Usamos cookies para medir audiência e melhorar sua experiência. Você pode aceitar ou recusar a qualquer momento. Veja sobre o iMasters.
Bom dia,
De uns dias pra cá tenho percebido que quando tento postar ou copiar links de download no facebook sempre aparecem com o endereço : https://lookaside.fbsbx.com/
Tem algumas pessoas dizendo que pode ser algum vírus , mas não sei.
Poderiam me ajudar?
Segue log do hijack:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:05:11, on 29/02/2016
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskhost.exe
C:\PROGRA~1\GbPlugin\GbpSv.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\SiS VGA Utilities\SiSTray.exe
C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files\Epson Software\Event Manager\EEventManager.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\System32\C2MP\UpdateChecker.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\System32\C2MP\TrayMenu.exe
C:\Users\Not\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\hijackthis\Trend Micro\HiJackThis\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL
O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\PROGRAM FILES\GBPLUGIN\gbieh.dll
O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\Program Files\GbPlugin\gbiehcef.dll
O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [siSTray] %ProgramFiles%\SiS VGA Utilities\SiSTray.exe
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"
O4 - HKLM\..\Run: [LGODDFU] C:\Program Files\lg_fwupdate\lgfw.exe blrun
O4 - HKLM\..\Run: [EEventManager] "C:\Program Files\Epson Software\Event Manager\EEventManager.exe"
O4 - HKLM\..\Run: [Codec Settings UAC Manager] "C:\Windows\system32\C2MP\CodecUACManager.exe"
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
O4 - HKLM\..\Run: [AdobeCS6ServiceManager] "C:\Program Files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Diebold - Warsaw] C:\Program Files\Diebold\Warsaw\core.exe
O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [EPSON TX133 TX135 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIHJB.EXE /FU "C:\Windows\TEMP\E_S11B.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner.exe" /MONITOR
O4 - HKCU\..\Run: [Codec Pack Update Checker] "C:\Windows\system32\C2MP\UpdateChecker.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Not\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Dropbox Update] "C:\Users\Not\AppData\Local\Dropbox\Update\DropboxUpdate.exe" /cO15 - Trusted Zone: imagem.caixa.gov.br
O15 - Trusted Zone: internetbanking.caixa.gov.br
O15 - Trusted Zone: internetbankingpf.caixa.gov.br
O15 - Trusted Zone: www.caixa.gov.br
O15 - Trusted Zone: http://www.caixa.gov.br
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL
O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O20 - Winlogon Notify: GbPluginBb - C:\Program Files\GbPlugin\gbieh.dll
O20 - Winlogon Notify: GbPluginCef - C:\Program Files\GbPlugin\gbiehCef.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exeO23 - Service: Serviço do Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe--
End of file - 7996 bytes
Bom dia,
Segue link dos relatórios:
http://www.cjoint.com/c/FCbmknmrQsO
http://www.cjoint.com/c/FCbmkSoX7xO
/_ Boa Tarde! carol2906 _\
Copie estas informações que estão em vermelho,para o Bloco de Notas.
Salve-as com o nome fixlist. << Texto!
Salve-as no desktop! ( ***Área de trabalho ...* ) -/- C:\Users\Not\Desktop** <<
start
CloseProcesses:
CHR StartupUrls: Default -> "hxxps://br.search.yahoo.com/?type=888596&fr=yo-yhp-ch","hxxp://www.mystartsearch.com/?type=hp&ts=1427037150&from=wpc&uid=WDCXWD3200BEVT-00ZCT0_WD-WXE409JR7164R7164"
CHR DefaultSearchURL: Default -> hxxp://dts.search.ask.com/web?q={searchTerms}
CHR DefaultSearchKeyword: Default -> Ask Search
CHR Extension: (Ask Search) - C:\Users\Not\AppData\Local\Google\Chrome\User Data\Default\Extensions\mppnoffgpafgpgbaigljliadgbnhljfl [2015-04-20]
CHR Extension: (iLivid) - C:\Users\Not\AppData\Local\Google\Chrome\User Data\Default\Extensions\nafaimnnclfjfedmmabolbppcngeolgf [2015-04-20]
S0 gbpddreg; system32\drivers\gbpddreg32.sys [X]
2015-01-09 17:44 - 2015-01-09 17:44 - 0016559 _____ () C:\Users\Not\AppData\Roaming\unins000.dat
2015-01-09 17:44 - 2015-01-09 17:44 - 0811218 _____ () C:\Users\Not\AppData\Roaming\unins000.exe
2015-01-15 21:55 - 2015-01-15 21:55 - 0016232 _____ () C:\Users\Not\AppData\Roaming\unins001.dat
2015-01-15 21:55 - 2015-01-15 21:55 - 0730322 _____ () C:\Users\Not\AppData\Roaming\unins001.exe
2015-05-14 09:04 - 2015-05-14 09:04 - 0016629 _____ () C:\Users\Not\AppData\Roaming\unins002.dat
2015-05-14 09:04 - 2015-05-14 09:04 - 0815826 _____ () C:\Users\Not\AppData\Roaming\unins002.exe
2015-03-24 13:21 - 2015-03-24 13:21 - 0000292 _____ () C:\Users\Not\AppData\Local\Temp-log.txt
2016-03-01 07:15 - 2016-03-01 07:15 - 00011264 _____ () C:\Users\Not\AppData\Local\Temp\nsmEBE6.tmp\System.dll
CustomCLSID: HKU\S-1-5-21-1918045531-4293645944-74723622-1000_Classes\CLSID\{1423F872-3F7F-4E57-B621-8B1A9D49B448}\InprocServer32 -> C:\Users\Not\AppData\Local\Google\Update\1.3.27.5\psuser.dll => Nenhum Arquivo
CustomCLSID: HKU\S-1-5-21-1918045531-4293645944-74723622-1000_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\Not\AppData\Local\Google\Update\1.3.28.1\psuser.dll => Nenhum Arquivo
CustomCLSID: HKU\S-1-5-21-1918045531-4293645944-74723622-1000_Classes\CLSID\{78550997-5DEF-4A8A-BAF9-D5774E87AC98}\InprocServer32 -> C:\Users\Not\AppData\Local\Google\Update\1.3.28.13\psuser.dll => Nenhum Arquivo
CustomCLSID: HKU\S-1-5-21-1918045531-4293645944-74723622-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Not\AppData\Local\Google\Update\1.3.26.9\psuser.dll => Nenhum Arquivo
CustomCLSID: HKU\S-1-5-21-1918045531-4293645944-74723622-1000_Classes\CLSID\{CC182BE1-84CE-4A57-B85C-FD4BBDF78CB2}\InprocServer32 -> C:\Users\Not\AppData\Local\Google\Update\1.3.29.1\psuser.dll => Nenhum Arquivo
CustomCLSID: HKU\S-1-5-21-1918045531-4293645944-74723622-1000_Classes\CLSID\{D166BD15-03AF-413A-BEFD-0679FF410B49}\InprocServer32 -> C:\Users\Not\AppData\Local\Dropbox\Update\1.3.27.29\psuser.dll => Nenhum Arquivo
CustomCLSID: HKU\S-1-5-21-1918045531-4293645944-74723622-1000_Classes\CLSID\{D1EDC4F5-7F4D-4B12-906A-614ECF66DDAF}\InprocServer32 -> C:\Users\Not\AppData\Local\Google\Update\1.3.28.15\psuser.dll => Nenhum Arquivo
FirewallRules: [TCP Query User{53FD0D53-63D0-4620-9B00-A708CBCF7856}C:\users\not\appdata\local\popcorn time\node-webkit\popcorn time.exe] => (Allow) C:\users\not\appdata\local\popcorn time\node-webkit\popcorn time.exe
FirewallRules: [uDP Query User{A68F4F71-03C9-426C-8A65-540F4948DD7E}C:\users\not\appdata\local\popcorn time\node-webkit\popcorn time.exe] => (Allow) C:\users\not\appdata\local\popcorn time\node-webkit\popcorn time.exeExecute FRST/FRST64 >> Clique "Corrigir" << Aguarde!
Na mensagem,clique Executar.
Poste o relatório! (Fixlog.txt)
/applications/core/interface/imageproxy/imageproxy.php?img=http://r17.imgfast.net/users/1712/29/07/67/smiles/434264.gif&key=8b580fd8c41338fe0925cd84ba4dbbb4293b15fe6a04cbd03d242b4e86624720" alt="434264.gif" />
< Peço aos visitantes que não utilizem este script em outros computadores,sob risco de danos aos mesmos! >
A+
Tópico Arquivado
Como o autor não respondeu por mais de 10 dias, o tópico foi arquivado.
Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura.
/_ Boa Noite! carol2906 _\
< Farbar Recovery Scan Tool 64-Bit >
/applications/core/interface/imageproxy/imageproxy.php?img=http://4.t.imgbox.com/4y9giFrI.jpg&key=e139a576677427cef459662f3742a19b4656d7f6e9c77c567cce8c5cae3c9197" alt="4y9giFrI.jpg" />
/applications/core/interface/imageproxy/imageproxy.php?img=http://i.imgur.com/EUE4tdb.jpg&key=a1493902e025170e24c1db9b5cbad8c87dbfb6dcd8089f17bcd66f77da7e54c1" alt="EUE4tdb.jpg" />
/applications/core/interface/imageproxy/imageproxy.php?img=http://t.imgbox.com/acrVh6GY.jpg&key=a98031df11d71116e6fc6fe6586a03c4ab49a7be484751ed5881cb409d37ce42" alt="acrVh6GY.jpg" />
/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/Copierlelien_zpsd51f499f.jpg&key=660428e74964025a431cba1b51ee2132f7bbee4aaf74172bd3f0a3be25c5b2b1" alt="Copierlelien_zpsd51f499f.jpg" />
A+