilde;es, pois elas podem danificar o funcionamento do seu sistema

Agora, execute a ferramenta The Avenger, clicando duas vezes em seu &iacute;cone na sua &Aacute;rea de trabalho;

Em Script file to execute escolha Input Script Manually;

Agora clique no &iacute;cone da Lupa onde abrir&aacute; uma nova janela chamada View/edit script;

Cole o texto copiado para esta janela pressionando (CTRL+V);

Clique em Done;

Agora clique no &iacute;cone Sinal Verde para iniciar a execu&ccedil;&atilde;o do script;

Responda Yes duas vezes quando solicitado.

The Avenger far&aacute; automaticamente o seguinte:
Reiniciar&aacute; seu computador; (em casos onde o c&oacute;digo para executar cont&eacute;m Drivers to Unload o Avenger reiniciar&aacute; o seu sistema duas vezes)

No reboot, abrir&aacute; momentaneamente uma janela do Prompt de comando na sua &Aacute;rea de trabalho, isto &eacute; normal;

Ap&oacute;s o rein&iacute;cio, ele criar&aacute; um arquivo log que deve abrir-se com os resultados das a&ccedil;&otilde;es do Avenger. Este arquivo log ficar&aacute; localizado em C:\avenger.txt;

O Avenger far&aacute; tamb&eacute;m um backup de todos os arquivos e etc., que voc&ecirc; pediu para deletar, e ter&aacute; zipado eles e movido os arquivos .zip para C:\avenger\backup.zip.

Por favor, copie e cole o conte&uacute;do do arquivo c:\avenger.txt na sua pr&oacute;xima resposta.

Answer

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\ejtebfep

*******************

Script file located at: \??\C:\WINDOWS\system32\jcaeyqgd.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Could not open file C:\Arquivos de programas\Intel\Intell.dll for deletion
Deletion of file C:\Arquivos de programas\Intel\Intell.dll failed!

Could not process line:
C:\Arquivos de programas\Intel\Intell.dll
Status: 0xc000003a

Could not open file C:\Arquivos de programas\Intel\Intell.exe for deletion
Deletion of file C:\Arquivos de programas\Intel\Intell.exe failed!

Could not process line:
C:\Arquivos de programas\Intel\Intell.exe
Status: 0xc000003a

Completed script processing.

*******************

Finished!  Terminate.

A pasta onde estavam os arquivos sumiu e eles tambem, mesmo parecendo q o programa nao fez nada hehe, estranho, mas o pc voltou ao normal :P. Muito obrigado pela ajuda, Eric!

Ferramentas

Mover Tópico