lordkaos 0 Denunciar post Postado Março 4, 2006 Ae galera to com um probleminha aki... no windows estah aparecendo constantemente uma janela com a seguinte mensagem: --------------------------------------------------------------------------------------------- Subsistema MS-DOS de 16 bits >>(titulo) C:\WINDOWS\System32\msbcs.exe A CPU NTVDM encontrou uma instruçao nao permitida. CS:06ea IP:0187 OP:63 75 6d 65 6e Escolha 'fechar' para finalizar o aplicativo --------------------------------------------------------------------------------------------- abri um log com o hijack: Logfile of HijackThis v1.99.1 Scan saved at 02:49:30, on 4/3/2006 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\System32\nvsvc32.exe C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\Arquivos de programas\Java\jre1.5.0_04\bin\jusched.exe C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\System32\cmrss.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\System32\rundll32.exe C:\Arquivos de programas\V3CallCenter\V3faxecp.exe D:\Spyware\guard\sgmain.exe D:\Spyware\guard\sgbhp.exe C:\Arquivos de programas\Internet Explorer\iexplore.exe C:\ARQUIV~1\GETRIGHT\GETRIGHT.EXE C:\Arquivos de programas\Internet Explorer\Iexplore.exe D:\hijack\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = &http://home.microsoft.com/intl/br/access/allinone.asp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - D:\Spyware\guard\dlprotect.dll O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\Downloaded Program Files\CONFLICT.46\gbieh.dll (file missing) O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [systemTray] SysTray.Exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Arquivos de programas\Java\jre1.5.0_04\bin\jusched.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [iK9aE] C:\WINDOWS\cfoxfouu.exe O4 - HKLM\..\Run: [[01]########################################################################### ###################################################] C:\Internet Optimizer\update\rogue.exe O4 - HKLM\..\Run: [bO²ùõö/ØG%)ßfÏNb½¾C:\Arquivos de programas\ISTsvc\istsvc.exe] C:\WINDOWS\cfoxfouu.exe O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [service System] "C:\windows\Desktops .exe" O4 - HKLM\..\Run: [cmrss] C:\WINDOWS\System32\cmrss.exe O4 - HKLM\..\Run: [foxpiyq5752] C:\WINDOWS\help\unicox.exe O4 - HKLM\..\Run: [foxytsv480] C:\WINDOWS\help\wvuh7840.exe O4 - HKLM\..\Run: [foxrcoj8713] C:\WINDOWS\help\wyut3190.exe O4 - HKLM\..\Run: [foxzxfj2233] C:\WINDOWS\help\qiqg1425.exe O4 - HKLM\..\Run: [foxefyj6925] C:\WINDOWS\help\xgih4944.exe O4 - HKLM\..\Run: [foxukog4302] C:\WINDOWS\help\orun9198.exe O4 - HKLM\..\Run: [taskmgr] C:\WINDOWS\System32\msbcs.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [instant Access] rundll32.exe EGACCESS4_1059.dll,InstantAccess O4 - HKCU\..\Run: [MailSkinner] c:\arquivos de programas\mailskinner\mailskinner.exe O4 - Startup: SpywareGuard.lnk = D:\Spyware\guard\sgmain.exe O4 - Global Startup: CallCenter Printer Interface.lnk = C:\Arquivos de programas\V3CallCenter\V3faxecp.exe O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://c:\arquivos de programas\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\arquivos de programas\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\arquivos de programas\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\arquivos de programas\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://c:\arquivos de programas\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\arquivos de programas\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Arquivos de programas\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Arquivos de programas\ICQLite\ICQLite.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {0DA910BC-6919-489E-B584-D9A4AAC7B8DE} - http://scripts.downloadv3.com/binaries/EGD...8_ASPIV4_XP.cab O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com/PhotoUpload/MsnPUpld.cab?10,0,911,0 O16 - DPF: {54579C3D-A58D-4623-B5B5-465552BDA45B} - http://scripts.downloadv3.com/binaries/EGD...2_ASPIV4_XP.cab O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab O16 - DPF: {6AA85413-165C-4200-8154-71166077B22E} - http://scripts.dlv4.com/binaries/IA/sysiasvc32_EN_XP.cab O16 - DPF: {87C1805D-C5AE-4455-AB39-E245BB516136} - http://scripts.dlv4.com/binaries/egaccess4...ss4_1059_XP.cab O16 - DPF: {8D8BAF56-B581-4B90-A549-C4AC6B03F1BB} - http://scripts.downloadv3.com/binaries/EGD...ESS_1074_XP.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downloadv3.com/binaries/IA/...svc32_EN_XP.cab O16 - DPF: {C2481ED1-9896-4D49-AE90-69858DFDE446} - http://scripts.downloadv3.com/binaries/EGD...ESS_1073_XP.cab O16 - DPF: {EC4AFBF3-4540-4306-AF10-4CAC509EA16B} - http://scripts.downloadv3.com/binaries/EGD...4_ASPIV4_XP.cab O16 - DPF: {EFB23983-5803-4914-ADA3-C0EA2CFBDC37} - http://scripts.downloadv3.com/binaries/EGD...ESS_1072_XP.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{124541E2-D516-4CCD-A537-801C38A94333}: NameServer = 200.225.197.37 200.225.197.34 O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe Agradeço muito qm puder me ajudar... :rolleyes: Compartilhar este post Link para o post Compartilhar em outros sites
jgarcia 1 Denunciar post Postado Março 4, 2006 Caro lordkaos, Vamos lá. Baixe o Brute Force Uninstaller em: Brute Force Uninstaller Extraia o arquivo para uma pasta própria, preferencialmente C:\BFU, mas não o execute ainda. Baixe o FindEGDA.vbs em: FindEGDA.vbs Salve-o na sua área de trabalho. Dê um duplo-clique nele para executar. Se o seu antivírus ou bloqueador de scripts reclamar, permita que o FindEGDA seja executado. Ele é inofensivo. Você deve ver uma caixa com uma mensagem parecida com a que segue abaixo: c:\windows\system32\aleatorio.exe -uninstall Clique em OK para confirmar. Abrir-se-á uma janela de confirmação perguntando se você quer realmente efetivar a desinstalação. Confirme e você verá, depois de algum tempo, uma mensagem informando que o programa foi removido. Dê duplo-clique no BFU.exe para executar o Brute Force Uninstaller. Clique no seguinte ícone: Na caixa que aparecer, coloque o seguinte: http://metallica.geekstogo.com/EGDACCESS.bfu Clique em OK e depois em Execute. Espere o aparecimento de uma mensagem confirmando que a execução do script terminou. Clique em OK e depois em Exit. Reinicie o computador em Modo Normal e poste um novo log do HijackThis. Abraços. Compartilhar este post Link para o post Compartilhar em outros sites
lordkaos 0 Denunciar post Postado Março 4, 2006 jgarcia quando eu executei o findegda.vbs nao apareceu nenhuma mensagem, apenas criou um log na minha area de trabalho (runnow.txt)... nao sei c deu certo... dah uma olhado no log agora... obrigado pela ajuda! :thumbsup: Logfile of HijackThis v1.99.1 Scan saved at 13:00:59, on 4/3/2006 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\System32\nvsvc32.exe C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\Arquivos de programas\Java\jre1.5.0_04\bin\jusched.exe C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\System32\cmrss.exe C:\WINDOWS\System32\wuauclt.exe C:\Arquivos de programas\V3CallCenter\V3faxecp.exe C:\WINDOWS\System32\rasautou.exe D:\hijack\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\Searchx.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.spedia.net/cgi-bin/tz.cgi?run=d...ome&uid=3990900 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = &http://home.microsoft.com/intl/br/access/allinone.asp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - D:\Spyware\guard\dlprotect.dll O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\Downloaded Program Files\CONFLICT.46\gbieh.dll (file missing) O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [systemTray] SysTray.Exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Arquivos de programas\Java\jre1.5.0_04\bin\jusched.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [iK9aE] C:\WINDOWS\cfoxfouu.exe O4 - HKLM\..\Run: [[01]########################################################################### ###################################################] C:\Internet Optimizer\update\rogue.exe O4 - HKLM\..\Run: [bO²ùõö/ØG%)ßfÏNb½¾C:\Arquivos de programas\ISTsvc\istsvc.exe] C:\WINDOWS\cfoxfouu.exe O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [service System] "C:\windows\Desktops .exe" O4 - HKLM\..\Run: [cmrss] C:\WINDOWS\System32\cmrss.exe O4 - HKLM\..\Run: [foxpiyq5752] C:\WINDOWS\help\unicox.exe O4 - HKLM\..\Run: [foxytsv480] C:\WINDOWS\help\wvuh7840.exe O4 - HKLM\..\Run: [foxrcoj8713] C:\WINDOWS\help\wyut3190.exe O4 - HKLM\..\Run: [foxzxfj2233] C:\WINDOWS\help\qiqg1425.exe O4 - HKLM\..\Run: [foxefyj6925] C:\WINDOWS\help\xgih4944.exe O4 - HKLM\..\Run: [foxukog4302] C:\WINDOWS\help\orun9198.exe O4 - HKLM\..\Run: [taskmgr] C:\WINDOWS\System32\msbcs.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [instant Access] rundll32.exe EGDACCESS_1073.dll,InstantAccess O4 - Global Startup: CallCenter Printer Interface.lnk = C:\Arquivos de programas\V3CallCenter\V3faxecp.exe O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Search - http://speedbar.myway.com/menusearch.html?p=MG1 O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Arquivos de programas\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Arquivos de programas\ICQLite\ICQLite.exe O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp O16 - DPF: {0DA910BC-6919-489E-B584-D9A4AAC7B8DE} - http://scripts.downloadv3.com/binaries/EGD...8_ASPIV4_XP.cab O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com/PhotoUpload/MsnPUpld.cab?10,0,911,0 O16 - DPF: {54579C3D-A58D-4623-B5B5-465552BDA45B} - http://scripts.downloadv3.com/binaries/EGD...2_ASPIV4_XP.cab O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab O16 - DPF: {6AA85413-165C-4200-8154-71166077B22E} - http://scripts.dlv4.com/binaries/IA/sysiasvc32_EN_XP.cab O16 - DPF: {87C1805D-C5AE-4455-AB39-E245BB516136} - http://scripts.dlv4.com/binaries/egaccess4...ss4_1059_XP.cab O16 - DPF: {8D8BAF56-B581-4B90-A549-C4AC6B03F1BB} - http://scripts.downloadv3.com/binaries/EGD...ESS_1074_XP.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downloadv3.com/binaries/IA/...svc32_EN_XP.cab O16 - DPF: {C2481ED1-9896-4D49-AE90-69858DFDE446} - http://scripts.downloadv3.com/binaries/EGD...ESS_1073_XP.cab O16 - DPF: {EC4AFBF3-4540-4306-AF10-4CAC509EA16B} - http://scripts.downloadv3.com/binaries/EGD...4_ASPIV4_XP.cab O16 - DPF: {EFB23983-5803-4914-ADA3-C0EA2CFBDC37} - http://scripts.downloadv3.com/binaries/EGD...ESS_1072_XP.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe thanks! Compartilhar este post Link para o post Compartilhar em outros sites
jgarcia 1 Denunciar post Postado Março 4, 2006 Caro lordkaos, Vamos lá. Habilite o Windows para mostrar todos os arquivos (até ocultos). Desinstale: --> ISTsvc Utilize Adicionar / Remover programas. Desinstale e reinicie após tê-lo feito. 1ª Etapa Baixe o Killbox em: Killbox Baixe, mas não execute ainda. Baixe o SpySweeper em: SpySweeper Baixe e atualize, mas não execute ainda. 2ª Etapa 1) Execute o Killbox, clique em Delete on Reboot. 2) Copie a lista abaixo em negrito para a área de transferência. Selecione --> Editar --> Copiar. C:\Internet OptimizerC:\Arquivos de programas\ISTsvc C:\WINDOWS\System32\cmrss.exe C:\WINDOWS\System32\msbcs.exe C:\WINDOWS\System32\Searchx.htm C:\WINDOWS\cfoxfouu.exe C:\windows\Desktops.exe C:\WINDOWS\help\unicox.exe C:\WINDOWS\help\wvuh7840.exe C:\WINDOWS\help\wyut3190.exe C:\WINDOWS\help\qiqg1425.exe C:\WINDOWS\help\xgih4944.exe C:\WINDOWS\help\orun9198.exe c:\ex.cab c:\eied_s7.cab 3. Retorne ao Killbox. Clique em File > Paste from clipboard. Clique em All Files. 4. Aperte em "X". Responda "não" à pergunta. É prudente que você faça a impressão deste documento ou salve-o em um lugar de fácil acesso, pois na próxima etapa entraremos em Modo de Seguro e a conexão à internet não será possível. 3ª Etapa Reinicie o computador em Modo Seguro (após reiniciar aperte a tecla F8 até aparecer uma tela preta em DOS e escolha Modo Seguro). Execute o HijackThis, clique em Do a system scan only e marque: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\Searchx.htmR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.spedia.net/cgi-bin/tz.cgi?run=d...ome&uid=3990900 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm O4 - HKLM\..\Run: [iK9aE] C:\WINDOWS\cfoxfouu.exe O4 - HKLM\..\Run: [[01]########################################################################### ###################################################] C:\Internet Optimizer\update\rogue.exe O4 - HKLM\..\Run: [bO²ùõö/ØG%)ßfÏNb½¾C:\Arquivos de programas\ISTsvc\istsvc.exe] C:\WINDOWS\cfoxfouu.exe O4 - HKLM\..\Run: [service System] "C:\windows\Desktops .exe" O4 - HKLM\..\Run: [cmrss] C:\WINDOWS\System32\cmrss.exe O4 - HKLM\..\Run: [foxpiyq5752] C:\WINDOWS\help\unicox.exe O4 - HKLM\..\Run: [foxytsv480] C:\WINDOWS\help\wvuh7840.exe O4 - HKLM\..\Run: [foxrcoj8713] C:\WINDOWS\help\wyut3190.exe O4 - HKLM\..\Run: [foxzxfj2233] C:\WINDOWS\help\qiqg1425.exe O4 - HKLM\..\Run: [foxefyj6925] C:\WINDOWS\help\xgih4944.exe O4 - HKLM\..\Run: [foxukog4302] C:\WINDOWS\help\orun9198.exe O4 - HKLM\..\Run: [taskmgr] C:\WINDOWS\System32\msbcs.exe O4 - HKCU\..\Run: [instant Access] rundll32.exe EGDACCESS_1073.dll,InstantAccess O16 - DPF: {0DA910BC-6919-489E-B584-D9A4AAC7B8DE} - http://scripts.downloadv3.com/binaries/EGD...8_ASPIV4_XP.cab O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab O16 - DPF: {54579C3D-A58D-4623-B5B5-465552BDA45B} - http://scripts.downloadv3.com/binaries/EGD...2_ASPIV4_XP.cab O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab O16 - DPF: {6AA85413-165C-4200-8154-71166077B22E} - http://scripts.dlv4.com/binaries/IA/sysiasvc32_EN_XP.cab O16 - DPF: {87C1805D-C5AE-4455-AB39-E245BB516136} - http://scripts.dlv4.com/binaries/egaccess4...ss4_1059_XP.cab O16 - DPF: {8D8BAF56-B581-4B90-A549-C4AC6B03F1BB} - http://scripts.downloadv3.com/binaries/EGD...ESS_1074_XP.cab O16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downloadv3.com/binaries/IA/...svc32_EN_XP.cab O16 - DPF: {C2481ED1-9896-4D49-AE90-69858DFDE446} - http://scripts.downloadv3.com/binaries/EGD...ESS_1073_XP.cab O16 - DPF: {EC4AFBF3-4540-4306-AF10-4CAC509EA16B} - http://scripts.downloadv3.com/binaries/EGD...4_ASPIV4_XP.cab O16 - DPF: {EFB23983-5803-4914-ADA3-C0EA2CFBDC37} - http://scripts.downloadv3.com/binaries/EGD...ESS_1072_XP.cab Clique em Fix Checked. 4ª Etapa Ainda em Modo Seguro faça o seguinte: 1) Localize e delete: EGDACCESS_1073.dll 2) Execute uma verificação completa com o SpySweeper. 5ª Etapa Reinicie em modo normal. Retorne com um novo log do HijackThis. Um abraço. Compartilhar este post Link para o post Compartilhar em outros sites
lordkaos 0 Denunciar post Postado Março 5, 2006 Habilite o Windows para mostrar todos os arquivos (até ocultos). Desinstale: --> ISTsvc Utilize Adicionar / Remover programas. caro jgarcia, nao consegui desinstalar ISTsvc. nao aparece no Adicionar / Remover programas. e agora? vlw :( Compartilhar este post Link para o post Compartilhar em outros sites
jgarcia 1 Denunciar post Postado Março 6, 2006 nao aparece no Adicionar / Remover programas.e agora? Passe para a próxima etapa. Compartilhar este post Link para o post Compartilhar em outros sites
Shine 0 Denunciar post Postado Outubro 2, 2006 TÓPICO ARQUIVADO Como o autor não respondeu por mais de 20 dias, o tópico foi arquivado. Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura. Compartilhar este post Link para o post Compartilhar em outros sites
