segurança Ajudem

[dorgido 0]

Olá gente estou com 1 probleminha com virus fiz 1 scan no bitdefender e detectou 2 virus analisem meu log e digam oque eu posso fazer para remove-los

 

QuickScan 32-bit v0.9.9.103

---------------------------

Data da análise: Sat Jan 14 15:40:38 2012

ID da máquina: 9296F5A5

 

 

 

2 arquivos infectados encontrados!

----------------------------------

 

c:\windows\system32\oyucumxm.dll --> Trojan.Generic.7114242

--> HKLM\Software\Classes\CLSID\{765A6E0E-1118-9AE2-487A-640AD52F4049}\InprocServer32\"(default)"

--> HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{765A6E0E-1118-9AE2-487A-640AD52F4049}

--> HKLM\System\ControlSet001\services\qayywknx

--> HKLM\System\ControlSet002\services\qayywknx

--> Processo explorer.exe (1908)

--> Processo firefox.exe (3656)

 

C:\Windows\System32\Drivers\dfsc.sys --> Gen:Variant.Graftor.12678

--> HKLM\System\ControlSet001\services\DfsC

--> HKLM\System\ControlSet002\services\DfsC

 

 

 

Processos

---------

Claro.exe 2580 C:\Program Files\Claro\Claro.exe

Firefox 3656 C:\Program Files\Mozilla Firefox\firefox.exe

Firefox 2460 C:\Program Files\Mozilla Firefox\plugin-container.exe

Firefox 3308 C:\Program Files\Mozilla Firefox\plugin-container.exe

Huawei Technologies Co., Ltd. DataCardM 348 C:\ProgramData\DatacardService\DCSHelper.exe

Microsoft Security Client 2484 C:\Program Files\Microsoft Security Client\msseces.exe

Microsoft® Windows® Operating System 3228 C:\Windows\System32\wuauclt.exe

openvpntray.exe 3816 C:\Program Files\Hotspot Shield\bin\openvpntray.exe

ouc.exe 2596 C:\Users\CRISTIANE\AppData\Roaming\Claro\ouc.exe

Sistema operacional Microsoft® Windows® 1908 C:\Windows\explorer.exe

Windows Live Messenger 2504 C:\Program Files\Windows Live\Messenger\msnmsgr.exe

(verificado) GrooveMonitor Utility 2492 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

(verificado) Sistema Operacional Microsoft® Windows® 1884 C:\Windows\System32\dwm.exe

(verificado) Sistema Operacional Microsoft® Windows® 1800 C:\Windows\System32\taskhost.exe

 

 

 

 

Autoruns e arquivos críticos

----------------------------

Claro.exe C:\Program Files\Claro\Claro.exe

GrooveShellExtensions Module C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

Microsoft Security Client C:\Program Files\Microsoft Security Client\msseces.exe

ouc.exe C:\Program Files\Claro\UpdateDog\ouc.exe

Windows Live Messenger C:\Program Files\Windows Live\Messenger\msnmsgr.exe

(verificado) GrooveMonitor Utility C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

(verificado) Sistema Operacional Microsoft® Windows® c:\windows\system32\userinit.exe

 

 

Plugins do navegador

--------------------

BitDefender QuickScan C:\Users\CRISTIANE\AppData\Roaming\Mozilla\Firefox\Profiles\4uv1onv0.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll

GrooveShellExtensions Module C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

hssie.dll c:\program files\hotspot shield\hssie\hssie.dll

Nexon Game Controller C:\ProgramData\NexonUS\NGM\npNxGameUS.dll

NPSWF32.dll C:\Windows\system32\Macromed\Flash\NPSWF32.dll

oyucumxm.dll c:\windows\system32\oyucumxm.dll

Silverlight Plug-In c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll

Windows® Internet Explorer C:\Windows\System32\ieframe.dll

(verificado) AcroIEHelperShim Library c:\program files\common files\adobe\acrobat\activex\acroiehelpershim.dll

(verificado) Microsoft® Windows Live Login Helper c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll

(verificado) Microsoft® Windows® Operating System C:\Windows\System32\winrnr.dll

(verificado) mswsock.dll C:\Windows\system32\mswsock.dll

(verificado) Sistema Operacional Microsoft® Windows® C:\Windows\system32\napinsp.dll

(verificado) Sistema Operacional Microsoft® Windows® C:\Windows\system32\pnrpnsp.dll

 

 

Análise

-------

MD5: 26384b8b6166399ec5b33f91c2450518 C:\Program Files\Claro\AddrBookPlugin.dll

MD5: 219f5d167987d6bf23e0f67036b4689a C:\Program Files\Claro\AddrBookUIPlugin.dll

MD5: 9e7f44ea06c9315fdf70f8283d1e33fe C:\Program Files\Claro\atcomm.dll

MD5: fd3103bd1f46a173c9e97dc479b4909d C:\Program Files\Claro\Claro.exe

MD5: 7db160912e7e610b2d46c0682584f13e C:\Program Files\Claro\ConfigFilePlugin.dll

MD5: ddc3d2ca3e5e1ce4554e0e150161150b C:\Program Files\Claro\Container.dll

MD5: 9d9a1992c526c2668a0da83f00de764e C:\Program Files\Claro\DetectDev.dll

MD5: ce4c178a5d1f673fb4e8b5973e8176fd C:\Program Files\Claro\DeviceMgrPlugin.dll

MD5: eb73e4819a4c3fe0be66ec18d26ded6a C:\Program Files\Claro\DeviceMgrUIPlugin.dll

MD5: 6f414841103007b7247fe1a63c8c6ad7 C:\Program Files\Claro\DeviceOperate.dll

MD5: afe15d99f87959b12157baac5d7ee7bb C:\Program Files\Claro\DialUpPlugin.dll

MD5: 395e2142a5daea53d61f76fe4c565ca1 C:\Program Files\Claro\DialupUIPlugin.dll

MD5: 8636338523933065e547d2c648ae339d C:\Program Files\Claro\FileManager.dll

MD5: 28a5dc01992d01a2006fd72b869e2691 C:\Program Files\Claro\isaputrace.dll

MD5: 29dec34ec2c7300e601fe34336055acb C:\Program Files\Claro\LiveUpdateInterface.dll

MD5: bc41030451b222489ced28600376ad61 C:\Program Files\Claro\LocaleMgrPlugin.dll

MD5: fa0653be0eec41ae34cd51ad550c7018 C:\Program Files\Claro\MenuMgrPlugin.dll

MD5: a0d3d76de998dd2540a205b5f944a9b4 C:\Program Files\Claro\NDISAPI.dll

MD5: 5fbe79e88359d718651b016b47d7f35d C:\Program Files\Claro\NDISPlugin.dll

MD5: 3623c5833f31ba53c84ba9f795e6336d C:\Program Files\Claro\NetConnectPlugin.dll

MD5: 9618e4c5097d910326c07e48ca184087 C:\Program Files\Claro\NetInfoPlugin.dll

MD5: 088033a0792d89b95d5d2a9e80bad4c7 C:\Program Files\Claro\NotifyServicePlugin.dll

MD5: 1a85bcaaeb83e7dec1ef30c69c5a9444 C:\Program Files\Claro\SkinMagicU.dll

MD5: cf9eea56e04455c55a9cf0677efc9040 C:\Program Files\Claro\SMSPlugin.dll

MD5: fe81ebe64db0bbf2380e81e949ae46d8 C:\Program Files\Claro\SMSUIPlugin.dll

MD5: 6fd572622a44e195cdaea906dbc3df62 C:\Program Files\Claro\StatusBarMgrPlugin.dll

MD5: 2c2e0d4871ddc66b3e8d025d97e4508c C:\Program Files\Claro\ToolBarMgrPlugin.dll

MD5: aaf84b7dfdfdb61aec07bb20f53a3e94 C:\Program Files\Claro\TracePlugin.dll

MD5: 98b31cbc09d671dadeb7c92aef1cbe29 C:\Program Files\Claro\UpdateDog\ouc.exe

MD5: b67d752d7777aa3ef3ec42c67767b234 C:\Program Files\Claro\XCodec.dll

MD5: 76f6f7dc7a43ecea5557d2596e6f0f3d C:\Program Files\Claro\XFramePlugin.dll

MD5: a328a46d87bb92ce4d8a4528e9d84787 C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

MD5: 6b1dc08d22231c9e508a715f07fce7fb C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE

MD5: 564bab77cd96ce0e3fd5bbcdded142df C:\Program Files\Hotspot Shield\bin\hsswd.exe

MD5: 037fc5e0c45da0764efa199e00fd5ba5 C:\Program Files\Hotspot Shield\bin\lang\gui-eng.dll

MD5: 44452f7a09d00573dc6e714874257cc9 C:\Program Files\Hotspot Shield\bin\openvpnas.exe

MD5: 44c528f5fb662ab74fdfae1688ef35c6 C:\Program Files\Hotspot Shield\bin\openvpntray.exe

MD5: dd56e3271d8d63d655454b3f5c0f5c01 c:\program files\hotspot shield\hssie\hssie.dll

MD5: 2cfea9c337b699aca38487e8a7438f35 C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe

MD5: fd67bab137c3a27d0418baf1bd78fe2e C:\Program Files\Microsoft Office\Office12\GrooveUtil.DLL

MD5: 0ef5a9073dd4bf47dd7c340749d56b14 C:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll

MD5: 12b9c4fa0d4735a1873fed4083b75748 C:\Program Files\Microsoft Security Client\Antimalware\MpClient.Dll

MD5: cfce43b70ca0cc4dcc8adb62b792b173 c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

MD5: a5cb074f34bbd89948e34a630d459c0c c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

MD5: 96e6931ecc73b103b1a00a84416dada9 C:\Program Files\Microsoft Security Client\EppManifest.dll

MD5: d0ebe8f93c70fca792e241ce268bc837 C:\Program Files\Microsoft Security Client\msseces.exe

MD5: ce6db25ffa35fd051c503f11db745862 c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll

MD5: cf60ab7b8b6710d8fb6e2561d8cfb38f C:\Program Files\Mozilla Firefox\components\browsercomps.dll

MD5: d102c2ce49f176a76cbe5bef4573f0fa C:\Program Files\Mozilla Firefox\extensions\[email protected]\components\afurladvisor90.dll

MD5: 11cca710674739e3db8f7450a5b650b6 C:\Program Files\Mozilla Firefox\firefox.exe

MD5: 87fe7afbf52ef4ffb15536e5db8055b3 C:\Program Files\Mozilla Firefox\freebl3.dll

MD5: c506b249c1dccb4f501b1fa40f86378a C:\Program Files\Mozilla Firefox\mozalloc.dll

MD5: 3a3b3053cf68edd6b6d9413e0bc4a595 C:\Program Files\Mozilla Firefox\mozjs.dll

MD5: b4c9ca30e7a6c113e4c05eba214626d0 C:\Program Files\Mozilla Firefox\mozsqlite3.dll

MD5: 79edfc335aea6a3a7d4c1d20c3c9432a C:\Program Files\Mozilla Firefox\mozutils.dll

MD5: e9ba5ae52561b8f96e4bdc5706d10e5c C:\Program Files\Mozilla Firefox\nspr4.dll

MD5: 661347d17b175939accf63a8ff6404c0 C:\Program Files\Mozilla Firefox\nss3.dll

MD5: a6cf050b542c949b0208a0669287f7a2 C:\Program Files\Mozilla Firefox\nssckbi.dll

MD5: 7bb247a365f0b50292446299835c7d5d C:\Program Files\Mozilla Firefox\nssdbm3.dll

MD5: 0c6bfbb3715254dbc1b28cdda406e670 C:\Program Files\Mozilla Firefox\nssutil3.dll

MD5: 9d705f101657633ce52b194a68b9fbad C:\Program Files\Mozilla Firefox\plc4.dll

MD5: 74395aeefcf091f6b03cf6d04330b1ef C:\Program Files\Mozilla Firefox\plds4.dll

MD5: 0619c9e7a3682c54bd226a831897cd06 C:\Program Files\Mozilla Firefox\plugin-container.exe

MD5: 29e7bd8b61184602a20f14a50b54c6ad C:\Program Files\Mozilla Firefox\smime3.dll

MD5: 97ef26a108e601128762e7c9bc09b80c C:\Program Files\Mozilla Firefox\softokn3.dll

MD5: 76f92c677c3dc3afcb441c2270f137fc C:\Program Files\Mozilla Firefox\ssl3.dll

MD5: 23777bb7976557948825e96e853d77e9 C:\Program Files\Mozilla Firefox\xpcom.dll

MD5: a66ab262a8f0715037ce3cceca984a39 C:\Program Files\Mozilla Firefox\xul.dll

MD5: b498a14133bd09ad0817590ace4470ad C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

MD5: 77fbd400984cf72ba0fc4b3489d65f74 C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5: 06602aac468bfacd8e5344db0ae3ddd3 C:\ProgramData\DatacardService\DCSHelper.exe

MD5: e956c0614367d4106a4411f151d494a5 C:\ProgramData\DatacardService\HWDeviceService.exe

MD5: a69630d039c38018689190234f866d77 c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{190FA45D-185E-4EDB-979A-37242DE19299}\MpKslc8cb506a.sys

MD5: a69630d039c38018689190234f866d77 c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{190FA45D-185E-4EDB-979A-37242DE19299}\MpKslfc09408e.sys

MD5: 6d657abadf217dbb17cf0a0af44a7e29 C:\ProgramData\NexonUS\NGM\npNxGameUS.dll

MD5: 98b31cbc09d671dadeb7c92aef1cbe29 C:\Users\CRISTIANE\AppData\Roaming\Claro\ouc.exe

MD5: 8aa2ee43e12639c23f7102b87d10e9a8 C:\Users\CRISTIANE\AppData\Roaming\Mozilla\Firefox\Profiles\4uv1onv0.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll

MD5: 5f3bdb02d64443efca7dd9248619c962 C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll

MD5: 225e83f591113adec764afba0ab12593 C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll

MD5: cb44e805bb7c0c9bc3b8a66a59bb300a C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll

MD5: 0a58da99321d95944e796541a716cbf5 C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll

MD5: ea93d50a341350321c96208f651408d0 C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

MD5: 61490bbf4d7c399bd42af6b63960fb92 C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll

MD5: 267aff1ea665dbe422276601989efff3 C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll

MD5: 792fc8e77dc71a5f095c32d3a5c78ea1 C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll

MD5: 84cb9832f03a6aa1929636f5d9e7e298 C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll

MD5: 3927fdfe073338428a24160e427e87a3 C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

MD5: 56b798396b5ad9fb064528b638a6008f C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll

MD5: 77895ba5c5cdcfef66419a03b6a4cdad C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

MD5: 88955bce0a301ca342562be24415d9cc C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll

MD5: 308823c5a58a4022fedd8f4db3f99a25 C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

MD5: 75959d7e5ef8fd7e7e17f40f63f3cc66 C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll

MD5: 2ff5b43393e8f2c46135ac33e842b076 C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll

MD5: a5750894aefe1d57cf8c460ea4065748 C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

MD5: b3758364d42bbdba18383f010fb7cfcd C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

MD5: 20f76c488929b6288733888bffe62f65 C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

MD5: 11e5a68a159bf13bcf0538bec894e0ce C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll

MD5: 5cccf830959345f0b8bcc2a0dfac11b5 C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

MD5: daef44b6ff4aec4533bab3761310d4a5 C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll

MD5: 62ad339f7420b022509edac1d9fd7ba1 C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll

MD5: c13d2932297d3597fea7b6902efc117d C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

MD5: cdc1f7b46fc7b0b8c88df0cfbda2eb2c C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

MD5: 69ac43aae61eec7625726b377ccaaa13 C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll

MD5: 5710b9bd7a3e4f716402b8119004eb48 C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll

MD5: a2903ece1d115fea38bb07e01c122b5e C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll

MD5: fabfc817547eabb19b74849cef410622 C:\Windows\system32\authui.dll

MD5: 7c5567a00456f3a3a07800ebb3f351c4 C:\Windows\system32\d2d1.dll

MD5: c5f549970ac071ea452e58b6422c94fa C:\Windows\system32\d3d10_1.dll

MD5: 029e2a480ce2020df097e535a2311712 C:\Windows\system32\d3d10_1core.dll

MD5: 524408d5127f14b71e574d80f2f0924f C:\Windows\system32\D3D10Warp.dll

MD5: 62390f4ace9e2b63e3ca26b7f7497897 C:\Windows\system32\dnsapi.dll

MD5: b15be77a2bacf9c3177d27518afe26a9 C:\Windows\System32\dnsrslvr.dll

MD5: 0db7a48388d54d154ebec120461a0fcd C:\Windows\system32\drivers\afd.sys

MD5: 9a5c671b7fbae4865149bb11f59b91b2 C:\Windows\system32\DRIVERS\bowser.sys

MD5: 36c252e474b2ffa0f0fbbff20d92a640 C:\Windows\System32\Drivers\cng.sys

MD5: 4bbabdb03b7bfedf6975c85e45621e67 C:\Windows\System32\Drivers\dfsc.sys

MD5: c94b6c3cc628179cb9b9061c19888b99 C:\Windows\System32\drivers\dxgkrnl.sys

MD5: 57c171ea22f0a7f068fcb0caedd1e8e7 C:\Windows\system32\DRIVERS\ew_hwusbdev.sys

MD5: bed3a9f86a637cc6c2c5296cd82423d8 C:\Windows\system32\DRIVERS\ew_jubusenum.sys

MD5: b93f069ecdf7449eaac5b887d59a23d1 C:\Windows\system32\DRIVERS\ew_jucdcacm.sys

MD5: 4f28652ec514fa1ba473bc1a695a5c98 C:\Windows\system32\DRIVERS\HssDrv.sys

MD5: 0263364acb9c834ace52fb85c2c064ec C:\Windows\System32\Drivers\ksecdd.sys

MD5: 27391db553be2a4e2b0adeea2873b2af C:\Windows\System32\Drivers\ksecpkg.sys

MD5: fee0baded54222e9f1dae9541212aab1 C:\Windows\system32\DRIVERS\MpFilter.sys

MD5: 2c3489660d4a8d514c123c3f0d67df46 C:\Windows\system32\DRIVERS\MpNWMon.sys

MD5: ca7570e42522e24324a12161db14ec02 C:\Windows\system32\DRIVERS\mrxsmb.sys

MD5: f965c3ab2b2ae5c378f4562486e35051 C:\Windows\system32\DRIVERS\mrxsmb10.sys

MD5: 25c38264a3c72594dd21d355d70d7a5d C:\Windows\system32\DRIVERS\mrxsmb20.sys

MD5: 7b01c6172cfd0b10116175e09200d4b4 C:\Windows\system32\DRIVERS\NisDrvWFP.sys

MD5: 7dfd48e24479b68b258d8770121155a0 C:\Windows\system32\DRIVERS\Rt86win7.sys

MD5: c4a027b8c0bd3fc0699f41fa5e9e0c87 C:\Windows\System32\DRIVERS\srv.sys

MD5: 414bb592cad8a79649d01f9d94318fb3 C:\Windows\System32\DRIVERS\srv2.sys

MD5: ff207d67700aa18242aaf985d3e7d8f4 C:\Windows\System32\DRIVERS\srvnet.sys

MD5: 56c198ac82efa622dd93e9e43575f79c C:\Windows\System32\drivers\tcpip.sys

MD5: 60cc965a89e2072ebd26d63d5e1e1d18 C:\Windows\system32\dwmcore.dll

MD5: c0523fe101a30e3821604fe1ca1740d7 C:\Windows\system32\DWrite.dll

MD5: 8898c95862d03d16b2a06db4db6bb6b2 C:\Windows\system32\EXPLORERFRAME.dll

MD5: 151258fc2ec8c48bdf8a53350ae0a676 C:\Windows\system32\FntCache.dll

MD5: 691e93028b8723e05b4a637be77380dd C:\Windows\System32\ieframe.dll

MD5: 1416ab557be700fa117323b6b8f32882 C:\Windows\system32\iertutil.dll

MD5: c351f62a539d8725f7ef3216a3cd6b3b C:\Windows\system32\igd10umd32.dll

MD5: c6595b078842e187c6587a285b43a565 C:\Windows\system32\inetcomm.dll

MD5: 7e99a20c758abb5ae89c7aeea3a9aeb2 C:\Windows\system32\kernel32.dll

MD5: acf24c46a6eada7621940d8f2511f906 C:\Windows\system32\KERNELBASE.dll

MD5: c2243ff9e9aad0c30e8b1a0914da15b6 C:\Windows\System32\lsass.exe

MD5: de3745a51b7ac7fedc356a83f76c8023 C:\Windows\system32\Macromed\Flash\NPSWF32.dll

MD5: 74c76bb54b26ce50c4bc755f92687c63 C:\Windows\system32\MFC42.dll

MD5: 66c0aee61d1c5c35bf1b4642a153b114 C:\Windows\System32\mshtml.dll

MD5: 35aae2e841aa1a949775168e119482c9 C:\Windows\system32\msls31.dll

MD5: 420db712b24607220c11fc08a9f9371c C:\Windows\System32\NLSData0416.dll

MD5: 9131fe60adfab595c8da53ad6a06aa31 C:\Windows\system32\npptNT2.sys

MD5: 2e92b666a7cc8af174d4445be8fdb0ed C:\Windows\SYSTEM32\ntdll.dll

MD5: 5764c381949147ebcfb9a7134e2abf06 C:\Windows\system32\ODBC32.dll

MD5: e2c2d8c982316c8abf800c6ce3f28fab C:\Windows\system32\ole32.dll

MD5: 4d59a5b6ef0af6f9fdf3d157534380af C:\Windows\system32\oleacc.dll

MD5: 705c210efc5564be49eb026bd7aff27a C:\Windows\system32\OLEAUT32.dll

MD5: 97fdbfb689eeaeaef7f4341dc041171c c:\windows\system32\oyucumxm.dll

MD5: 2862a3819bbc9757dd27bac41a4e0a3e C:\Windows\System32\pnidui.dll

MD5: b9980fcd160d1ec1422b111c74b56db2 C:\Windows\system32\quartz.dll

MD5: 83041697ae93aa4b783ae8746904edd2 C:\Windows\system32\schannel.DLL

MD5: df1e5c82e4d09cf8105cc644980c4803 C:\Windows\system32\schedsvc.dll

MD5: b4c246937bdb3e50b24698ee811074bf C:\Windows\system32\Secur32.dll

MD5: d1bb750eb51694de183e08b9c33be5b2 C:\Windows\System32\spoolsv.exe

MD5: 4c287f9069fedbd791178876ee9de536 C:\Windows\system32\sppsvc.exe

MD5: 8f6bf790d3168224c16f2af68a84438c C:\Windows\system32\srvsvc.dll

MD5: 361bf6f1988f4effdb9bf6747d530015 C:\Windows\system32\SspiCli.dll

MD5: 8d908f346eedd752005a32787a6dcafa C:\Windows\System32\StructuredQuery.dll

MD5: 8c7fe6b9559204765849bff308764fa5 C:\Windows\System32\SyncCenter.dll

MD5: 04105c8da62353589c29bdaeb8d88bd8 C:\Windows\system32\sysmain.dll

MD5: 25819a6361f10c30905b5d0fdb8dca42 C:\Windows\system32\t2embed.dll

MD5: 21012407e8c74aa72bbb485b0fc197fe C:\Windows\system32\taskschd.dll

MD5: 71def5ec79774c798342d0ea16e41780 C:\Windows\system32\umpnpmgr.dll

MD5: 814638f572f497d96b17bf254113d9a4 C:\Windows\system32\urlmon.dll

MD5: 7790b77fe1e5ee47dcc66247095bb4c9 C:\Windows\system32\wbengine.exe

MD5: 02f98b5c0e397ad06124d84428cf8f1a C:\Windows\system32\wininet.dll

MD5: b0da80ff42a0819d162a86612896aaf2 C:\Windows\System32\wuauclt.exe

MD5: a33408cc036f9c08142b11be5e93f0a1 C:\Windows\system32\wuaueng.dll

MD5: f6ad68cc45f5630a01ac4178cef10384 C:\Windows\system32\wucltux.dll

MD5: 2b3d64e795f6080e02cfcd9b8553ae2f C:\Windows\system32\wups2.dll

MD5: d3ead1cf16ba729a7f7c9a5d94aa7c05 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7600.16661_none_ebfb56996c72aefc\comctl32.dll

MD5: 4b8dd8541c0e26602005dd0137333615 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll

 

Os seguintes arquivos devem ser carregados para análise do lado do servidor:

C:\Windows\System32\Drivers\dfsc.sys

 

O carregamento iniciou - 1 arquivos(s)

dfsc.sys (78336)

Velocidade de carregamento - 6 KB/s

Carregamento finalizou - 1 carregado, 0 falhou

 

Fim da Análise - a comunicação levou 13 seg

Tráfego Total - 0.09 MB enviados, 0.84 KB receb

Analisados 756 arquivos e módulos - 329 segundos

 

==============================================================================

 

[raizen12 8]

Faça um scan com seu anti-vírus, ele mesmo fará o processo de remoção de acordo com o que você desejar, as opções serão mostradas pelo anti-virus.

[dorgido 0]

Já fiz 1 scan o problema é que

C:\Windows\System32\Drivers\dfsc.sys --> Gen:Variant.Graftor.12678

--> HKLM\System\ControlSet001\services\DfsC

--> HKLM\System\ControlSet002\services\DfsC

 

dfcs.sys é 1 arquivo critico do sistema e a unica opção oferecida é Ignorar eu uso karpeksy então ...

 

c:\windows\system32\oyucumxm.dll --> Trojan.Generic.7114242

--> HKLM\Software\Classes\CLSID\{765A6E0E-1118-9AE2-487A-640AD52F4049}\InprocServer32\"(default)"

--> HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects\{765A6E0E-1118-9AE2-487A-640AD52F4049}

--> HKLM\System\ControlSet001\services\qayywknx

--> HKLM\System\ControlSet002\services\qayywknx

--> Processo explorer.exe (1908)

--> Processo firefox.exe (3656)

Esse arquivo é 1 turkojan mais acho q já consegui me livrar dele ...