[Arquivado] problema com msbcs.exe

[lordkaos 0]

Ae galera to com um probleminha aki... no windows estah aparecendo constantemente uma janela com a seguinte mensagem:

 

---------------------------------------------------------------------------------------------

Subsistema MS-DOS de 16 bits >>(titulo)

 

C:\WINDOWS\System32\msbcs.exe

A CPU NTVDM encontrou uma instruçao nao permitida.

CS:06ea IP:0187 OP:63 75 6d 65 6e Escolha 'fechar' para finalizar o aplicativo

---------------------------------------------------------------------------------------------

 

abri um log com o hijack:

 

Logfile of HijackThis v1.99.1

Scan saved at 02:49:30, on 4/3/2006

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Java\jre1.5.0_04\bin\jusched.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\System32\cmrss.exe

C:\WINDOWS\System32\ctfmon.exe

C:\WINDOWS\System32\rundll32.exe

C:\Arquivos de programas\V3CallCenter\V3faxecp.exe

D:\Spyware\guard\sgmain.exe

D:\Spyware\guard\sgbhp.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\ARQUIV~1\GETRIGHT\GETRIGHT.EXE

C:\Arquivos de programas\Internet Explorer\Iexplore.exe

D:\hijack\HijackThis.exe

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = &http://home.microsoft.com/intl/br/access/allinone.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm

O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - D:\Spyware\guard\dlprotect.dll

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\Downloaded Program Files\CONFLICT.46\gbieh.dll (file missing)

O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [systemTray] SysTray.Exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Arquivos de programas\Java\jre1.5.0_04\bin\jusched.exe

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [iK9aE] C:\WINDOWS\cfoxfouu.exe

O4 - HKLM\..\Run: [[01]###########################################################################

###################################################] C:\Internet Optimizer\update\rogue.exe

O4 - HKLM\..\Run: [bO²ùõö/ØG%)ßfÏNb½¾C:\Arquivos de programas\ISTsvc\istsvc.exe] C:\WINDOWS\cfoxfouu.exe

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [service System] "C:\windows\Desktops .exe"

O4 - HKLM\..\Run: [cmrss] C:\WINDOWS\System32\cmrss.exe

O4 - HKLM\..\Run: [foxpiyq5752] C:\WINDOWS\help\unicox.exe

O4 - HKLM\..\Run: [foxytsv480] C:\WINDOWS\help\wvuh7840.exe

O4 - HKLM\..\Run: [foxrcoj8713] C:\WINDOWS\help\wyut3190.exe

O4 - HKLM\..\Run: [foxzxfj2233] C:\WINDOWS\help\qiqg1425.exe

O4 - HKLM\..\Run: [foxefyj6925] C:\WINDOWS\help\xgih4944.exe

O4 - HKLM\..\Run: [foxukog4302] C:\WINDOWS\help\orun9198.exe

O4 - HKLM\..\Run: [taskmgr] C:\WINDOWS\System32\msbcs.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [instant Access] rundll32.exe EGACCESS4_1059.dll,InstantAccess

O4 - HKCU\..\Run: [MailSkinner] c:\arquivos de programas\mailskinner\mailskinner.exe

O4 - Startup: SpywareGuard.lnk = D:\Spyware\guard\sgmain.exe

O4 - Global Startup: CallCenter Printer Interface.lnk = C:\Arquivos de programas\V3CallCenter\V3faxecp.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: &Google Search - res://c:\arquivos de programas\google\GoogleToolbar2.dll/cmsearch.html

O8 - Extra context menu item: &Translate English Word - res://c:\arquivos de programas\google\GoogleToolbar2.dll/cmwordtrans.html

O8 - Extra context menu item: Backward Links - res://c:\arquivos de programas\google\GoogleToolbar2.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://c:\arquivos de programas\google\GoogleToolbar2.dll/cmcache.html

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Similar Pages - res://c:\arquivos de programas\google\GoogleToolbar2.dll/cmsimilar.html

O8 - Extra context menu item: Translate Page into English - res://c:\arquivos de programas\google\GoogleToolbar2.dll/cmtrans.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Arquivos de programas\ICQLite\ICQLite.exe

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Arquivos de programas\ICQLite\ICQLite.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {0DA910BC-6919-489E-B584-D9A4AAC7B8DE} - http://scripts.downloadv3.com/binaries/EGD...8_ASPIV4_XP.cab

O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab

O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab

O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com/PhotoUpload/MsnPUpld.cab?10,0,911,0

O16 - DPF: {54579C3D-A58D-4623-B5B5-465552BDA45B} - http://scripts.downloadv3.com/binaries/EGD...2_ASPIV4_XP.cab

O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab

O16 - DPF: {6AA85413-165C-4200-8154-71166077B22E} - http://scripts.dlv4.com/binaries/IA/sysiasvc32_EN_XP.cab

O16 - DPF: {87C1805D-C5AE-4455-AB39-E245BB516136} - http://scripts.dlv4.com/binaries/egaccess4...ss4_1059_XP.cab

O16 - DPF: {8D8BAF56-B581-4B90-A549-C4AC6B03F1BB} - http://scripts.downloadv3.com/binaries/EGD...ESS_1074_XP.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downloadv3.com/binaries/IA/...svc32_EN_XP.cab

O16 - DPF: {C2481ED1-9896-4D49-AE90-69858DFDE446} - http://scripts.downloadv3.com/binaries/EGD...ESS_1073_XP.cab

O16 - DPF: {EC4AFBF3-4540-4306-AF10-4CAC509EA16B} - http://scripts.downloadv3.com/binaries/EGD...4_ASPIV4_XP.cab

O16 - DPF: {EFB23983-5803-4914-ADA3-C0EA2CFBDC37} - http://scripts.downloadv3.com/binaries/EGD...ESS_1072_XP.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{124541E2-D516-4CCD-A537-801C38A94333}: NameServer = 200.225.197.37 200.225.197.34

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

 

 

 

Agradeço muito qm puder me ajudar...

:rolleyes:

[jgarcia 1]

Caro lordkaos,

 

Vamos lá.

 

Baixe o Brute Force Uninstaller em:

Brute Force Uninstaller

 

Extraia o arquivo para uma pasta própria, preferencialmente C:\BFU, mas não o execute ainda.

 

Baixe o FindEGDA.vbs em:

FindEGDA.vbs

 

Salve-o na sua área de trabalho.

 

Dê um duplo-clique nele para executar. Se o seu antivírus ou bloqueador de scripts reclamar, permita que o FindEGDA seja executado. Ele é inofensivo.

 

Você deve ver uma caixa com uma mensagem parecida com a que segue abaixo:

 

c:\windows\system32\aleatorio.exe -uninstall

Clique em OK para confirmar.

 

Abrir-se-á uma janela de confirmação perguntando se você quer realmente efetivar a desinstalação. Confirme e você verá, depois de algum tempo, uma mensagem informando que o programa foi removido.

 

Dê duplo-clique no BFU.exe para executar o Brute Force Uninstaller.

 

Clique no seguinte ícone:

 

Na caixa que aparecer, coloque o seguinte:

http://metallica.geekstogo.com/EGDACCESS.bfu

Clique em OK e depois em Execute.

 

Espere o aparecimento de uma mensagem confirmando que a execução do script terminou.

 

Clique em OK e depois em Exit.

 

Reinicie o computador em Modo Normal e poste um novo log do HijackThis.

 

Abraços.

[lordkaos 0]

jgarcia quando eu executei o findegda.vbs nao apareceu nenhuma mensagem, apenas criou um log na minha area de trabalho (runnow.txt)... nao sei c deu certo... dah uma olhado no log agora...

obrigado pela ajuda!

:thumbsup:

 

 

Logfile of HijackThis v1.99.1

Scan saved at 13:00:59, on 4/3/2006

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Java\jre1.5.0_04\bin\jusched.exe

C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\System32\cmrss.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Arquivos de programas\V3CallCenter\V3faxecp.exe

C:\WINDOWS\System32\rasautou.exe

D:\hijack\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\Searchx.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.spedia.net/cgi-bin/tz.cgi?run=d...ome&uid=3990900

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = &http://home.microsoft.com/intl/br/access/allinone.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm

O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - D:\Spyware\guard\dlprotect.dll

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\Downloaded Program Files\CONFLICT.46\gbieh.dll (file missing)

O3 - Toolbar: &Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [systemTray] SysTray.Exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Arquivos de programas\Java\jre1.5.0_04\bin\jusched.exe

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [iK9aE] C:\WINDOWS\cfoxfouu.exe

O4 - HKLM\..\Run: [[01]###########################################################################

###################################################] C:\Internet Optimizer\update\rogue.exe

O4 - HKLM\..\Run: [bO²ùõö/ØG%)ßfÏNb½¾C:\Arquivos de programas\ISTsvc\istsvc.exe] C:\WINDOWS\cfoxfouu.exe

O4 - HKLM\..\Run: [avast!] C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [service System] "C:\windows\Desktops .exe"

O4 - HKLM\..\Run: [cmrss] C:\WINDOWS\System32\cmrss.exe

O4 - HKLM\..\Run: [foxpiyq5752] C:\WINDOWS\help\unicox.exe

O4 - HKLM\..\Run: [foxytsv480] C:\WINDOWS\help\wvuh7840.exe

O4 - HKLM\..\Run: [foxrcoj8713] C:\WINDOWS\help\wyut3190.exe

O4 - HKLM\..\Run: [foxzxfj2233] C:\WINDOWS\help\qiqg1425.exe

O4 - HKLM\..\Run: [foxefyj6925] C:\WINDOWS\help\xgih4944.exe

O4 - HKLM\..\Run: [foxukog4302] C:\WINDOWS\help\orun9198.exe

O4 - HKLM\..\Run: [taskmgr] C:\WINDOWS\System32\msbcs.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Arquivos de programas\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [msnmsgr] "C:\Arquivos de programas\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [instant Access] rundll32.exe EGDACCESS_1073.dll,InstantAccess

O4 - Global Startup: CallCenter Printer Interface.lnk = C:\Arquivos de programas\V3CallCenter\V3faxecp.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Arquivos de programas\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: &Search - http://speedbar.myway.com/menusearch.html?p=MG1

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Arquivos de programas\ICQLite\ICQLite.exe

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Arquivos de programas\ICQLite\ICQLite.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {0DA910BC-6919-489E-B584-D9A4AAC7B8DE} - http://scripts.downloadv3.com/binaries/EGD...8_ASPIV4_XP.cab

O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab

O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab

O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com/PhotoUpload/MsnPUpld.cab?10,0,911,0

O16 - DPF: {54579C3D-A58D-4623-B5B5-465552BDA45B} - http://scripts.downloadv3.com/binaries/EGD...2_ASPIV4_XP.cab

O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab

O16 - DPF: {6AA85413-165C-4200-8154-71166077B22E} - http://scripts.dlv4.com/binaries/IA/sysiasvc32_EN_XP.cab

O16 - DPF: {87C1805D-C5AE-4455-AB39-E245BB516136} - http://scripts.dlv4.com/binaries/egaccess4...ss4_1059_XP.cab

O16 - DPF: {8D8BAF56-B581-4B90-A549-C4AC6B03F1BB} - http://scripts.downloadv3.com/binaries/EGD...ESS_1074_XP.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downloadv3.com/binaries/IA/...svc32_EN_XP.cab

O16 - DPF: {C2481ED1-9896-4D49-AE90-69858DFDE446} - http://scripts.downloadv3.com/binaries/EGD...ESS_1073_XP.cab

O16 - DPF: {EC4AFBF3-4540-4306-AF10-4CAC509EA16B} - http://scripts.downloadv3.com/binaries/EGD...4_ASPIV4_XP.cab

O16 - DPF: {EFB23983-5803-4914-ADA3-C0EA2CFBDC37} - http://scripts.downloadv3.com/binaries/EGD...ESS_1072_XP.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\ARQUIV~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe

 

thanks!

[jgarcia 1]

Caro lordkaos,

 

Vamos lá.

 

Habilite o Windows para mostrar todos os arquivos (até ocultos).

 

Desinstale:

--> ISTsvc

 

Utilize Adicionar / Remover programas.

 

Desinstale e reinicie após tê-lo feito.

 

1ª Etapa

 

Baixe o Killbox em:

Killbox

 

Baixe, mas não execute ainda.

 

Baixe o SpySweeper em:

SpySweeper

 

Baixe e atualize, mas não execute ainda.

 

2ª Etapa

 

1) Execute o Killbox, clique em Delete on Reboot.

 

2) Copie a lista abaixo em negrito para a área de transferência. Selecione --> Editar --> Copiar.

C:\Internet Optimizer

C:\Arquivos de programas\ISTsvc

C:\WINDOWS\System32\cmrss.exe

C:\WINDOWS\System32\msbcs.exe

C:\WINDOWS\System32\Searchx.htm

C:\WINDOWS\cfoxfouu.exe

C:\windows\Desktops.exe

C:\WINDOWS\help\unicox.exe

C:\WINDOWS\help\wvuh7840.exe

C:\WINDOWS\help\wyut3190.exe

C:\WINDOWS\help\qiqg1425.exe

C:\WINDOWS\help\xgih4944.exe

C:\WINDOWS\help\orun9198.exe

c:\ex.cab

c:\eied_s7.cab

3. Retorne ao Killbox. Clique em File > Paste from clipboard. Clique em All Files.

 

4. Aperte em "X". Responda "não" à pergunta.

 

É prudente que você faça a impressão deste documento ou salve-o em um lugar de fácil acesso, pois na próxima etapa entraremos em Modo de Seguro e a conexão à internet não será possível.

 

3ª Etapa

 

Reinicie o computador em Modo Seguro (após reiniciar aperte a tecla F8 até aparecer uma tela preta em DOS e escolha Modo Seguro).

 

Execute o HijackThis, clique em Do a system scan only e marque:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\Searchx.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.spedia.net/cgi-bin/tz.cgi?run=d...ome&uid=3990900

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm

O4 - HKLM\..\Run: [iK9aE] C:\WINDOWS\cfoxfouu.exe

O4 - HKLM\..\Run: [[01]###########################################################################

 

###################################################] C:\Internet Optimizer\update\rogue.exe

O4 - HKLM\..\Run: [bO²ùõö/ØG%)ßfÏNb½¾C:\Arquivos de programas\ISTsvc\istsvc.exe] C:\WINDOWS\cfoxfouu.exe

O4 - HKLM\..\Run: [service System] "C:\windows\Desktops .exe"

O4 - HKLM\..\Run: [cmrss] C:\WINDOWS\System32\cmrss.exe

O4 - HKLM\..\Run: [foxpiyq5752] C:\WINDOWS\help\unicox.exe

O4 - HKLM\..\Run: [foxytsv480] C:\WINDOWS\help\wvuh7840.exe

O4 - HKLM\..\Run: [foxrcoj8713] C:\WINDOWS\help\wyut3190.exe

O4 - HKLM\..\Run: [foxzxfj2233] C:\WINDOWS\help\qiqg1425.exe

O4 - HKLM\..\Run: [foxefyj6925] C:\WINDOWS\help\xgih4944.exe

O4 - HKLM\..\Run: [foxukog4302] C:\WINDOWS\help\orun9198.exe

O4 - HKLM\..\Run: [taskmgr] C:\WINDOWS\System32\msbcs.exe

O4 - HKCU\..\Run: [instant Access] rundll32.exe EGDACCESS_1073.dll,InstantAccess

O16 - DPF: {0DA910BC-6919-489E-B584-D9A4AAC7B8DE} - http://scripts.downloadv3.com/binaries/EGD...8_ASPIV4_XP.cab

O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab

O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab

O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab

O16 - DPF: {54579C3D-A58D-4623-B5B5-465552BDA45B} - http://scripts.downloadv3.com/binaries/EGD...2_ASPIV4_XP.cab

O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab

O16 - DPF: {6AA85413-165C-4200-8154-71166077B22E} - http://scripts.dlv4.com/binaries/IA/sysiasvc32_EN_XP.cab

O16 - DPF: {87C1805D-C5AE-4455-AB39-E245BB516136} - http://scripts.dlv4.com/binaries/egaccess4...ss4_1059_XP.cab

O16 - DPF: {8D8BAF56-B581-4B90-A549-C4AC6B03F1BB} - http://scripts.downloadv3.com/binaries/EGD...ESS_1074_XP.cab

O16 - DPF: {B2B0AEDF-7CDF-4792-BB67-7654AD1E1B13} - http://scripts.downloadv3.com/binaries/IA/...svc32_EN_XP.cab

O16 - DPF: {C2481ED1-9896-4D49-AE90-69858DFDE446} - http://scripts.downloadv3.com/binaries/EGD...ESS_1073_XP.cab

O16 - DPF: {EC4AFBF3-4540-4306-AF10-4CAC509EA16B} - http://scripts.downloadv3.com/binaries/EGD...4_ASPIV4_XP.cab

O16 - DPF: {EFB23983-5803-4914-ADA3-C0EA2CFBDC37} - http://scripts.downloadv3.com/binaries/EGD...ESS_1072_XP.cab

Clique em Fix Checked.

 

4ª Etapa

 

Ainda em Modo Seguro faça o seguinte:

 

1) Localize e delete:

EGDACCESS_1073.dll

 

2) Execute uma verificação completa com o SpySweeper.

 

5ª Etapa

 

Reinicie em modo normal.

 

Retorne com um novo log do HijackThis.

 

Um abraço.

[lordkaos 0]

Habilite o Windows para mostrar todos os arquivos (até ocultos).

 

Desinstale:

--> ISTsvc

 

Utilize Adicionar / Remover programas.

 

caro jgarcia, nao consegui desinstalar ISTsvc.

nao aparece no Adicionar / Remover programas.

e agora?

 

vlw

:(

[jgarcia 1]

nao aparece no Adicionar / Remover programas.

e agora?

Passe para a próxima etapa.

[Shine 0]

TÓPICO ARQUIVADO

 

Como o autor não respondeu por mais de 20 dias, o tópico foi arquivado.

 

Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada

para um moderador da área juntamente com o link para este tópico e explique

o motivo da reabertura.