Notebook Dell G7 2019.
Windows Esnterprise trial.
Meu dispositivo (atualmente trial Microsoft Enterprise, tenho assinatura ativa do Microsoft 365 Business, mas não consigo acessar a chave, tenho o nº do recibo) foi invadido por um ramsware que atacou via Trustinstaller.
SINTOMAS: acesso negado, inclusive via prompt na recuperação do sistema. Sequestro de softwares antivírus (Defender, Mcfee e Malwarebytes), gerando ícones de atalho falsos. Ataque às nuvens OneDrive, Icloud, Crativecloud e Dropbox e modificação dos meus
arquivos de código, extensões .html, .css e principalmente .js, que se deram quando eu estava trabalhando no Visual Studio IDE 2019, após download de extensões. A nuvem do Azure está apresentando inconsistências (alterações da Dashware e interrupção repentina
da conexão).
PROCEDIMENTOS REALIZADOS:
- Várias reinstações limpas e Data Wipe.
- No prompt:
* net stop trustedinstaller;
* Chkdsk /f/r;
* Wufix.bat;
* rede.bat;
* Dism (recuperação da imagem e restorehealth);
* Bootrec (todos os fix e rebuild);
*Rkill.
Quando eu executo o sfc /scannow a informação é que o sistema está integro.
Entretanto:
- O Windows Defender Offline por vezes não roda, simplesmente reinicia;
- O sistema apresenta paradas repentinas, pois a CPU vai a 100% repentinamente (verificação pelo task manager).
Quando isso ocorre executo Rkill e net stop trustedinstaller pelo prompt e volta ao normal.
COMO POSSO VERIFICAR A INTEGRIDADE DO SISTEMA, PRINCIPALMENTE DO WINDOWS DEFENDER e RESTAURAR IMAGENS CORROMPIDAS?
Segue o último log do Rkill:
Rkill 2.7.0 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2019 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html
Program started at: 08/28/2019 01:58:04 PM in x64 mode.
Windows Version: Windows 10 Enterprise Evaluation
Checking for Windows services to stop:
* No malware services found to stop.
Checking for processes to terminate:
* No malware processes found to kill.
Checking Registry for malware related settings:
* No issues found in the Registry.
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
Performing miscellaneous checks:
* Reparse Point/Junctions Found (Most likely legitimate)!
* C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 => C:\WINDOWS\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\IE [Dir]
* No issues found.
Checking Windows Service Integrity:
* (BFE) is not Running.
Startup Type set to:
* AeLookupSvc [Missing Service]
* AllUserInstallAgent [Missing Service]
* Browser [Missing Service]
* Fax [Missing Service]
* hkmsvc [Missing Service]
* THREADORDER [Missing Service]
* TimeBroker [Missing Service]
* UI0Detect [Missing Service]
* WcsPlugInService [Missing Service]
* WPCSvc [Missing Service]
* WSService [Missing Service]
* wudfsvc [Missing Service]
* adp94xx [Missing Service]
* adpahci [Missing Service]
* adpu320 [Missing Service]
* agp440 [Missing Service]
* arc [Missing Service]
* BthAvrcpTg [Missing Service]
* bthhfhid [Missing Service]
* discache [Missing Service]
* FxPPM [Missing Service]
* gagp30kx [Missing Service]
* iirsp [Missing Service]
* IRENUM [Missing Service]
* LSI_SAS2 [Missing Service]
* LSI_SCSI [Missing Service]
* mrxsmb10 [Missing Service]
* nfrd960 [Missing Service]
* nv_agp [Missing Service]
* srv [Missing Service]
* uagp35 [Missing Service]
* uliagpkx [Missing Service]
* viaide [Missing Service]
* Wd [Missing Service]
* wpcfltr [Missing Service]
* HomeGroupListener [Missing ImagePath]
* HomeGroupProvider [Missing ImagePath]
* napagent [Missing ImagePath]
* AppIDSvc => %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted -p [Incorrect ImagePath]
* Appinfo => %SystemRoot%\system32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* AudioEndpointBuilder => %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* Audiosrv => %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted -p [Incorrect ImagePath]
* BDESVC => %SystemRoot%\System32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* BFE => %systemroot%\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p [Incorrect ImagePath]
* BITS => %SystemRoot%\System32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* BrokerInfrastructure => %SystemRoot%\system32\svchost.exe -k DcomLaunch -p [Incorrect ImagePath]
* bthserv => %SystemRoot%\system32\svchost.exe -k LocalService -p [Incorrect ImagePath]
* CryptSvc => %SystemRoot%\system32\svchost.exe -k NetworkService -p [Incorrect ImagePath]
* DcomLaunch => %SystemRoot%\system32\svchost.exe -k DcomLaunch -p [Incorrect ImagePath]
* DeviceAssociationService => %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* DeviceInstall => %SystemRoot%\system32\svchost.exe -k DcomLaunch -p [Incorrect ImagePath]
* Dhcp => %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted -p [Incorrect ImagePath]
* Dnscache => %SystemRoot%\system32\svchost.exe -k NetworkService -p [Incorrect ImagePath]
* dot3svc => %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* DPS => %SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork -p [Incorrect ImagePath]
* DsmSvc => %SystemRoot%\system32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* Eaphost => %SystemRoot%\System32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* EventLog => %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted -p [Incorrect ImagePath]
* EventSystem => %SystemRoot%\system32\svchost.exe -k LocalService -p [Incorrect ImagePath]
* fdPHost => %SystemRoot%\system32\svchost.exe -k LocalService -p [Incorrect ImagePath]
* FDResPub => %SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation -p [Incorrect ImagePath]
* fhsvc => %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* FontCache => %SystemRoot%\system32\svchost.exe -k LocalService -p [Incorrect ImagePath]
* gpsvc => %systemroot%\system32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* hidserv => %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* IKEEXT => %systemroot%\system32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* iphlpsvc => %SystemRoot%\System32\svchost.exe -k NetSvcs -p [Incorrect ImagePath]
* KtmRm => %SystemRoot%\System32\svchost.exe -k NetworkServiceAndNoImpersonation -p [Incorrect ImagePath]
* LanmanServer => %SystemRoot%\system32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* LanmanWorkstation => %SystemRoot%\System32\svchost.exe -k NetworkService -p [Incorrect ImagePath]
* lltdsvc => %SystemRoot%\System32\svchost.exe -k LocalService -p [Incorrect ImagePath]
* lmhosts => %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted -p [Incorrect ImagePath]
* LSM => %SystemRoot%\system32\svchost.exe -k DcomLaunch -p [Incorrect ImagePath]
* MMCSS => \SystemRoot\system32\drivers\mmcss.sys [Incorrect ImagePath]
* MpsSvc => %SystemRoot%\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p [Incorrect ImagePath]
* MSiSCSI => %systemroot%\system32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* NcaSvc => %SystemRoot%\System32\svchost.exe -k NetSvcs -p [Incorrect ImagePath]
* NcdAutoSetup => %SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork -p [Incorrect ImagePath]
* Netman => %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* netprofm => %SystemRoot%\System32\svchost.exe -k LocalService -p [Incorrect ImagePath]
* NlaSvc => %SystemRoot%\System32\svchost.exe -k NetworkService -p [Incorrect ImagePath]
* nsi => %systemroot%\system32\svchost.exe -k LocalService -p [Incorrect ImagePath]
* PcaSvc => %systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* pla => %SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork -p [Incorrect ImagePath]
* PlugPlay => %SystemRoot%\system32\svchost.exe -k DcomLaunch -p [Incorrect ImagePath]
* PolicyAgent => %SystemRoot%\system32\svchost.exe -k NetworkServiceNetworkRestricted -p [Incorrect ImagePath]
* Power => %SystemRoot%\system32\svchost.exe -k DcomLaunch -p [Incorrect ImagePath]
* ProfSvc => %systemroot%\system32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* QWAVE => %windir%\system32\svchost.exe -k LocalServiceAndNoImpersonation -p [Incorrect ImagePath]
* RasAuto => %SystemRoot%\System32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* RemoteRegistry => %SystemRoot%\system32\svchost.exe -k localService -p [Incorrect ImagePath]
* RpcEptMapper => %SystemRoot%\system32\svchost.exe -k RPCSS -p [Incorrect ImagePath]
* RpcSs => %SystemRoot%\system32\svchost.exe -k rpcss -p [Incorrect ImagePath]
* Schedule => %systemroot%\system32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* seclogon => %windir%\system32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* SENS => %SystemRoot%\system32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* SensrSvc => %SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation -p [Incorrect ImagePath]
* SessionEnv => %SystemRoot%\System32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* SharedAccess => %SystemRoot%\System32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* ShellHWDetection => %SystemRoot%\System32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* SSDPSRV => %SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation -p [Incorrect ImagePath]
* SstpSvc => %SystemRoot%\system32\svchost.exe -k LocalService -p [Incorrect ImagePath]
* StorSvc => %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* svsvc => %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* SysMain => %systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* SystemEventsBroker => %SystemRoot%\system32\svchost.exe -k DcomLaunch -p [Incorrect ImagePath]
* TabletInputService => %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* TapiSrv => %SystemRoot%\System32\svchost.exe -k NetworkService -p [Incorrect ImagePath]
* Themes => %SystemRoot%\System32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* TrkWks => %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* UmRdpService => %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* upnphost => %SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation -p [Incorrect ImagePath]
* vmicheartbeat => %systemroot%\system32\svchost.exe -k ICService -p [Incorrect ImagePath]
* vmickvpexchange => %systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* vmicrdv => %systemroot%\system32\svchost.exe -k ICService -p [Incorrect ImagePath]
* vmicshutdown => %systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* vmictimesync => %systemroot%\system32\svchost.exe -k LocalServiceNetworkRestricted -p [Incorrect ImagePath]
* vmicvss => %systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* Wcmsvc => %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted -p [Incorrect ImagePath]
* wcncsvc => %SystemRoot%\System32\svchost.exe -k LocalServiceAndNoImpersonation -p [Incorrect ImagePath]
* WdiServiceHost => %SystemRoot%\System32\svchost.exe -k LocalService -p [Incorrect ImagePath]
* WdiSystemHost => %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* WebClient => %SystemRoot%\system32\svchost.exe -k LocalService -p [Incorrect ImagePath]
* Wecsvc => %SystemRoot%\system32\svchost.exe -k NetworkService -p [Incorrect ImagePath]
* wercplsupport => %SystemRoot%\System32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* WiaRpc => %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* WinDefend => "C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1907.4-0\MsMpEng.exe" [Incorrect ImagePath]
* WinHttpAutoProxySvc => %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted -p [Incorrect ImagePath]
* Winmgmt => %systemroot%\system32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* WinRM => %SystemRoot%\System32\svchost.exe -k NetworkService -p [Incorrect ImagePath]
* WlanSvc => %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* wlidsvc => %SystemRoot%\system32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* wscsvc => %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted -p [Incorrect ImagePath]
* wuauserv => %systemroot%\system32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* WwanSvc => %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
* BasicDisplay => \SystemRoot\System32\DriverStore\FileRepository\basicdisplay.inf_amd64_25ab9510fd18cfda\BasicDisplay.sys [Incorrect ImagePath]
* BasicRender => \SystemRoot\System32\DriverStore\FileRepository\basicrender.inf_amd64_9ff437f462543a42\BasicRender.sys [Incorrect ImagePath]
* CompositeBus => \SystemRoot\System32\DriverStore\FileRepository\compositebus.inf_amd64_095624d60edd8fe5\CompositeBus.sys [Incorrect ImagePath]
* swenum => \SystemRoot\System32\DriverStore\FileRepository\swenum.inf_amd64_9ebb9a8726114d22\swenum.sys [Incorrect ImagePath]
* umbus => \SystemRoot\System32\DriverStore\FileRepository\umbus.inf_amd64_0a69be6a385b49f7\umbus.sys [Incorrect ImagePath]
* WdBoot => system32\drivers\wd\WdBoot.sys [Incorrect ImagePath]
* WdFilter => system32\drivers\wd\WdFilter.sys [Incorrect ImagePath]
* AppMgmt => %SystemRoot%\system32\svchost.exe -k netsvcs -p [Incorrect ImagePath]
* CscService => %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted -p [Incorrect ImagePath]
Searching for Missing Digital Signatures:
* No issues found.
Checking HOSTS File:
* No issues found.
Program finished at: 08/28/2019 01:58:25 PM
Execution time: 0 hours(s), 0 minute(s), and 21 seconds(s)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
