segurança Peguei um virus nervoso chamado(msnmsgrs.exe)

ordamax · 5 de Dezembro 2010

msnmsgrs.exe,esse virus ta destruindo meu pc mudou tudo e excluiu o meu norton 360 por favor alguem me ajuda,eu excluo o arquivo so q ele aparece novamente,fiz o scan por bitdefender:

QuickScan Beta 32-bit v0.9.9.57

-------------------------------

Scan date: Sun Dec 05 10:42:58 2010

Machine ID: 84D089DB

Found 1 infected file!

----------------------

C:\WINDOWS\system32\svchost\msnmsgrs.exe --> Trojan.Generic.KDV.78015

--> HKCU\Software\Microsoft\Windows\CurrentVersion\Run\"Msn"

--> HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\"Policies"

--> HKLM\Software\Microsoft\Windows\CurrentVersion\Run\"Msn"

--> HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\"Policies"

Processes

---------

(unsigned) Orbit Downloader 852 C:\Arquivos de programas\Orbitdownloader\orbitdm.exe

(unsigned) P2P service of Orbit Downloader 868 C:\Arquivos de programas\Orbitdownloader\orbitnet.exe

(unsigned) Sistema operacional Microsoft® Windows® 972 C:\WINDOWS\system32\notepad.exe

(unsigned) Sistema operacional Microsoft® Windows® 1768 C:\WINDOWS\system32\notepad.exe

(unsigned) Sistema operacional Microsoft® Windows® 1116 C:\WINDOWS\system32\services.exe

(verified) Google Chrome 384 C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

(verified) Google Chrome 472 C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

(verified) Google Chrome 512 C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

(verified) Google Chrome 536 C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

(verified) Google Chrome 652 C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

(verified) Google Chrome 664 C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

(verified) Google Chrome 712 C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

(verified) Google Chrome 724 C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

(verified) Google Chrome 776 C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

(verified) Google Chrome 984 C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

(verified) Google Chrome 1584 C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

(verified) Google Chrome 1728 C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

(verified) Google Chrome 1772 C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

(verified) Google Chrome 1792 C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

(verified) Google Chrome 1864 C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

(verified) Google Chrome 1876 C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

(verified) Google Chrome 1968 C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\Application\chrome.exe

(verified) Microsoft® Windows® Operating System 1048 C:\WINDOWS\system32\csrss.exe

(verified) Microsoft® Windows® Operating System 312 C:\WINDOWS\system32\ctfmon.exe

(verified) Microsoft® Windows® Operating System 1128 C:\WINDOWS\system32\lsass.exe

(verified) Microsoft® Windows® Operating System 888 C:\WINDOWS\system32\svchost.exe

(verified) Microsoft® Windows® Operating System 1380 C:\WINDOWS\system32\svchost.exe

(verified) Sistema operacional Microsoft® Windows® 192 C:\WINDOWS\explorer.exe

(verified) Sistema Operacional Microsoft® Windows® 1000 C:\WINDOWS\system32\smss.exe

(verified) Sistema operacional Microsoft® Windows® 1072 C:\WINDOWS\system32\winlogon.exe

Network activity

----------------

Process orbitdm.exe (852) connected on port 80 (HTTP) --> 89.202.157.219

Process orbitnet.exe (868) connected on port 5051 (Yahoo Messenger) --> 189.12.59.104

Process chrome.exe (1968) connected on port 80 (HTTP) --> 208.51.92.41

Process chrome.exe (1968) connected on port 80 (HTTP) --> 64.233.163.154

Process chrome.exe (1968) connected on port 80 (HTTP) --> 64.233.163.100

Process chrome.exe (1968) connected on port 80 (HTTP) --> 64.233.163.154

Process chrome.exe (1968) connected on port 80 (HTTP) --> 64.233.163.100

Process chrome.exe (1968) connected on port 80 (HTTP) --> 64.233.169.102

Process chrome.exe (1968) connected on port 80 (HTTP) --> 64.233.163.154

Process chrome.exe (1968) connected on port 80 (HTTP) --> 64.233.169.102

Process chrome.exe (1968) connected on port 80 (HTTP) --> 66.235.142.2

Process chrome.exe (1968) connected on port 80 (HTTP) --> 64.233.163.104

Process chrome.exe (1968) connected on port 80 (HTTP) --> 66.235.142.2

Process chrome.exe (1968) connected on port 80 (HTTP) --> 64.233.163.104

Process chrome.exe (1968) connected on port 80 (HTTP) --> 89.202.157.219

Process chrome.exe (1968) connected on port 80 (HTTP) --> 72.246.216.41

Process chrome.exe (1968) connected on port 80 (HTTP) --> 64.233.169.113

Process chrome.exe (1968) connected on port 80 (HTTP) --> 64.233.163.148

Process chrome.exe (1968) connected on port 80 (HTTP) --> 66.235.142.2

Process chrome.exe (1968) connected on port 80 (HTTP) --> 64.233.163.100

Process chrome.exe (1968) connected on port 80 (HTTP) --> 72.14.213.101

Process chrome.exe (1968) connected on port 80 (HTTP) --> 64.233.163.100

Process chrome.exe (1968) connected on port 80 (HTTP) --> 64.233.163.152

Process chrome.exe (1968) connected on port 80 (HTTP) --> 66.220.147.11

Process chrome.exe (1968) connected on port 80 (HTTP) --> 64.233.163.154

Process chrome.exe (1968) connected on port 80 (HTTP) --> 64.233.163.100

Process orbitnet.exe (868) listens on ports: 1862

Autoruns and critical files

---------------------------

(unsigned) msnmsgrs.exe C:\WINDOWS\system32\svchost\msnmsgrs.exe

(unsigned) NVIDIA Compatible Windows 2000 Display C:\WINDOWS\system32\nvcpl.dll

(unsigned) Sistema operacional Microsoft® Windows® C:\WINDOWS\system32\shell32.dll

(verified) Adobe Acrobat C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe

(verified) Adobe Reader and Acrobat Manager C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe

(verified) Google Update C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Update\GoogleUpdate.exe

(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\cryptnet.dll

(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\ctfmon.exe

(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\dimsntfy.dll

(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\wpdshserviceobj.dll

(verified) Sistema operacional Microsoft® Windows® C:\WINDOWS\system32\browseui.dll

(verified) Sistema operacional Microsoft® Windows® C:\WINDOWS\system32\crypt32.dll

(verified) Sistema operacional Microsoft® Windows® C:\WINDOWS\system32\cscdll.dll

(verified) Sistema operacional Microsoft® Windows® C:\WINDOWS\system32\logonui.exe

(verified) Sistema operacional Microsoft® Windows® C:\WINDOWS\system32\sclgntfy.dll

(verified) Sistema operacional Microsoft® Windows® C:\WINDOWS\system32\stobject.dll

(verified) Sistema operacional Microsoft® Windows® c:\windows\system32\userinit.exe

(verified) Sistema operacional Microsoft® Windows® C:\WINDOWS\system32\wlnotify.dll

(verified) Windows® Internet Explorer C:\WINDOWS\system32\webcheck.dll

Browser plugins

---------------

(unsigned) Orbitcth c:\arquivos de programas\orbitdownloader\orbitcth.dll

(unsigned) Proxifier Standard Edition C:\WINDOWS\system32\PrxerDrv.dll

(unsigned) Proxifier Standard Editon C:\WINDOWS\system32\PrxerNsp.dll

(unsigned) Shockwave for Director C:\WINDOWS\system32\Adobe\Director\np32dsw.dll

(unsigned) Sistema operacional Microsoft® Windows® C:\WINDOWS\system32\mswsock.dll

(verified) AcroIEHelperShim Library c:\arquivos de programas\arquivos comuns\adobe\acrobat\activex\acroiehelpershim.dll

(verified) Adobe Acrobat C:\Arquivos de programas\Mozilla Firefox\plugins\nppdf32.dll

(verified) Adobe® Flash® Player ActiveX C:\WINDOWS\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe

(verified) BitDefender QuickScan C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie\0.9.9.57_0\npqscan.dll

(verified) BitDefender QuickScan C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie\0.9.9.57_0\npqslauncher.dll

(verified) FlashGet Browser Helper Object c:\documents and settings\jean felipe\dados de aplicativos\flashgetbho\flashgetbho3.dll

(verified) Google Update C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Update\1.2.183.39\npGoogleOneClick8.dll

(verified) Messenger C:\Arquivos de programas\Messenger\msmsgs.exe

(verified) Microsoft® Windows Live Login Helper c:\arquivos de programas\arquivos comuns\microsoft shared\windows live\windowslivelogin.dll

(verified) Microsoft® Windows® Operating System C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\rsvpsp.dll

(verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\winrnr.dll

(verified) Mozilla Default Plug-in C:\Arquivos de programas\Mozilla Firefox\plugins\npnul32.dll

(verified) MSN® Games by Zone.com C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll

(verified) Norton Confidential c:\arquivos de programas\norton 360\engine\3.8.0.41\coieplg.dll

(verified) NPSWF32.dll C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

(verified) OGPlanet Game Plugin C:\WINDOWS\system32\npOGPPlugin.dll

(verified) RealPlayer Version Plugin C:\Arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

(verified) RealPlayer G2 LiveConnect-Enabled P C:\Arquivos de programas\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

(verified) Silverlight Plug-In c:\Arquivos de programas\Microsoft Silverlight\4.0.50917.0\npctrl.dll

(verified) Symantec Intrusion Detection c:\arquivos de programas\norton 360\engine\3.8.0.41\ipsbho.dll

(verified) Unity Player C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Unity\WebPlayer\loader\npUnity3D32.dll

(verified) UNO Messenger C:\WINDOWS\Downloaded Program Files\GAME_UNO1.dll

(verified) Windows® Internet Explorer C:\WINDOWS\system32\ieframe.dll

(verified) XpcomOpusConnector.dll C:\Documents and Settings\Jean Felipe\Dados de aplicativos\Mozilla\Firefox\Profiles\1sc5igew.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\components\XpcomOpusConnector.dll

Scan

----

(unsigned) MD5: b242aff9b81ddbc6501296d90350fb37 C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\pdfshell.PTB

(unsigned) MD5: 0e3c92b02ccfa54add7756374ee01fce C:\Arquivos de programas\Orbitdownloader\download.dll

(unsigned) MD5: cdef13460a1c133137238f56794ff6bd C:\Arquivos de programas\Orbitdownloader\idht.dll

(unsigned) MD5: 297a136d2b8aef250a8ef7209d4d7811 c:\arquivos de programas\orbitdownloader\orbitcth.dll

(unsigned) MD5: bc96a29ee58f759b2c29523643093c5f C:\Arquivos de programas\Orbitdownloader\orbitdm.exe

(unsigned) MD5: 591439a79b8287dee82bc178d0a3a122 C:\Arquivos de programas\Orbitdownloader\orbitnet.exe

(unsigned) MD5: f02c4aaa6ac913faab0eaa74ead94d9a C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\Application\8.0.552.215\gcswf32.dll

(unsigned) MD5: 62bd0d98ea1c4d60b39c5980f8f0d96f C:\Documents and Settings\Jean Felipe\Configurações locais\Dados de aplicativos\Google\Chrome\Application\Plugins\nporbit.dll

(unsigned) MD5: b7f79d9b2f13da92f21cf88405a9473b C:\WINDOWS\system32\activeds.dll

(unsigned) MD5: ac47b55b38d626b678897f195793ecab C:\WINDOWS\system32\Adobe\Director\np32dsw.dll

(unsigned) MD5: c8037ed502658cc8be057d33d981de93 C:\WINDOWS\system32\adsldpc.dll

(unsigned) MD5: 4956c6eac6a2af1603f56fe21aa2572b C:\WINDOWS\system32\advapi32.dll

(unsigned) MD5: fca7aedf94a19a0fd4a92dcc819ab579 C:\WINDOWS\system32\avifil32.dll

(unsigned) MD5: 7c87f86a1451b7eb2c9f3ffcf9e629fa C:\WINDOWS\system32\d3dim.dll

(unsigned) MD5: 6f1d087713cdbe356875159eff6d9ae2 C:\WINDOWS\system32\dnsapi.dll

(unsigned) MD5: 4c3696c1ed1a36629ebb348bf745a328 C:\WINDOWS\system32\DRIVERS\nv4_mini.sys

(unsigned) MD5: e47c52f0380f0950e2bc9f1bcdc0de9b C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys

(unsigned) MD5: ae4d13b572399b206b43d65da4d9983d C:\WINDOWS\system32\drivers\SRV.sys

(unsigned) MD5: a5bc817bb84dcb9e71719ff868144124 C:\WINDOWS\system32\drivers\TCPIP.sys

(unsigned) MD5: 29373f00ac66795567729db9919cd034 C:\WINDOWS\system32\dxdiagn.dll

(unsigned) MD5: 58586eb44e6fd9a711943647c8451741 C:\WINDOWS\system32\es.dll

(unsigned) MD5: 47485a84326c992440e41828aa9ee34c C:\WINDOWS\system32\GameMon.des

(unsigned) MD5: e6f088a60350b12c7cfacb34d863bf06 C:\WINDOWS\system32\gdi32.dll

(unsigned) MD5: 79e532e2521f36e385f1473bfd46939f C:\WINDOWS\System32\hidserv.dll

(unsigned) MD5: 2acc4e834a1b563c426a0ebadfb8a05c C:\WINDOWS\System32\irmon.dll

(unsigned) MD5: 68ecdad8ae2768de61c20c41a28cc0b0 C:\WINDOWS\system32\kernel32.dll

(unsigned) MD5: 171e0d77ff01d08b692916ecd18c84c7 C:\WINDOWS\system32\lsasrv.dll

(unsigned) MD5: 876611ddb9e36a94512dd1e61ebc5abb C:\WINDOWS\system32\mprapi.dll

(unsigned) MD5: aa925ef24f94339f950c229abd50fdfd C:\WINDOWS\system32\mscms.dll

(unsigned) MD5: 609222d86984fc7a48a6aa5cb491d24f C:\WINDOWS\system32\MSCTFIME.IME

(unsigned) MD5: 5265ea72f599cf8277a34780f6369b60 C:\WINDOWS\system32\mswsock.dll

(unsigned) MD5: c895b18a038cff07dd5d134d83e69ba7 C:\WINDOWS\system32\netapi32.dll

(unsigned) MD5: e4a18adf075d1861bd6240348a67cce2 C:\WINDOWS\system32\notepad.exe

(unsigned) MD5: ec6f999f3d32f951b4ea08bdfbc7b705 C:\WINDOWS\system32\ntdll.dll

(unsigned) MD5: 25a4cabd197a4527a0b45559c3706302 C:\WINDOWS\system32\nvcpl.dll

(unsigned) MD5: 96f1a6f0a0d4f11047df2f5c17c87e9d C:\WINDOWS\system32\nvsvc32.exe

(unsigned) MD5: 023d0caa9ca4ed183754f4b1d824a965 C:\WINDOWS\system32\PrxerDrv.dll

(unsigned) MD5: 7d70b9b31f73e3c5a96ac76774c40da4 C:\WINDOWS\system32\PrxerNsp.dll

(unsigned) MD5: 1ad9e1fede7f65c792d0cd526838b547 C:\WINDOWS\system32\rpcrt4.dll

(unsigned) MD5: e34a1b6160a90c7cb90bf2ee8d6ad921 C:\WINDOWS\system32\rpcss.dll

(unsigned) MD5: 6b4b041d6b3a346a98dca5b545c65250 C:\WINDOWS\system32\schannel.dll

(unsigned) MD5: a7ef7656c875d500d97c780bebdffb5e C:\WINDOWS\system32\secur32.dll

(unsigned) MD5: ee7999baaca84cfaa03726e677ee2a33 C:\WINDOWS\system32\services.exe

(unsigned) MD5: 16b88a42ce305eb052ff28e33c443812 C:\WINDOWS\system32\shdoclc.dll

(unsigned) MD5: 884552170dde507e0708ed4b201f1394 C:\WINDOWS\system32\shell32.dll

(unsigned) MD5: e919cba1b6fda836573b2fbb88d354ce C:\WINDOWS\system32\shgina.dll

(unsigned) MD5: 60effa3ab2f80efcc9ac6b780b15e399 C:\WINDOWS\system32\shmedia.dll

(unsigned) MD5: 63dfb83cb105cfc894c45d98af8c9bfc C:\WINDOWS\system32\svchost\msnmsgrs.exe

(unsigned) MD5: faddca6414d67f76377074445dd200fa C:\WINDOWS\system32\uxtheme.dll

(unsigned) MD5: ab8da4f41b41774f120aee9495f346bd C:\WINDOWS\system32\wiashext.dll

(unsigned) MD5: cc016c11d75c648766037da9390ae6a4 C:\WINDOWS\system32\winhttp.dll

(unsigned) MD5: c9616b6066d59891befbce35d193a487 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5581_x-ww_dfbc4fc4\GdiPlus.dll

No file uploaded.

Scan finished - communication took 15 sec

Total traffic - 0.03 MB sent, 0.92 KB recvd

Scanned 723 files and modules - 26 seconds

==============================================================================

`ReL´CLouD · 5 de Dezembro 2010

Ja respondi no topico de onde vc pego o virus

**Lincon_** · 6 de Dezembro 2010

msnmsgrs é o launcher do Msn ...

mais sei lá como se conseguio isso ... tenta ir na pasta do msn e ou finaliza o processo no gerenciador de tarefas e vai desistala o msn ...

na ultima .. posibilidade formate o pc

ahhh ....... norton 360

é um lixo

**Amazonense** · 5 de Janeiro 2011

Errado, msnmsgr.exe sim é o processo referente ao próprio msn, preste atenção, esse vírus tem um "s" ao final, antes de afirmar algo sobre vírus é bom ter certeza, caso não a tenha, não afirme com tanta convicção.

Atenciosamente, Amazonense.

**[AST]Riike** · 5 de Janeiro 2011

É um keylogger, eu já peguei esse ai também, para tirar, faça o seguinte:

Use o SuperAntiSpyware e o Kaspersky(ou qualquer outro antivirus da preferencia) e faça uma "varredura" no sitema, fiz isso e o virus foi embora.

**'Leozin** · 6 de Janeiro 2011

Tópico Ressuscitado, e está em área errada.

Closed [x]

Entrar

Quem está por aqui 0 membros estão online

segurança Peguei um virus nervoso chamado(msnmsgrs.exe)

Posts Recomendados

ordamax 0

Link para o comentário

Compartilhar em outros sites

`ReL´CLouD 0

Link para o comentário

Compartilhar em outros sites

Lincon_ 2

Link para o comentário

Compartilhar em outros sites

Amazonense 0

Link para o comentário

Compartilhar em outros sites

[AST]Riike 0

Link para o comentário

Compartilhar em outros sites

'Leozin 38

Link para o comentário

Compartilhar em outros sites

Conteúdo Similar

segurança COMO BLINDAR O MYSQL, MARIADB E O PHPMYADMIN CONTAR ATAQUES

LINEAGE 2 📊 Logs e Monitoramento de Segurança 📊

LINEAGE 2 📡 Proteção contra Packet Hacks 📡

LINEAGE 2 🔍 Sistema de Detecção de Exploits 🔍

LINEAGE 2 🛡️ Configuração Anti-DDoS 🛡️

Fóruns

Todas Atividades

LOJA WCOINS

Informação Importante