Olá!
Então, segue ai os novos logs e primeiras impressões:
Hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:49, on 26/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\ARQUIV~1\GbPlugin\GbpSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Arquivos de programas\Apache Software Foundation\Apache2.2\bin\httpd.exe
C:\Arquivos de programas\MySQL\MySQL Server 5.1\bin\mysqld.exe
C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe
C:\Arquivos de programas\Apache Software Foundation\Apache2.2\bin\httpd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\Arquivos de programas\GbPlugin\gbieh.dll
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Monitor Apache Servers.lnk = C:\Arquivos de programas\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsof...ss/allinone.asp
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zon...kr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zon...wn.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zon...1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1217801760265
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O16 - DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} (GbpDistObj Class) - https://www14.bancob...gin/GbpDist.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zon...er.cab56986.cab
O20 - Winlogon Notify: GbPluginBb - C:\Arquivos de programas\GbPlugin\gbieh.dll
O23 - Service: Apache2.2 - Apache Software Foundation - C:\Arquivos de programas\Apache Software Foundation\Apache2.2\bin\httpd.exe
O23 - Service: Gbp Service (GbpSv) - - C:\ARQUIV~1\GbPlugin\GbpSv.exe
O23 - Service: MySQL - Unknown owner - C:\Arquivos.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe
--
End of file - 4735 bytes
Não removido:
[?] - O23 - Service: MySQL - Unknown owner - C:\Arquivos.exe (file missing)
Por tratar-se de um serviço, o MySQL, o qual o HijackThis não o reconhece como legítimo.
Combofix:
ComboFix 09-05-25.A2 - WinXP 26/05/2009 11:36.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.255.126 [GMT -3:00]
Executando de: c:\documents and settings\WinXP\Desktop\ComboFix.exe
.
(((((((((((((((( Arquivos/Ficheiros criados de 2009-04-26 to 2009-05-26 ))))))))))))))))))))))))))))
.
2009-04-30 00:17 . 2009-04-30 00:17 95 ----a-w c:\documents and settings\All Users\Dados de aplicativos\Last.fm\Client\uninst2.bat
2009-04-30 00:17 . 2009-04-30 00:17 -------- d-----w c:\documents and settings\All Users\Dados de aplicativos\Last.fm
2009-04-30 00:17 . 2009-04-30 00:17 683801 ----a-w c:\documents and settings\All Users\Dados de aplicativos\Last.fm\Client\UninstWA\unins000.exe
2009-04-30 00:15 . 2009-04-30 00:15 -------- d-----w c:\arquivos de programas\Last.fm
.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-25 23:45 . 2008-08-30 16:33 26228 ---ha-w c:\windows\system32\mlfcache.dat
2009-05-21 23:02 . 2008-08-05 21:17 -------- d-----w c:\documents and settings\WinXP\Dados de aplicativos\BrOffice.org2
2009-05-21 23:01 . 2008-08-05 21:18 1 ----a-w c:\documents and settings\WinXP\Dados de aplicativos\BrOffice.org2\user\uno_packages\cache\stamp.sys
2009-05-17 03:15 . 2009-03-21 16:18 -------- d-----w c:\arquivos de programas\Google
2009-05-01 13:01 . 2008-08-20 17:41 -------- d-----w c:\arquivos de programas\eMule
2009-04-26 12:44 . 2008-08-04 15:55 -------- d-----w c:\arquivos de programas\Windows Live
2009-04-26 12:42 . 2001-10-28 18:07 67290 ----a-w c:\windows\system32\perfc016.dat
2009-04-26 12:42 . 2001-10-28 18:07 425512 ----a-w c:\windows\system32\perfh016.dat
2009-03-24 21:33 . 2009-03-24 21:33 237264 ----a-w c:\documents and settings\WinXP\Dados de aplicativos\Mozilla\plugins\npgoogletalk.dll
2009-03-10 00:40 . 2009-03-10 00:40 91136 --sha-r c:\windows\system32\okvnnnt.dll
2008-08-26 14:02 . 2008-08-26 14:02 16 --sh--w c:\arquivos de programas\winmaq32.dll
2009-05-26 14:13 . 2009-02-11 03:01 32768 ----a-w c:\arquivos de programas\mozilla firefox\plugins\MsnChat40pt-br.dll
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\arquivos de programas\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360]
c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\
Monitor Apache Servers.lnk - c:\arquivos de programas\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe [2008-12-9 41042]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginBb]
2009-01-21 17:22 413488 ------w c:\arquivos de programas\GbPlugin\gbieh.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"MIDI1"= SYNCOR11.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Adobe LM Service"=3 (0x3)
"WZCSVC"=2 (0x2)
"WebClient"=2 (0x2)
"usnjsvc"=3 (0x3)
"TrkWks"=2 (0x2)
"TapiSrv"=3 (0x3)
"stisvc"=2 (0x2)
"SSDPSRV"=3 (0x3)
"SharedAccess"=2 (0x2)
"SENS"=2 (0x2)
"RemoteRegistry"=2 (0x2)
"RasMan"=3 (0x3)
"PolicyAgent"=2 (0x2)
"Nla"=3 (0x3)
"lanmanworkstation"=2 (0x2)
"lanmanserver"=2 (0x2)
"helpsvc"=2 (0x2)
"FastUserSwitchingCompatibility"=3 (0x3)
"EventSystem"=3 (0x3)
"Browser"=2 (0x2)
"xmlprov"=3 (0x3)
"WmiApSrv"=3 (0x3)
"VSS"=3 (0x3)
"UPS"=3 (0x3)
"SysmonLog"=3 (0x3)
"SwPrv"=3 (0x3)
"SCardSvr"=3 (0x3)
"RSVP"=3 (0x3)
"RDSessMgr"=3 (0x3)
"RasAuto"=3 (0x3)
"NtLmSsp"=3 (0x3)
"Netlogon"=3 (0x3)
"MSIServer"=3 (0x3)
"MSDTC"=3 (0x3)
"mnmsrvc"=3 (0x3)
"IrService"=2 (0x2)
"gupdate1c9aa40a7c2745c"=2 (0x2)
"FirebirdServerDefaultInstance"=3 (0x3)
"dmadmin"=3 (0x3)
"COMSysApp"=3 (0x3)
"clr_optimization_v2.0.50727_32"=3 (0x3)
"CiSvc"=3 (0x3)
"aspnet_state"=3 (0x3)
"AppMgmt"=3 (0x3)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Arquivos de programas\\MSN Messenger\\msnmsgr.exe"=
"c:\\Arquivos de programas\\MSN Messenger\\livecall.exe"=
"c:\\Arquivos de programas\\eMule\\emule.exe"=
"d:\\--==[ClubeChat]==--\\ClubeChaT.exe"=
"c:\\Arquivos de programas\\Apache Software Foundation\\Apache2.2\\bin\\httpd.exe"=
"c:\\Documents and Settings\\WinXP\\Configurações locais\\Dados de aplicativos\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\WinXP\\Configurações locais\\Dados de aplicativos\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
R0 GbpKm;Gbp KernelMode;c:\windows\system32\drivers\gbpkm.sys [05/03/2009 19:54 31536]
R2 Apache2.2;Apache2.2;c:\arquivos de programas\Apache Software Foundation\Apache2.2\bin\httpd.exe [09/12/2008 23:10 24636]
R2 GbpSv;Gbp Service;c:\arquiv~1\GbPlugin\GbpSv.exe [05/03/2009 19:54 53040]
S2 IrService;Center Image;c:\windows\system32\svchost.exe -k netsvcs [28/10/2001 15:07 14336]
S4 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;"c:\arquivos de programas\Firebird\Firebird_2_1\bin\fbserver.exe" -s DefaultInstance --> c:\arquivos de programas\Firebird\Firebird_2_1\bin\fbserver.exe [?]
S4 gupdate1c9aa40a7c2745c;Google Update Service (gupdate1c9aa40a7c2745c);c:\arquivos de programas\Google\Update\GoogleUpdate.exe [21/03/2009 13:18 133104]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
IrService
.
Conteúdo da pasta 'Tarefas Agendadas'
2009-05-26 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\arquivos de programas\Google\Update\GoogleUpdate.exe [2009-03-21 16:18]
.
- - - - ORFÃOS REMOVIDOS - - - -
SafeBoot-procexp90.Sys
.
------- Scan Suplementar -------
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = local
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {DB6BF2CD-4F59-4F1C-AA9C-D08C0B61A931} - hxxps://www14.bancobrasil.com.br/plugin/GbpDist.cab
FF - ProfilePath - c:\documents and settings\WinXP\Dados de aplicativos\Mozilla\Firefox\Profiles\5ihcg3xz.default\
FF - component: c:\documents and settings\WinXP\Dados de aplicativos\Mozilla\Firefox\Profiles\5ihcg3xz.default\extensions\{87F8774F-B485-47E2-A755-A40A8A5E886C}\components\GbMzhBb.dll
FF - component: c:\documents and settings\WinXP\Dados de aplicativos\Mozilla\Firefox\Profiles\5ihcg3xz.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - plugin: c:\arquivos de programas\Google\Update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\arquivos de programas\Mozilla Firefox\plugins\NPPGWrap.dll
FF - plugin: c:\documents and settings\WinXP\Dados de aplicativos\Mozilla\plugins\npgoogletalk.dll
---- FIREFOX POLICIES ----
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-26 11:38
Windows 5.1.2600 Service Pack 2 NTFS
Procurando processos ocultos ...
Procurando entradas auto inicializáveis ocultas ...
Procurando ficheiros/arquivos ocultos ...
Varredura completada com sucesso
arquivos/ficheiros ocultos: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]
"ImagePath"="\"c:\arquivos de programas\MySQL\MySQL Server 5.1\bin\mysqld\" --defaults-file=\"c:\arquivos de programas\MySQL\MySQL Server 5.1\my.ini\" MySQL"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\IrService]
"ServiceDll"="c:\windows\system32\okvnnnt.dll"
.
--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------
- - - - - - - > 'winlogon.exe'(636)
c:\arquivos de programas\GbPlugin\gbieh.dll
- - - - - - - > 'explorer.exe'(3440)
c:\arquivos de programas\GbPlugin\gbieh.dll
c:\windows\system32\msi.dll
.
Tempo para conclusão: 2009-05-26 11:46
ComboFix-quarantined-files.txt 2009-05-26 14:46
Pré-execução: 13 pasta(s) 33,064,148,992 bytes disponíveis
Pós execução: 12 pasta(s) 32,972,431,360 bytes disponíveis
161
Registros estranhos ou de softwares que não existem mais:
S4 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;"c:\arquivos de programas\Firebird\Firebird_2_1\bin\fbserver.exe" -s DefaultInstance --> c:\arquivos de programas\Firebird\Firebird_2_1\bin\fbserver.exe [?]
Não uso mais Firebird faz mais de meio ano, inclusive faz algum tempo que o removi.
Obrigado,
This topic is locked
