[Resolvido] &nbspWindows XP SP3 - lento e travando.

lilobaby · Setembro 5, 2010

Bom dia, meu computador de um tempo para cá está travando muito em qualquer momento, já formatei e voltou a ficar assim, e a explicação que me deram era do meu anti virus KIS 2010 estar fazendo isso, mas o engraçado ou por coincidência antes eu tinha uma net mais lenta da OI 1 mega e agora estou com a GVT 10 megas e depois que mudei o meu CPU ficou esquisito, trava do nada não só a net mas qualquer programa que uso. Se puderem me ajudar ficarei muito agradecida, segue o relatório do HijackThis.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:49:26, on 5/9/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Arquivos de programas\Analog Devices\Core\smax4pnp.exe

C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe

C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe

C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe

C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\Arquivos de programas\Google\Update\GoogleUpdate.exe

C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\mdm.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\HPZipm12.exe

c:\Arquivos de programas\Arquivos comuns\Protexis\License Service\PsiService_2.exe

C:\Arquivos de programas\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Arquivos de programas\VSO\ConvertX\4\convertxtodvd.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe

C:\Arquivos de programas\Mozilla Firefox\plugin-container.exe

C:\Arquivos de programas\IncrediMail\Bin\IncMail.exe

C:\Arquivos de programas\IncrediMail\bin\IMApp.exe

C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll

O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll

O3 - Toolbar: Foxit Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Arquivos de programas\Ask.com\GenericAskToolbar.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [soundMAXPnP] C:\Arquivos de programas\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [AVP] "C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [NBAgent] "C:\Arquivos de programas\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [HP Software Update] "C:\Arquivos de programas\HP\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Arquivos de programas\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" -automount

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\Arquivos de programas\IncrediMail\bin\resources\WebMenuImg.htm

O8 - Extra context menu item: Adicionar ao Antifaixas - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~4\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki... - res://C:\Arquivos de programas\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

O9 - Extra button: &Teclado virtual - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~4\Office12\REFIEBAR.DLL

O9 - Extra button: Veri&ficação de URLs - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Arquivos de programas\PokerStars.NET\PokerStarsUpdate.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1280415710343

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1281061806781

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O20 - AppInit_DLLs: zipfldra.dll,C:\ARQUIV~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\ARQUIV~1\KASPER~1\KASPER~1\kloehk.dll

O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Arquivos de programas\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: @C:\Arquivos de programas\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Arquivos de programas\Nero\Update\NASvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Arquivos de programas\Arquivos comuns\Protexis\License Service\PsiService_2.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Arquivos de programas\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

--

End of file - 9489 bytes

Diogo R · Setembro 6, 2010

Olá lilobaby

Seja Bem Vindo (a)

1.

:veja: Faça o download do '>http://forum-aide-contre-virus.be/download/C_XX/AD-R.exe"]Ad Remover

:veja: Execute o Ad Remover...

:veja: Logo após, tecle --> L <--e depois ENTER <------------

:veja: Durante o processo de remoção será perguntado se deseja remover, Tecle [O]

:veja: Será gerado um Log em C:\Ad-Report-CLEAN.log

:veja: Copie e cole esse log aqui...

2.

:veja: Desative temporiariamente seu AntiVirus

:veja: Utilize o Navegador Internet Explorer para fazer o scaniamento!

:veja: Acesse o site '>http://www.eset.com/onlinescan/index.php"]AQUI

:veja: Faça o scan com o Nod32 de acordo com o flash abaixo:

:veja: Ao final da verificação marque a caixa "Delete Quarantined files" e clique em [FINISH]

:veja: Será gerado um relatório, que estará em:

C:\Arquivos de programas\EsetOnlineScanner\log.txt

Copie e Cole o log aqui...

T+

lilobaby · Setembro 10, 2010

Olá lilobaby

Seja Bem Vindo (a)

1.

:veja: Faça o download do '>http://forum-aide-contre-virus.be/download/C_XX/AD-R.exe"]Ad Remover

:veja: Execute o Ad Remover...

:veja: Logo após, tecle --> L <--e depois ENTER <------------

:veja: Durante o processo de remoção será perguntado se deseja remover, Tecle [O]

:veja: Será gerado um Log em C:\Ad-Report-CLEAN.log

:veja: Copie e cole esse log aqui...

2.

:veja: Desative temporiariamente seu AntiVirus

:veja: Utilize o Navegador Internet Explorer para fazer o scaniamento!

:veja: Acesse o site '>http://www.eset.com/onlinescan/index.php"]AQUI

:veja: Faça o scan com o Nod32 de acordo com o flash abaixo:

:veja: Ao final da verificação marque a caixa "Delete Quarantined files" e clique em [FINISH]

:veja: Será gerado um relatório, que estará em:

C:\Arquivos de programas\EsetOnlineScanner\log.txt

Copie e Cole o log aqui...

T+

Boa noite, obrigada pela atenção, abaixo segue o que foi solicitado:

1)

======= REPORT FROM AD-REMOVER 2.0.0.1,E | ONLY XP/VISTA/7 =======

Updated by C_XX on 06/09/10 at 15:20

Contact: AdRemover.contact[AT]gmail.com

website: http://www.teamxscript.org

C:\Arquivos de programas\Ad-Remover\main.exe (SCAN [1]) -> Launched at 21:38:45 on 09/09/2010, Normal boot

Microsoft Windows XP Professional Service Pack 3 (X86)

xp@PC-LIA ( )

============== SEARCH ==============

0,Folder found: C:\WINDOWS\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

0,File found: C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

0,Folder found: C:\Documents and Settings\xp\Dados de aplicativos\Mozilla\FireFox\Profiles\qs6e31vm.default\extensions\toolbar@ask.com

0,Folder found: C:\Arquivos de programas\Ask.com

0,Folder found: C:\Documents and Settings\xp\Configurações locais\Dados de aplicativos\AskToolbar

3,File found: C:\WINDOWS\Installer\4aab8.msi

-- File opened: C:\Documents and Settings\xp\Dados de aplicativos\Mozilla\FireFox\Profiles\qs6e31vm.default\Prefs.js --

Line found: user_pref("extensions.asktb.cbid", "F4");

Line found: user_pref("extensions.asktb.default-channel-url-mask", "hxxp://www.ask.com/web?q={query}&o={o}&l={l}...

Line found: user_pref("extensions.asktb.dtid", "YYYYYYBCBR");

Line found: user_pref("extensions.asktb.fresh-install", false);

Line found: user_pref("extensions.asktb.l", "dis");

Line found: user_pref("extensions.asktb.last-config-req", "1284066061283");

Line found: user_pref("extensions.asktb.locale", "en_US");

Line found: user_pref("extensions.asktb.o", "101699");

Line found: user_pref("extensions.asktb.overlay-reloaded-using-restart", true);

Line found: user_pref("extensions.asktb.qsrc", "2871");

Line found: user_pref("extensions.asktb.r", "4");

Line found: user_pref("extensions.enabledItems", "{20a82645-c095-46ed-80e3-08825760534b}:1.2.1,jqs@sun.com:1.0,l...

-- File closed --

1,Key found: HKLM\Software\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}

1,Key found: HKLM\Software\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}

1,Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}

1,Key found: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

1,Key found: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}

1,Key found: HKLM\Software\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

1,Key found: HKLM\Software\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

1,Key found: HKLM\Software\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

1,Key found: HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}

0,Key found: HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd

0,Key found: HKLM\Software\Classes\GenericAskToolbar.ToolbarWnd.1

0,Key found: HKLM\Software\Classes\AppID\GenericAskToolbar.DLL

1,Key found: HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

0,Key found: HKLM\Software\Conduit

0,Key found: HKCU\Software\Ask.com

0,Key found: HKCU\Software\AskToolbar

0,Key found: HKCU\Software\Conduit

0,Key found: HKCU\Software\AppDataLow\AskToolbarInfo

3,Key found: HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

3,Key found: HKLM\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

0,Key found: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

0,Value found: HKLM\Software\Microsoft\Internet Explorer\Toolbar|{D4027C7F-154A-4066-A1AD-4243D8127440}

0,Value found: HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser|{D4027C7F-154A-4066-A1AD-4243D8127440}

============== ADDITIONNAL SCAN ==============

** Mozilla Firefox Version [3.6.8 (pt-BR)] **

-- C:\Documents and Settings\xp\Dados de aplicativos\Mozilla\FireFox\Profiles\qs6e31vm.default\Prefs.js --

browser.download.lastDir, C:\\Documents and Settings\\xp\\Desktop\\Testes

browser.startup.homepage, hxxp://www.brturbo.com.br/

browser.startup.homepage_override.mstone, rv:1.9.2.8

========================================

** Internet Explorer Version [8.0.6001.18702] **

[HKCU\Software\Microsoft\Internet Explorer\Main]

Do404Search: 0x01000000

Enable Browser Extensions: yes

Local Page: C:\WINDOWS\system32\blank.htm

Search Page: &hxxp://home.microsoft.com/intl/br/access/allinone.asp

Show_ToolBar: yes

Start Page: hxxp://mystart.incredimail.com/

[HKLM\Software\Microsoft\Internet Explorer\Main]

Default_Page_URL: hxxp://go.microsoft.com/fwlink/?LinkId=69157

Default_Search_URL: hxxp://go.microsoft.com/fwlink/?LinkId=54896

Delete_Temp_Files_On_Exit: yes

Local Page: C:\WINDOWS\system32\blank.htm

Search Page: hxxp://go.microsoft.com/fwlink/?LinkId=54896

Start Page: hxxp://go.microsoft.com/fwlink/?LinkId=69157

[HKLM\Software\Microsoft\Internet Explorer\ABOUTURLS]

Tabs: res://ieframe.dll/tabswelcome.htm

Blank: res://mshtml.dll/blank.htm

========================================

C:\Arquivos de programas\Ad-Remover\Quarantine: 0 File(s)

C:\Arquivos de programas\Ad-Remover\Backup: 1 File(s)

C:\Ad-Report-SCAN[1].txt - 09/09/2010 (1905 Byte(s))

End at: 21:45:36, 09/09/2010

============== E.O.F ==============

2)

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6211

# api_version=3.0.2

# EOSSerial=fd424af2fd28bc4aadc2a164b8e373cd

# end=finished

# remove_checked=true

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2010-09-10 02:38:31

# local_time=2010-09-09 11:38:31 (-0300, Hora oficial do Brasil)

# country="Brazil"

# lang=1033

# osver=5.1.2600 NT Service Pack 3

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=1280 16777191 100 0 2087849 2087849 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=72644

# found=20

# cleaned=20

# scan_time=5641

C:\Documents and Settings\xp\Desktop\PS2\TUTORIAL Converter CD em DVD\tutoriais de conversão cd para dvd\Playstation 2-TUTORIAL 2\Playstation 2-PROGRAMAS.zip probably a variant of Win32/Agent.FDSUVWE trojan (deleted - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\xp\Meus documentos\Pessoal\Assinaturas\Cancelado\DIRECT TV\Sua senha de acesso ao Site de Serviços da DIRECT.htm HTML/Iframe.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\xp\Meus documentos\Pessoal\Assinaturas\COMPRAS - diversas\mercado livre\Manual Câmera fotogr P73\MANUAL EM PORTUGUÊS CÂMERA DIGITAL SONY P 73.htm HTML/Iframe.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\xp\Meus documentos\Pessoal\Assinaturas\COMPRAS - diversas\mercado livre\Manual Câmera fotogr P73\Parabéns! Você é o vencedor da negociação Manual PORTUGUES P.htm HTML/Iframe.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\xp\Meus documentos\Pessoal\Assinaturas\COMPRAS - diversas\mercado livre\Manual Câmera fotogr P73\RE MANUAL EM PORTUGUÊS CÂMERA DIGITAL SONY P 73.htm HTML/Iframe.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\xp\Meus documentos\Pessoal\Assinaturas\COMPRAS - diversas\mercado livre\Manual Câmera fotogr P73\RE RES MANUAL EM PORTUGUÊS CÂMERA DIGITAL SONY P 73.htm HTML/Iframe.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\xp\Meus documentos\Pessoal\Assinaturas\COMPRAS - diversas\mercado livre\squeeze\MercadoLivre Brasil.htm HTML/Iframe.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\xp\Meus documentos\Pessoal\Assinaturas\COMPRAS - diversas\mercado livre\squeeze\Perguntas.htm HTML/Iframe.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\xp\Meus documentos\Pessoal\Assinaturas\COMPRAS - diversas\mercado livre\squeeze\Perguntas_arquivos\org_mkt.htm HTML/Iframe.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\xp\Meus documentos\Pessoal\Assinaturas\COMPRAS - diversas\PS2 MUNDO-SITE\__Seja Bem Vindo__A Maior Loja em Games de Playstation 2 La.htm HTML/Iframe.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\xp\Meus documentos\Pessoal\Assinaturas\MANUAL\Legendas Brasil - Fazendo um DVD-DIKO.htm HTML/Iframe.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\xp\Meus documentos\Pessoal\Assinaturas\MANUAL\PrimeiramenteDIKO.htm HTML/Iframe.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\xp\Meus documentos\Pessoal\Assinaturas\MANUAL\ADSL - D-LINK\CONF. MODEM EM PPPOA.htm HTML/Iframe.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\xp\Meus documentos\Pessoal\Assinaturas\MANUAL\ADSL - D-LINK\CONFIG. ROUTER.htm HTML/Iframe.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\xp\Meus documentos\Pessoal\Assinaturas\Senhas\FOTOGRAFIAS\LOJA DO GORILA.htm HTML/Iframe.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\xp\Meus documentos\Pessoal\Assinaturas\Senhas\Programas\tradutor\registro silicon-Lingo Ware.htm HTML/Iframe.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\xp\Meus documentos\Pessoal\Assinaturas\Senhas\Programas\tradutor\registro silicon-Lingo Ware_arquivos\$d=100$p=1$s=14.htm HTML/Iframe.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\xp\Meus documentos\SONY ERICSSON\programas\a2uploader.exe a variant of Win32/Packed.Themida application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\xp\Meus documentos\SONY ERICSSON\programas\A2_TOOL_PATCH_FIX.rar a variant of Win32/Packed.Themida application (deleted - quarantined) 00000000000000000000000000000000 C

C:\Documents and Settings\xp\Meus documentos\SONY ERICSSON\software\a2uploader+usbdriversrar\a2uploader\a2uploader.exe a variant of Win32/Packed.Themida application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

Diogo R · Setembro 10, 2010

Olá

1.

:veja: Delete a pasta C:\Arquivos de programas\EsetOnlineScanner

2.

:veja: Execute o Ad Remover...

:veja: Clique em "Clean"

:veja: Será gerado um Log em C:\Ad-Report-CLEAN.log

:veja: Copie e cole esse log aqui...

3.

Baixe o Malwarebytes'>http://www.besttechie.net/tools/mbam-setup.exe"]Malwarebytes Anti-Malware

:veja: Inicie a instalação clicando em "mbam-setup.exe"...

:veja: Marque "Atualizar Malwarebytes Anti-Malware" e clique em concluir...

:veja: Execute o programa MalwareBytes Anti Malware...

:veja: Clique na aba: "Verificação", selecione a opção "Verificação completa"....

:veja: Clique então em "Verificar"...

:veja: Selecione tudo que deseja escanear.....

:veja: Clique então em "Verificar"....

:veja: Quando o scan terminar, clique em Ok e em "Mostrar Resultados" para ver o log...

:veja: Se algo for detectado, veja se tudo está marcado e clique em "Remover"....

:veja: Se perguntar se você deseja remover objetos da memória, clica em Sim...

:veja: O log é automaticamente gravado e pode ser consultado clicando em "Logs" do menu principal...

:veja: Copie e cole esse log aqui...

Aguardo seu poste...

T+

lilobaby · Setembro 11, 2010

Mais uma vez obrigada pela atenção, seguem os resultados:

1) pasta deletada.

2)

======= REPORT FROM AD-REMOVER 2.0.0.1,E | ONLY XP/VISTA/7 =======

Updated by C_XX on 06/09/10 at 15:20

Contact: AdRemover.contact[AT]gmail.com

website: http://www.teamxscript.org

C:\Arquivos de programas\Ad-Remover\main.exe (SCAN [2]) -> Launched at 19:49:00 on 10/09/2010, Normal boot