[Resolvido!]safetyuptodate

valgom · Junho 8, 2006

Olá peço ajuda em remover a pagina inicial "safetyuptodate" em meu microjá rodei o programa indicado por jgarcia o que faço depois?abrços

jgarcia · Junho 9, 2006

já rodei o programa indicado por jgarcia o que faço depois?

Poste o log gerado aqui neste mesmo tópico.

Abraços.

valgom · Junho 9, 2006

Olá bom dia jgarcia...

conforme orientação segue

grato

Logfile of HijackThis v1.99.1

Scan saved at 16:54:21, on 08/06/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Network Associates\Common Framework\FrameworkService.exe

C:\Arquivos de programas\Network Associates\VirusScan\Mcshield.exe

C:\Arquivos de programas\Network Associates\VirusScan\VsTskMgr.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\ARQUIV~1\NETWOR~1\COMMON~1\naPrdMgr.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\Explorer.EXE

C:\Arquivos de programas\Network Associates\Common Framework\UpdaterUI.exe

C:\Arquivos de programas\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Arquivos de programas\Network Associates\VirusScan\SHSTAT.EXE

C:\Arquivos de programas\Arquivos comuns\Network Associates\TalkBack\TBMon.exe

C:\Arquivos de programas\Java\jre1.5.0_03\bin\jusched.exe

C:\Arquivos de programas\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe

C:\Program Files\ASUS\Asus Probe\AsusProb.exe

C:\forum\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.uol.com.br/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = &http://home.microsoft.com/intl/br/access/allinone.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Nothing - {686a161d-5bd1-4999-8832-6393f41e564c} - C:\WINDOWS\system32\hp100.tmp

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\arquivos de programas\google\googletoolbar2.dll

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\WINDOWS\Downloaded Program Files\gbieh.dll

O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\arquivos de programas\google\googletoolbar2.dll

O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] C:\Arquivos de programas\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

O4 - HKLM\..\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [shStatEXE] "C:\Arquivos de programas\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Arquivos de programas\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Arquivos de programas\Arquivos comuns\Network Associates\TalkBack\TBMon.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Arquivos de programas\Java\jre1.5.0_03\bin\jusched.exe

O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Asus Probe\AsusProb.exe

O8 - Extra context menu item: &Pesquisa do Google - res://c:\arquivos de programas\google\GoogleToolbar2.dll/cmsearch.html

O8 - Extra context menu item: &Traduzir palavra em inglês - res://c:\arquivos de programas\google\GoogleToolbar2.dll/cmwordtrans.html

O8 - Extra context menu item: Instantâneo da página em cache - res://c:\arquivos de programas\google\GoogleToolbar2.dll/cmcache.html

O8 - Extra context menu item: Links para esta página - res://c:\arquivos de programas\google\GoogleToolbar2.dll/cmbacklinks.html

O8 - Extra context menu item: Páginas semelhantes - res://c:\arquivos de programas\google\GoogleToolbar2.dll/cmsimilar.html

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399F83} (GbPluginObj Class) - https://www14.bancobrasil.com.br/plugin/GbPluginBb.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{1AADAB28-FB78-425A-9A33-C9FAFA0D7A4C}: NameServer = 216.157.145.12,216.157.145.13

O17 - HKLM\System\CCS\Services\Tcpip\..\{F54398AA-D239-4D0B-9FAB-25AFAC06DC33}: NameServer = 201.10.120.2,192.168.0.1

O17 - HKLM\System\CS1\Services\Tcpip\..\{1AADAB28-FB78-425A-9A33-C9FAFA0D7A4C}: NameServer = 216.157.145.12,216.157.145.13

O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Arquivos de programas\McAfee\McAfee VirusScan\Avsynmgr.exe (file missing)

O23 - Service: Serviço McAfee Framework (McAfeeFramework) - Unknown owner - C:\Arquivos de programas\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart (file missing)

O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Arquivos de programas\Network Associates\VirusScan\Mcshield.exe

O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Arquivos de programas\Network Associates\VirusScan\VsTskMgr.exe

jgarcia · Junho 11, 2006

Opa valgom,

1. Baixe o SmitfraudFix;

2. Desabilite a proteção do seu anti-vírus (temporariamente);

3. Extraia o arquivo SmitFraudFix para o seu desktop;

4. Reinicie em Modo Seguro;

5. Execute o SmitfraudFix --> Opção 2;

6. Responda sim (oui) à pergunta sobre a limpeza no registro;

7. Aguarde o término do scan e a geração do log;

8. Reinicie em Modo Normal;

9. Poste o log do SmitfraudFix (opção 2) + log HijackThis (gerado em Modo Normal).

Aguardo retorno.

Abraços.

valgom · Junho 12, 2006

Bom dia Jgarcia,

muito obrigado por me ajudar a eliminar o problema "safetyuptodate"

não sou muito bom em discurso, mas é bom saber que tem pessoas dispostas a ajudar gente como eu

leigo em software, a curiosidade muitas vezes deixa-nos em situações difícieis. Mais uma vez muito obrigado, um abraço e bom trabalho...

segue log "smitfraudfix

SmitFraudFix v2.59

Scan done at 8:02:27,47, 12/06/2006

Run from C:\Documents and Settings\Valdir\Desktop

OS: Microsoft Windows XP [versÆo 5.1.2600] - Windows_NT

Fix ran in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix

!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\atmclk.exe Deleted

C:\WINDOWS\system32\dcomcfg.exe Deleted

C:\WINDOWS\system32\hp???.tmp Deleted

C:\WINDOWS\system32\ld????.tmp Deleted

C:\WINDOWS\system32\migicons.exe Deleted

C:\WINDOWS\system32\regperf.exe Deleted

C:\WINDOWS\system32\simpole.tlb Deleted

C:\WINDOWS\system32\stdole3.tlb Deleted

C:\WINDOWS\system32\1024\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix

!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

log HijackThis