Usamos cookies para medir audiência e melhorar sua experiência. Você pode aceitar ou recusar a qualquer momento. Veja sobre o iMasters.
Bom dia.
Nos últimos dias, a minha navegação web esta bastante lenta. Fiz o teste de velocidade e funcionou corretamente. Alguns sites entram normal, como Uol, outros demoram bastante para carregar. Passei o Malwarebytes e não encontrou nada.
Abaixo o log do HijackThis:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 09:09:43, on 10/10/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16450)
Boot mode: Normal
Running processes:
C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
C:\hijackthis\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Auxiliar de Conexão do Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\Program Files (x86)\GbPlugin\gbieh.dll
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Maicon\AppData\Local\Google\Update\GoogleUpdate.exe" /cO4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIÇO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO DE REDE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIÇO DE REDE')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe
O8 - Extra context menu item: &Enviar para o OneNote - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: Add to WebSite-Watcher - C:\Users\Maicon\AppData\Roaming\aignes\WebSite-Watcher\config\settings\wswie.htm
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000
O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
O9 - Extra button: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: www.bancobrasil.com.br
O15 - Trusted Zone: www14.bancobrasil.com.br
O15 - Trusted Zone: www2.bancobrasil.com.br
O15 - Trusted Zone: www.bb.com.br
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O20 - AppInit_DLLs: acaptuser32.dll
O20 - Winlogon Notify: GbPluginBb - C:\Program Files (x86)\GbPlugin\gbieh.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: avast! Firewall - AVAST Software - C:\Program Files\AVAST Software\Avast\afwServ.exe
O23 - Service: Serviço do Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Gbp Service (GbpSv) - - C:\PROGRA~2\GbPlugin\GbpSv.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: mental ray 3.9 Satellite for Autodesk 3ds Max 2012 64-bit - English 64-bit (mi-raysat_3dsmax2012_64) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files (x86)\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.17\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.5.8\bin\mysqld.exe
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
--
End of file - 12735 bytes
Bom dia DigRam.
Log do Eset:
C:\$Recycle.Bin\S-1-5-21-875019213-1501409631-4201425577-1000\$RWKBGKQ.exe a variant of Win32/InstallCore.AW application cleaned by deleting - quarantined
C:\Users\Maicon\AppData\Local\Temp\ICReinstall_glary-utilities-24901600-baixaki-32-bits-410201212320.exe a variant of Win32/InstallCore.AW application cleaned by deleting - quarantined
C:\Users\Maicon\Downloads\backup_info_1209240126.xml.tgz multiple threats deleted - quarantined
Bom Dia! maicon_m
|- Baixe: < /applications/core/interface/imageproxy/imageproxy.php?img=http://billy-oneal.com/Canned%2520Speeches/speechimages/OTL/otlDesktopIcon.png&key=1894e5d356219721410c3360cbf9af74877ae24ccc81ed88026fc2d95dd96a07" alt="otlDesktopIcon.png" /> > ( ... by OldTimer Tools )
|- Clique em Salvar!
|- Salve-o no desktop!
|- Duplo clique em OTL.exe >> Executar.
/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/OTL_Configuracao.jpg&key=7e76108b70bd59b556c6498d72f98bc50a1507c1101b089d8b9941f652fb86f9" alt="OTL_Configuracao.jpg" /> >> /applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/My%2520Tools%25203/OTL_Padrao.jpg&key=527dbad2b87905959f3ae5549fa6261b5208534cea6c54c3fa3ff991665188f4" alt="OTL_Padrao.jpg" />
|- Configure "Verificação de Arquivos",segundo a screenshot!
/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/My%2520Tools%25202/OTL_SemExt2.jpg&key=05f9220c5424b04df13bdcb38bad393cbf3e2b0c3d3705a4baff62e1096dadd8" alt="OTL_SemExt2.jpg" />
|- Ps: Faça o mesmo para estes!
|- Em "Exame Extra do Registro",assinale "Nenhum".
crack /s
keygen /s
serial /s
AutoKMS /s
loader /s
%APPDATA%\Local\*.
%APPDATA%\*.exe /s
%APPDATA%\*.
%USERPROFILE%\AppData\Local\.
%USERPROFILE%\AppData\Roaming\.
%systemroot%\assembly\tmp\. /S /MD5
%systemroot%\assembly\temp\. /S /MD5
%systemroot%\assembly\GAC\. /S /MD5
%systemroot%\assembly\GAC_32\. /S /MD5
%systemroot%\assembly\GAC_64\. /S /MD5
%USERPROFILE%\Desktop\registrybackup.reg /c
%systemroot%\system32\config\systemprofile\AppData\Local\.
%windir%\ServiceProfiles\LocalService\AppData\Local\Temp\.
%windir%\ServiceProfiles\NetworkService\AppData\Local\Temp\.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes
/md5start
netsvcs
explorer.exe
userinit.exe
winlogon.exe
svchost.exe
services.exe
uninst.exe
/md5stop
regedit /e c:\registrybackup.reg /c
type c:\boot.ini >> test.txt /c
%systemroot%\system32\tasks\. /s /64
%systemroot%\system32\Tasks\. /s
%windir%\tasks\. /s
/applications/core/interface/imageproxy/imageproxy.php?img=http://www.mediafire.com/imgbnc.php/6659d256325569c6e621117dc332966313a07d11cb5fb0ea4d9176217c7aefa76g.jpg&key=2f5fa92bb006b1b2ac6be24e167f552dde9bcc59e9fb935192d1c347c1a94cbf" alt="6659d256325569c6e621117dc332966313a07d11cb5fb0ea4d9176217c7aefa76g.jpg" />
|- Cole estas informações,que estão no Code,para o campo "Exames Personalizados/Correções".
/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/OTL_Verificar2.jpg&key=072b599459f737b1b122361ecc2bc4aff0eead0d719d5b8e47659ed5a3dc3b58" alt="OTL_Verificar2.jpg" />
|- Concluindo,poste o relatório: OTL.txt
|- Para grandes relatórios,acesse: < /applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/Cjoint_Logo.jpg&key=bc3f249ffa4fec167155636520ebfd1fed8f6c8d63b5aa0b8cd82fb55aa2edb7" alt="Cjoint_Logo.jpg" /> >
|- Maiores informações: < |Link| >
Abraços!
Arquivo OTL.txt
Boa Tarde! maicon_m
|- Baixe: < /applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/My%2520Tools%25203/adwcleaner_logo.jpg&key=e2bde0dd8c13fd52e18ca6fc88e8f2d73040a387059f8bc22a53202f0de6f95f" alt="adwcleaner_logo.jpg" /> > ( ... par Xplode )
|- Ao acessar,clique na imagem: < /applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/AdwCleaner_Tlcharger.jpg&key=2319bbcd35144166c25768473f26c7f193a7ab5036b9479bd1465d8257d6f6b2" alt="AdwCleaner_Tlcharger.jpg" /> >
|- Salve-o no desktop!
|- Clique direito em adwcleaner.exe,e escolha sua execução como "administrador".
|- Ps: Dê início ao scan,clicando em "Delete" ou "Suppression".
/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/My%2520Tools%25203/AdwCleaner_Delete.jpg&key=75f446191cf36528cf6179827354e5d573f05557fda01df5a7ea91d29f5b7dee" alt="AdwCleaner_Delete.jpg" />
|- Ao concluir,poste o relatório: C:\AdwCleaner[S1].txt
-/-
|- Execute o OTL.exe.
|- Copie estas informações que estão no Code,para o campo "Exames Personalizados Correções".
:OTL
IE - HKU\S-1-5-21-875019213-1501409631-4201425577-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch
IE - HKU\S-1-5-21-875019213-1501409631-4201425577-1000\..\SearchScopes\{4A1714DE-886B-471B-9F86-3C418F19ABE5}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ATU2&o=14670&src=crm&q={searchTerms}&locale=&apn_ptnrs=T8&apn_dtid=YYYYYYYYBR&apn_uid=84de6a5a-3aca-43a3-9dec-cc14e9009716&apn_sauid=38464C65-3BAB-439F-9C7D-9220BF2A4110&
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaulturl: "http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.startup.homepage: "http://br.ask.com/?l=dis&o=14672"
[2011/11/13 10:47:20 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Maicon\AppData\Roaming\mozilla\Firefox\Profiles\tfs3ddk7.default\extensions\ffxtlbr@babylon.com
[2011/11/11 16:15:09 | 000,002,191 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2012/01/31 15:10:09 | 000,000,000 | ---D | M] -- C:\Users\Maicon\AppData\Roaming\Babylon
CHR - homepage: http://search.babylon.com/home
CHR - homepage: http://search.babylon.com/home
O1 - Hosts: 127.0.0.1 genuine.microsoft.com
O1 - Hosts: 127.0.0.1 mpa.one.microsoft.com
O1 - Hosts: 127.0.0.1 sls.microsoft.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 adobe.activate.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes]
"Gopher"="gopher://"
:Files
C:\Users\Maicon\AppData\Roaming\Babylon
C:\Users\Maicon\AppData\Local\{*}
:Commands
[CREATERESTOREPOINT]
[purity]
[resethosts]
[emptytemp]
[Reboot]
|- Clique no botão Consertar -> Aguarde a conclusão!
|- O computador vai reiniciar! -> Clique em "Executar".
/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/My%2520Tools%25203/OTL_RunFix.jpg&key=09e9249e416710368096f3071f572470adab328652ebc1420e14063af4dbfd77" alt="OTL_RunFix.jpg" />
|- Para versões em Inglês,clique em Run Fix que é o mesmo que Consertar.
|- Poste o relatório: C:\_OTL\MovedFiles\*.log
Abs!
AdwCleaner log:
*** [services] ***
*** [Files / Folders] ***
File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
File Deleted : C:\Users\Maicon\AppData\Roaming\Mozilla\Firefox\Profiles\tfs3ddk7.default\searchplugins\Askcom.xml
Folder Deleted : C:\Program Files (x86)\Babylon
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\boost_interprocess
Folder Deleted : C:\Users\Maicon\AppData\Local\Babylon
Folder Deleted : C:\Users\Maicon\AppData\LocalLow\BabylonToolbar
Folder Deleted : C:\Users\Maicon\AppData\Roaming\Babylon
Folder Deleted : C:\Users\Maicon\AppData\Roaming\Mozilla\Firefox\Profiles\tfs3ddk7.default\extensions\ffxtlbr@babylon.com
*** [Registry] ***
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASMANCS
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
*** [internet Browsers] ***
-\\ Internet Explorer v9.0.8112.16421
[OK] Registry is clean.
-\\ Mozilla Firefox v15.0.1 (pt-BR)
Profile name : default
File : C:\Users\Maicon\AppData\Roaming\Mozilla\Firefox\Profiles\tfs3ddk7.default\prefs.js
Deleted : user_pref("browser.search.defaultengine", "Ask.com");
Deleted : user_pref("browser.search.defaultenginename", "Ask.com");Deleted : user_pref("browser.search.order.1", "Ask.com");
Deleted : user_pref("browser.startup.homepage", "hxxp://br.ask.com/?l=dis&o=14672");
Deleted : user_pref("extensions.BabylonToolbar.aflt", "orgnl");
Deleted : user_pref("extensions.BabylonToolbar.bbDpng", 15);
Deleted : user_pref("extensions.BabylonToolbar.lastDP", 15);
Deleted : user_pref("extensions.BabylonToolbar.lastVrsnTs", "");
Deleted : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "7.0");
Deleted : user_pref("extensions.BabylonToolbar.propectorlck", 59914428);
Deleted : user_pref("extensions.BabylonToolbar.smplGrp", "free");-\\ Google Chrome v22.0.1229.94
File : C:\Users\Maicon\AppData\Local\Google\Chrome\User Data\Default\Preferences
Deleted [l.8] : homepage = "hxxp://search.babylon.com/home",
Deleted [l.1394] : homepage = "hxxp://search.babylon.com/home",
-\\ Opera v12.2.1578.0
File : C:\Users\Maicon\AppData\Roaming\Opera\Opera\operaprefs.ini
[OK] File is clean.
*************************
AdwCleaner[s1].txt - [3662 octets] - [15/10/2012 14:08:45]
########## EOF - C:\AdwCleaner[s1].txt - [3722 octets] ##########
OTL log:
Files\Folders moved on Reboot...
C:\Users\Maicon\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Windows\temp\_avast_\unp142608807.tmp moved successfully.
C:\Windows\temp\_avast_\unp185864129.tmp moved successfully.
File\Folder C:\Windows\temp\_avast_\unp206264894.tmp not found!
C:\Windows\temp\_avast_\unp224482664.tmp moved successfully.
C:\Windows\temp\_avast_\unp229988843.tmp moved successfully.
C:\Windows\temp\_avast_\unp266518377.tmp moved successfully.
C:\Windows\temp\_avast_\unp27247496.tmp moved successfully.
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.
PendingFileRenameOperations files...
Registry entries deleted on Reboot..
A navegação continua lenta. A página carrega uns 90% e o restante fica travado.
Boa Tarde! maicon_m
|- O log da OTL veio incompleto!
|- Ps: Não vejo seu problema associado à malware(s).
|- Baixe: < /applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/My%2520Tools%25203/ZHPDiag_Silent.jpg&key=b108c6f3da4b9ebe004c6fc63c6e29fc4f2043056612e16f58c8a6da9600eaea" alt="ZHPDiag_Silent.jpg" /> > ( ... par Nicolas Coolman )
|- Salve-o no desktop!
|- Desabilite seu antivírus!
|- Caso utilize o Avast,estabeleça esta configuração à SandBox.
|- Para Windows Vista ou 7,clique direito e execute o arquivo como administrador.
|- Aguarde a conclusão do scan e clique em "Copier". <- Aguarde!
/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/My%2520Tools%25203/ZHPDiag_4cones.jpg&key=1fa875282159446f710d915aa0f19515c10ea929b8487f1466b6ce34a529ae11" alt="ZHPDiag_4cones.jpg" />
|- Além do relatório,teremos no desktop: ZHP_uninstall, MBRCheck, ZHPDiag, ZHPFix
|- Poste e/ou cole aqui,o link que será gerado,logo após o relatório.
Abs!
DigRam, os arquivos gerados no desktop podem ser apagados?
http://pjjoint.malekal.com/files.php?read=ZHPDiag_20121015_z8g15v12t11u13
Boa Tarde! maicon_m
#####
Total RAM: 4095 MB (16% free)
#####
|- você possui pouca memória RAM disponível ou livre. ( Desinstale Glary )
|- Desinstale softwares que não utiliza ou coloque mais RAM na máquina.
|- Desinstale: C:\Program Files (x86)\uTorrent
DigRam, os arquivos gerados no desktop podem ser apagados?
|- No momento oportuno,serão removidos.
-/-
|- Feche programas/pastas que estejam abertas.
|- Feche,também,o navegador!
|- Para Windows Vista,desabilite a UAC.
/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/My%2520Tools%25203/My%2520Tools%25204/ZHPFix_silent_zps532d2db6.jpg&key=e3bca71d24a0067fad1910903f2d756650c2d526a3a3b4495f41f8a5e073328a" alt="ZHPFix_silent_zps532d2db6.jpg" />
|- Para Windows Vista ou 7,clique direito em ZHPFix.exe e execute-o como administrador.
|- Selecione e copie estas informações,que estão no Code,para o "Bloco de Notas".
[MD5.00000000000000000000000000000000] [APT] [{40CC35BF-A81F-4B8C-B425-F44AF99435AE}] (...) -- C:\Users\Maicon\Desktop\DirectX.exe (.not file.)
[MD5.00000000000000000000000000000000] [APT] [{7483F8CB-F233-4CCE-864A-5697926C9D3A}] (...) -- C:\Users\Maicon\Downloads\Plugins.PS.2011\plugins\Alien Skin Bundle \Alien.Skin.Blow.Up.v2.0.4.Incl.Keymaker-CORE\Alien.Skin.Blow.Up.v2.0.4.Incl.Keymaker-CORE
O43 - CFD: 29/10/2011 - 13:01:01 - [0] ----D C:\Users\Maicon\AppData\Local\Dados de aplicativos
O43 - CFD: 29/10/2011 - 13:01:01 - [0] ----D C:\Users\Maicon\AppData\Local\Histórico
O43 - CFD: 15/10/2012 - 15:23:55 - [0] ----D C:\Users\Maicon\AppData\Local\{9272053F-7D69-42E5-985F-2C24504DC65E}
O51 - MPSK:{46192d01-0244-11e1-aadb-806e6f6e6963}\AutoRun\command. (.LG Electronics - BlueBirds Module.) -- F:\BlueBirds.exe
O53 - SMSR:HKLM\...\startupreg\Octoshape Streaming Services [Key] . (.Octoshape ApS - Main program for Octoshape client.) -- C:\Users\Maicon\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
O87 - FAEL: "{AED13F8D-5D76-4773-A22D-BCCA02CB27D5}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files (x86)\Opera\pluginwrapper\opera_plugin_wrapper.exe (.not file.)
O87 - FAEL: "{A02B4F66-CE5B-442B-9DBB-4CAD944AA1FC}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files (x86)\Opera\pluginwrapper\opera_plugin_wrapper.exe (.not file.)
O87 - FAEL: "TCP Query User{75F347E7-EC91-4474-BB33-6ACAAF4C3B4B}C:\users\maicon\downloads\resident_evil\resident_evil_5\re5dx10.exe" |In - Private - P6 - TRUE | .(...) -- C:\users\maicon\downloads\resident_evil\resident_evil_5\re5dx10.exe (.not file.)
O87 - FAEL: "UDP Query User{452B8EC6-F934-46F6-86B3-C732AD84FCE1}C:\users\maicon\downloads\resident_evil\resident_evil_5\re5dx10.exe" |In - Private - P17 - TRUE | .(...) -- C:\users\maicon\downloads\resident_evil\resident_evil_5\re5dx10.exe (.not file.)
O87 - FAEL: "TCP Query User{31840A30-0094-49BD-93C5-242D1B47861D}C:\users\maicon\downloads\resident_evil\resident_evil_5\re5dx9.exe" |In - Private - P6 - TRUE | .(...) -- C:\users\maicon\downloads\resident_evil\resident_evil_5\re5dx9.exe (.not file.)
O87 - FAEL: "UDP Query User{CB3DE5CC-56B8-46DA-95EE-9A2CAF60D2C6}C:\users\maicon\downloads\resident_evil\resident_evil_5\re5dx9.exe" |In - Private - P17 - TRUE | .(...) -- C:\users\maicon\downloads\resident_evil\resident_evil_5\re5dx9.exe (.not file.)
O87 - FAEL: "TCP Query User{483415B5-138A-4635-8205-CCA32ABEE6FF}C:\windows\kmsemulator.exe" |In - Private - P6 - TRUE | .(...) -- C:\windows\kmsemulator.exe (.not file.) => Infection Diverse (Trojan.Keygen)
O87 - FAEL: "UDP Query User{2A544F41-405C-419F-9A85-0DDC8E21A57C}C:\windows\kmsemulator.exe" |In - Private - P17 - TRUE | .(...) -- C:\windows\kmsemulator.exe (.not file.) => Infection Diverse (Trojan.Keygen)[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: Modified
hostfix
proxyfix
emptytemp
emptyflash
firewallraz
sysrestore
|- Estando com o Bloco de Notas aberto,acione os atalhos: "Ctrl+A" -> "Ctrl+C"
|- Minimize o Bloco de Notas.
/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/My%2520Tools%25203/ZHPDiag_PasteClipboard.jpg&key=e48613cfa6f79756d0d3087d1f9470f91a4d063f3d1285295d93d87cacbfb63d" alt="ZHPDiag_PasteClipboard.jpg" />
|- Clique no menu,"Paste ClipBoard".
|- Clique em "GO" -> Oui.
/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/My%2520Tools%25203/ZHPFix_GO.jpg&key=558fe81face1e694faa61f1e0c3985db203e8ad910d59aa68f5da5f2fd114f02" alt="ZHPFix_GO.jpg" />
|- Ps: Temos,àcima,sequência de imagens para maior exclarecimento.
|- Poste o relatório: C:\ZHP\ZHPFix[R1].txt
Abs!
Rapport de ZHPFix 1.3.01 par Nicolas Coolman, Update du 22/09/2012
Fichier d'export Registre :
Run by Maicon at 15/10/2012 17:09:28
Windows 7 Ultimate Edition, 64-bit Service Pack 1 (Build 7601)
Web site : http://nicolascoolman.skyrock.com/
========== Registry Key ==========
DELETED CLSID MPSK: {46192d01-0244-11e1-aadb-806e6f6e6963}
DELETED Key*: StartupReg: Octoshape Streaming Services
========== Registry Value ==========
DELETED {AED13F8D-5D76-4773-A22D-BCCA02CB27D5}
DELETED {A02B4F66-CE5B-442B-9DBB-4CAD944AA1FC}
NOT FOUND TCP Query User{75F347E7-EC91-4474-BB33-6ACAAF4C3B4B}C:/users/maicon/downloads/resident_evil/resident_evil_5/re5dx10.exe
NOT FOUND UDP Query User{452B8EC6-F934-46F6-86B3-C732AD84FCE1}C:/users/maicon/downloads/resident_evil/resident_evil_5/re5dx10.exe
NOT FOUND TCP Query User{31840A30-0094-49BD-93C5-242D1B47861D}C:/users/maicon/downloads/resident_evil/resident_evil_5/re5dx9.exe
NOT FOUND UDP Query User{CB3DE5CC-56B8-46DA-95EE-9A2CAF60D2C6}C:/users/maicon/downloads/resident_evil/resident_evil_5/re5dx9.exe
NOT FOUND TCP Query User{483415B5-138A-4635-8205-CCA32ABEE6FF}C:/windows/kmsemulator.exe
NOT FOUND UDP Query User{2A544F41-405C-419F-9A85-0DDC8E21A57C}C:/windows/kmsemulator.exe
ProxyFix : Proxy killed successfully
DELETED ProxyServer Value
DELETED ProxyEnable Value
DELETED EnableHttp1_1 Value
DELETED ProxyHttp1.1 Value
DELETED ProxyOverride Value
========== Registry Data Items ==========
REMOVED Explorer Association Data Application: http://www.filefacts.net/redirect.php?ext=%s
========== Repertory ==========
NOT FOUND C:\Users\Maicon\AppData\Local\Dados de aplicativos
NOT FOUND C:\Users\Maicon\AppData\Local\Histórico
DELETED Folder: C:\Users\Maicon\AppData\Local\{9272053F-7D69-42E5-985F-2C24504DC65E}
DELETED Window Temporary:
DELETED Flash Cookies:
========== File ==========
NOT FOUND Folder/File: c:\users\maicon\downloads\plugins.ps.2011\plugins\alien skin bundle \alien.skin.blow.up.v2.0.4.incl.keymaker-core\alien.skin.blow.up.v2.0.4.incl.keymaker-core
DELETE on Reboot f:\bluebirds.exe
DELETED File: c:\users\maicon\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe
DELETED Window Temporary:
DELETED Flash Cookies:
========== Task ==========
DELETED Task: {40CC35BF-A81F-4B8C-B425-F44AF99435AE}
DELETED Task: {7483F8CB-F233-4CCE-864A-5697926C9D3A}
========== Summary ==========
2 : Registry Key
14 : Registry Value
1 : Registry Data Items
5 : Repertory
5 : File
2 : Task
End of clean in 00mn 10s
========== Report File ==========
C:\ZHP\ZHPFix[R1].txt - 15/10/2012 17:09:30 [2590]
Boa Tarde! maicon_m
/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/My%2520Tools%25203/My%2520Tools%25204/ZHP_uninstall_zps01617da3.jpg&key=4c72f6071ce1a6017cbd38c7d970b405f7ad80ff93aa3ea6619a232702a6b035" alt="ZHP_uninstall_zps01617da3.jpg" />
|- Desinstale ZHPDiag,clicando em "ZHP_uninstall".
/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/AdwCleaner_Uninstall2.jpg&key=a9e703e726fc1f13cd20ff066e475a995646652ce2e7d66ac03b110ebe5a8322" alt="AdwCleaner_Uninstall2.jpg" />
|- Abra a ferramenta AdwCleaner e clique em "Uninstall".
-/-
|- Abra o OTL.exe -> Clique em Limpeza. <-- Confirme!
|- Ps: O computador irá reiniciar!
-/-
|- Seus logs estão limpos!
|- Tudo Ok?
Abs!
Obrigado pela atenção e orientações DigRam.
Você pode me dizer qual o resultado de todos esses escaneamentos?
>
Obrigado pela atenção e orientações DigRam.
Você pode me dizer qual o resultado de todos esses escaneamentos?
Olá!
|- Práticamente,remoção de adwares.
|- Seu computador possui softwares desnecessários,o que causa consumo de memória,que seriam úteis em aplicações fundamentais.
|- Ps: Cito como exemplo o Bonjour,Stardock,etc...
|- O plugin de segurança bancária é um estorvo,mas...considero um mal necessário. rsr...
|- O antivírus é outro 'mal' necessário,pois poucos sabem navegar sem sua presença.
Abs!
PROBLEMA RESOLVIDO
Caso o autor necessite que o tópico seja reaberto basta enviar uma Mensagem Privada para um Moderador com um link para o tópico.
Bom Dia! maicon_m
|- Execute escaneamento online em | /applications/core/interface/imageproxy/imageproxy.php?img=http://img237.imageshack.us/img237/223/hh3lp9.jpg&key=b9c458b783f8ec469d9a67ce5b0da9137554ca65f2a7fb5a504f004bef116210" alt="hh3lp9.jpg" /> |
|- Utilize o navegador "Internet Explorer",para essa tarefa!
/applications/core/interface/imageproxy/imageproxy.php?img=http://i1158.photobucket.com/albums/p604/slackwings/th_Nod32.gif&key=c4397e7681bbeefed43d8e7d4a6f8d2c4bec2c6859e58614694a7d384f75ca6b" alt="th_Nod32.gif" />
|- Siga,conforme a imagem,essa verificação ou scan.
/applications/core/interface/imageproxy/imageproxy.php?img=http://t.imgbox.com/abmL2O1b.jpg&key=47927bb59aed84d037fa4c4384dc381a123bbd5d6a4357b1e11941461d9b3c31" alt="abmL2O1b.jpg" />
|- Ao concluir,clique em "List of found threats" >> "Export to text file"
|- Salve esse texto no desktop,com o nome: Esetlog
|- Ps: Caso nada seja detectado,não teremos relatório ou lista presente.
|- Poste o relatório que estará no desktop! ( Esetlog.txt )
Abs!