segurança Possivel Virus ! Ajuda.

[- Darkness 0]

Ola pessoal, recentemente estava olhando os processos do meu pc e me deparei com 3 arquivos estranhas, segue o nome deles : ixplore.exe ixplore.exe ixplore.exe , sim todos iguais, pensei que seria o internet explorer mais tentei finalizar o processo e ele sempre voltava. Peço ajuda de vocês se possivel para me ajudar a remover o virus.

Se precisar segue o log :

 

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 18:27:04, on 02/05/2013

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v9.00 (9.00.8112.16476)

Boot mode: Normal

 

Running processes:

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe

C:\Program Files\VIA\VIAudioi\VDeck\viaaud.exe

C:\Program Files\Yuna Software\Messenger Plus!\PlusService.exe

C:\Program Files\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

C:\Users\PC Vitor\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\PC Vitor\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\PC Vitor\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\PC Vitor\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe

C:\Users\PC Vitor\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\PC Vitor\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\PC Vitor\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\PC Vitor\Desktop\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

É necessário se cadastrar para acessar o conteúdo.

• Entre
• ou
• Cadastre-se

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

É necessário se cadastrar para acessar o conteúdo.

• Entre
• ou
• Cadastre-se

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

É necessário se cadastrar para acessar o conteúdo.

• Entre
• ou
• Cadastre-se

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

É necessário se cadastrar para acessar o conteúdo.

• Entre
• ou
• Cadastre-se

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

É necessário se cadastrar para acessar o conteúdo.

• Entre
• ou
• Cadastre-se

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

É necessário se cadastrar para acessar o conteúdo.

• Entre
• ou
• Cadastre-se

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL =

É necessário se cadastrar para acessar o conteúdo.

• Entre
• ou
• Cadastre-se

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

É necessário se cadastrar para acessar o conteúdo.

• Entre
• ou
• Cadastre-se

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: Complitly - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Users\PC Vitor\AppData\Roaming\Complitly\Complitly.dll (file missing)

O2 - BHO: CrossriderApp0002258 - {11111111-1111-1111-1111-110011221158} - C:\Program Files\I Want This\I Want This.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (file missing)

O2 - BHO: FindLyrics - {44C9CC91-6A4A-4579-B4B5-899ECDC18DC6} - C:\Program Files\FindLyrics\FindLyrics.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll

O2 - BHO: DataMngr - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~1\WIA6EB~1\Datamngr\BROWSE~1.DLL

O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll

O2 - BHO: Help the General-Search Project - {CA4520F3-AE13-4FB1-A513-58E23991C86D} - C:\Users\PCVITO~1\AppData\Roaming\MEDIAF~1\EXTENS~1\GENCRA~1.DLL

O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

O3 - Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - (no file)

O3 - Toolbar: aTube Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)

O3 - Toolbar: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll

O3 - Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (file missing)

O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe -r

O4 - HKLM\..\Run: [VIAAUD] C:\Program Files\VIA\VIAudioi\VDeck\VIAAUD.exe

O4 - HKLM\..\Run: [switchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O4 - HKLM\..\Run: [PlusService] C:\Program Files\Yuna Software\Messenger Plus!\PlusService.exe

O4 - HKLM\..\Run: [DATAMNGR] C:\PROGRA~1\WIA6EB~1\Datamngr\DATAMN~1.EXE

O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [LogMeIn Hamachi Ui] "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start

O4 - HKLM\..\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [VDownloader] C:\Program Files\VDownloader\VDownloader.exe /silent

O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

O4 - HKCU\..\Run: [speedBitVideoAccelerator] "C:\Program Files\SpeedBit Video Accelerator\VideoAccelerator.exe" /startup

O4 - HKCU\..\Run: [Google Update] "C:\Users\PC Vitor\AppData\Local\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [Media Finder] "C:\Program Files\Media Finder\MF.exe" /opentotray

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [sandboxieControl] "C:\Program Files\Sandboxie\SbieCtrl.exe"

O4 - HKCU\..\Run: [Clownfish] "C:\Program Files\Clownfish\Clownfish.exe"

O4 - HKCU\..\Run: [PCAccelerate] C:\Program Files\PC Accelerate\PCAccelerate.exe

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun

O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED

O4 - HKCU\..\Run: [GameTracker] C:\Program Files\GameTracker\GTLite.exe

O4 - HKCU\..\Run: [steam] "C:\Program Files\Steam\Steam.exe" -silent

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun

O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\Windows\system32\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe -update activex

O4 - HKUS\S-1-5-18\..\Run: [browser Infrastructure Helper] C:\Users\PC Vitor\AppData\Local\Smartbar\Application\Linkury.exe startup (User 'SISTEMA')

O4 - HKUS\.DEFAULT\..\Run: [browser Infrastructure Helper] C:\Users\PC Vitor\AppData\Local\Smartbar\Application\Linkury.exe startup (User 'Default user')

O8 - Extra context menu item: Download with &Media Finder - C:\Program Files\Media Finder\hook.html

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000

O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll

O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\speedbit video accelerator\sblsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\speedbit video accelerator\sblsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\speedbit video accelerator\sblsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\speedbit video accelerator\sblsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\speedbit video accelerator\sblsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\speedbit video accelerator\sblsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\speedbit video accelerator\sblsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\speedbit video accelerator\sblsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\speedbit video accelerator\sblsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\speedbit video accelerator\sblsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\speedbit video accelerator\sblsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O15 - Trusted Zone: *.clonewarsadventures.com

O15 - Trusted Zone: *.freerealms.com

O15 - Trusted Zone: *.soe.com

O15 - Trusted Zone: *.sony.com

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

É necessário se cadastrar para acessar o conteúdo.

• Entre
• ou
• Cadastre-se

O17 - HKLM\System\CCS\Services\Tcpip\..\{F69BFA05-5E9D-494C-AEF8-06DFCB039AB2}: NameServer = 200.204.0.10 200.204.0.138

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O20 - AppInit_DLLs: C:\PROGRA~1\WIA6EB~1\Datamngr\datamngr.dll C:\PROGRA~1\WIA6EB~1\Datamngr\IEBHO.dll

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: Sandboxie Service (SbieSvc) - SANDBOXIE L.T.D - C:\Program Files\Sandboxie\SbieSvc.exe

O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe

O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O23 - Service: TeamViewer 7 (TeamViewer7) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe

O23 - Service: TipCtrl - Unknown owner - C:\Program Files\uTIPu\TipCtrl.exe (file missing)

O23 - Service: VideoAcceleratorService - SpeedBit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe

 

--

End of file - 13662 bytes

 

No momento estou fazendo uma varredura com o SpyBot estou esperando para ver se ele reconhece, preciso muito da ajuda de vocês muito obrigado desde já.

[mikhail 99]

BHO: Complitly - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Users\PC Vitor\AppData\Roaming\Complitly\Complitly.dll

Malware quando vinculado ao KeepMeUpdated.exe

 

BHO: CrossriderApp0002258 - {11111111-1111-1111-1111-110011221158} - C:\Program Files\I Want This\I Want This.dll

Processo de um adware

 

BHO: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\Ba bylonToolbar.dll (file missing)

Toolbar: Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\Babyl onToolbarTlbr.dl

Processo toolbar que pode ser removido se necessário

 

BHO: FindLyrics - {44C9CC91-6A4A-4579-B4B5-899ECDC18DC6} - C:\Program Files\FindLyrics\FindLyrics.dll

Processo adware sob a proposta de recuperar lçetras de músicas na internet.

 

BHO: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WIA6EB~1\Datamngr\ToolBar\searchqudtx. dll

Adware geralmente associado a aplicativos gratúitos ou por tempo determinado. Toolbar/adware

 

BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)

Ask toolbar - para muitos um adware, para outros apenas uma barra de ferramentas desnecessária.

 

Toolbar: aTube Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)

 

Toolbar: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WIA6EB~1\Datamngr\ToolBar\searchqudtx. dll

C:\Program Files\Windows Searchqu Toolbar\Datamngr\datamngrUI.exe

 

Parei nas barras de ferramentas....

 

 

Você parece estar usando o MSE com o Spybot - Search & Destroy. Ok, mas mesmo assim vc tem dado autorização para instalação de algumas toolbars que podem ser consideradas Adwares.

 

Se isto foi escolha sua ok, deixa rolar. Se não foi melhor atualizar tanto o MSE quanto o Spybot e, começando pelo Spybot, fazer varreduras COMPLETAS com cada um deles. categorias diferentes de pragas vão requerer abordagens diferentes de solução.

 

A remoção de barras como a Ask, a Babylon (chata de remover) a Searchqu e FindLyrics vc vai achar facilmente na net, basta uma busca no Google e vc terá uma série de tutos muito fáceis de seguir.

 

Depois de fazer as varreduras, eliminar TODOS os arquivos e processos suspeitos encontrados refaça o Log Hijack pra que mais alguém possa ajuda-lo.

 

Quanto ao tal processo ixplore.exe...

 

No log do HijackThis não há referencias a isto.

 

No entanto se vc estiver se referindo ao iexplore.exe a coisa muda. Iexplore.exe é um processo legítimo, é o Internet Explorer.

 

Verifique qual a grafia correta do processo suspeito:

 

• ixplore.exe ou
  
• iexplore.exe