[Arquivado] &nbspCADASTRO.1.Exe

O.Aprendiz.CSS · Outubro 13, 2011

Prezados,

muito bom dia a todos, e de ante mão agradeço a todos pela preciosa contribuição que sempre nos é dada para resolver "pequenos problemas" em nossa vida digital.

Pois bem, vamos lá. De alguns dias para cá, tenho reparado meu PC extremamente lento e com o Firefox travando de 2 em 2 minutos, depois que eu instalei o anti-vírus Protect Invação fornecido pela GVT, até aí digamos que seja normal por ele ter modificado configurações que com certeza fizeram isto.

Bom mais daí eu passeando por processos que por ventura pudessem fazer minha máquina ficar um pouco mais rápida, encontro na inicialização dela o seguinte programa,

Cadastro.1.exe C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cadastro.1.exe

Se não bastasse encontrei agora o Domino.exe, pois bem estes são meus "pequenos problemas" de hoje já tentei removê-los e não consigo, pois não aparecem na lista de softwares do windows apenas no iniciador do CCleaner.

Segue abaixo o meu LOG.

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 09:07:27, on 13/10/2011

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16869)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

D:\install\HiJackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\PROGRAM FILES (X86)\GBPLUGIN\gbieh.dll

O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\Program Files (x86)\GbPlugin\gbiehCef.dll

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O15 - Trusted Zone: www.bancobrasil.com.br

O15 - Trusted Zone: www14.bancobrasil.com.br

O15 - Trusted Zone: www2.bancobrasil.com.br

O15 - Trusted Zone: www.bb.com.br

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O20 - Winlogon Notify: GbPluginBb - C:\PROGRAM FILES (X86)\GBPLUGIN\gbieh.dll

O20 - Winlogon Notify: GbPluginCef - C:\Program Files (x86)\GbPlugin\gbiehCef.dll

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - Unknown owner - C:\Program Files (x86)\GVT\Protect\Anti-Virus\fsgk32st.exe

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files (x86)\GVT\Protect\FWES\Program\fsdfwd.exe

O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files (x86)\GVT\Protect\Common\FSMA32.EXE

O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files (x86)\GVT\Protect\ORSP Client\fsorsp.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

ESPERO QUE POSSAM ME AJUDAR, POIS PELO NOME A COISA NÃO É AMIGÁVEL NÃO.

Um grande abraço a todos e muito obrigado.

Felipe_88 · Outubro 14, 2011

Boa noite!

Vamos por etapa...

1.

*Baixe o AD-Remover e salve-o no desktop

*Execute-o, clique [Clean] > [sim] > [OK] > [sim]. O PC poderá ser reiniciado

*Cole o relatório C:\Ad-Report-CLEAN[1].txt

2.

*Baixe o USBFix e salve-o no desktop

*Conecte o pen drive no PC, execute-o e clique [Pesquisa]

*Cole o relatório apresentado

O.Aprendiz.CSS · Outubro 14, 2011

Bom primeira etapa conclusa, segue relatório.

======= REPORT FROM AD-REMOVER 2.0.0.2,G | ONLY XP/VISTA/7 =======

Updated by TeamXscript on 12/04/11

Contact: AdRemover[DOT]contact[AT]gmail[DOT]com

website: http://www.teamxscript.org

C:\Program Files (x86)\Ad-Remover\main.exe (CLEAN [1]) -> Launched at 22:54:24 on 13/10/2011, Normal boot

Microsoft Windows 7 Ultimate (X64)

Administrator@HP-PAVILLION (Hewlett-Packard HP Pavilion b2000br MT)

============== ACTION(S) ==============

Folder deleted: C:\Users\Administrator\AppData\Roaming\OpenCandy

Folder deleted: C:\Users\Administrator\AppData\Local\OpenCandy

(!) -- Temporary files deleted.

Key deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

============== ADDITIONNAL SCAN ==============

**** Mozilla Firefox Version [7.0.1 (pt-BR)] ****

Searchplugins\buscape.xml (hxxp://busca.buscape.com.br/cprocura)

Searchplugins\mercadolivre.xml (hxxp://pmstrk.mercadolivre.com.br/jm/PmsTrk)

Searchplugins\wikipedia-br.xml (hxxp://pt.wikipedia.org/wiki/Especial:Busca)

Searchplugins\yahoo-br.xml (hxxp://br.search.yahoo.com/search)

Components\browsercomps.dll (Mozilla Foundation)

HKLM_Extensions|litmus-ff@f-secure.com - C:\Program Files (x86)\GVT\Protect\NRS\litmus-ff@f-secure.com

-- C:\Users\Administrator\AppData\Roaming\Mozilla\FireFox\Profiles\omzfztm3.default --

Extensions\{87F8774F-B485-47E2-A755-A40A8A5E886C} (Modulo de Protecao - Banco do Brasil)

Extensions\{87F8774F-B485-47E2-A755-A40A8A5E886D} (Adicional de Seguranca CAIXA)

Extensions\{87F8774F-B485-47E2-A755-A40A8A5E8873} (Guardiao Itau 30 horas)

Prefs.js - browser.search.defaultenginename, Google

Prefs.js - browser.startup.homepage, hxxp://www.google.com.br/

Prefs.js - browser.startup.homepage_override.buildID, 20110928134238

Prefs.js - browser.startup.homepage_override.mstone, rv:7.0.1

========================================

**** Internet Explorer Version [8.0.7600.16385] ****

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896

HKCU_Main|Start Page - hxxp://fr.msn.com/

HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896

HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm

HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM_Main|Start Page - hxxp://fr.msn.com/

HKCU_Toolbar\WebBrowser|{47833539-D0C5-4125-9FA8-0819E2EAAC93} (C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll)

HKLM_ElevationPolicy\{07d873dc-b9b9-44f5-af0b-fb59fa54fb7a} - C:\Windows\SysWOW64\wpcer.exe (x)

HKLM_ElevationPolicy\{0a402d70-1f10-4ae7-bec9-286a98240695} - C:\Windows\SysWOW64\winfxdocobj.exe (x)

HKLM_ElevationPolicy\{6A7C9604-8A57-4B28-821B-BDEDF0E04788} - C:\Program Files\Microsoft Office\Office14\winproj.exe (x)

HKLM_ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999} - C:\Program Files (x86)\Internet Explorer\iedw.exe (x)

HKLM_ElevationPolicy\{B43A0C1E-B63F-4691-B68F-CD807A45DA01} - C:\Windows\system32\TSWbPrxy.exe (x)

HKLM_Extensions\{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - "?" (?)

BHO\{C41A1C0E-EA6C-11D4-B1B8-444553540000} - "GbIehObj Class" (C:\PROGRAM FILES (X86)\GBPLUGIN\gbieh.dll)

BHO\{C41A1C0E-EA6C-11D4-B1B8-444553540003} - "GbIehObj Class" (C:\Program Files (x86)\GbPlugin\gbiehCef.dll)

========================================

C:\Program Files (x86)\Ad-Remover\Quarantine: 6 File(s)

C:\Program Files (x86)\Ad-Remover\Backup: 14 File(s)

C:\Ad-Report-CLEAN[1].txt - 13/10/2011 22:54:36 (3757 Byte(s))

End at: 22:56:01, 13/10/2011

============== E.O.F ==============

Já já estou de volta com a conclusão da segunda.

Bom parece que o USBfix não está mais disponível para download, temos um plano B?

Ou você tem como disponibilizar o executável para que eu possa rodar?

Aguardo.

Valeu.

wings · Outubro 17, 2011

Olá O.Aprendiz.CSS

O link do USBFix mudou. Baixe-o aqui e aguarde por novas orientações do Felipe_88

Um abraço.

Felipe_88 · Outubro 17, 2011

Valeu Wings...

Aguardando relatório USBFix.

O.Aprendiz.CSS · Outubro 17, 2011

Olá O.Aprendiz.CSS

O link do USBFix mudou. Baixe-o aqui e aguarde por novas orientações do Felipe_88

Um abraço.

Amigo, este link está quebrado, não consigo puxar nada dele.

De qualquer forma agradeço.

Power Max · Outubro 17, 2011

Amigo, este link está quebrado, não consigo puxar nada dele.

De qualquer forma agradeço.

Olá amigo, este link está funcionando. Acabei de baixar o Usbfix por ele e o link é este:

http://eldesaparecido.com/tools/UsbFix.exe

O.Aprendiz.CSS · Outubro 17, 2011

Olá amigo, este link está funcionando. Acabei de baixar o Usbfix por ele e o link é este:

http://eldesaparecido.com/tools/UsbFix.exe

Agora simmmm... Valeu.

Dando sequência.

Porém o meu anti-vírus está bloqueando este software por ter localizado um Trojan. O que fazer???

Aguardo retorno.

O.Aprendiz.CSS · Outubro 18, 2011

Bom mudei o anti-vírus e agora deu certo.

segue o relatório.

############################## | UsbFix V 7.062 | [Research]

User: Administrator (Administrator) # HP-PAVILLION

Updated 11/10/2011 by El Desaparecido

Started at 09:18:51 | 18/10/2011

Website: http://eldesaparecido.com

Suspicious file ? : http://eldesaparecido.com/support.php

Contact: contact@eldesaparecido.com

PC: Hewlett-Packard (HP Pavilion b2000br MT ) (x64-based PC) # Desktop Computer

CPU: Intel® Pentium® D CPU 2.80GHz (2800)

RAM -> [ Total : 3327 | Free : 1749 ]

BIOS: Phoenix - Award BIOS v6.00PG

BOOT: Normal boot

OS: Microsoft Windows 7 Ultimate (6.1.7600 64-Bit) #

WB: Windows Internet Explorer 8.0.7600.16385

SC: Security Center Service [ Enabled ]

WU: Windows Update Service [ Enabled ]

AV: Kaspersky Anti-Virus [ Enabled | Updated ]

FW: Windows FireWall Service [ Enabled ]

C:\ (%systemdrive%) -> Fixed drive # 39 Gb (2 Mb free - 6%) [] # NTFS

D:\ -> Fixed drive # 110 Gb (41 Mb free - 37%) [Pavillion HP ] # NTFS

E:\ -> CD-ROM

J:\ -> CD-ROM

L:\ -> Removable drive # 959 Mb (568 Mb free - 59%) [KGT1G] # FAT

################## | Active Processes |

C:\Windows\system32\csrss.exe (516)

C:\Windows\system32\wininit.exe (576)

C:\Windows\system32\csrss.exe (588)

C:\Windows\system32\services.exe (624)

C:\Windows\system32\lsass.exe (648)

C:\Windows\system32\lsm.exe (656)

C:\Windows\system32\winlogon.exe (712)

C:\Windows\system32\svchost.exe (820)

C:\PROGRA~2\GbPlugin\GbpSv.exe (880)

C:\Windows\system32\svchost.exe (936)

C:\Windows\System32\svchost.exe (996)

C:\Windows\System32\svchost.exe (396)

C:\Windows\system32\svchost.exe (736)

C:\Windows\system32\svchost.exe (1124)

C:\Windows\system32\svchost.exe (1236)

C:\Windows\System32\spoolsv.exe (1376)

C:\Windows\system32\svchost.exe (1408)

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe (1524)

C:\Windows\system32\taskhost.exe (1596)

C:\Windows\system32\Dwm.exe (1748)

C:\Windows\Explorer.EXE (1792)

C:\Windows\system32\svchost.exe (1964)

C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe (2000)

C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe (2044)

C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe (1184)

c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (572)

C:\Windows\system32\svchost.exe (1800)

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (1960)

C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (2088)

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (2208)

C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe (2676)

C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe (2748)

C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe (2832)

C:\Windows\system32\svchost.exe (3044)

C:\Windows\system32\WUDFHost.exe (2528)

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (3132)

C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (3244)

C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cadastro.1.exe (3332)

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe (3384)

C:\Windows\system32\SearchIndexer.exe (3636)

C:\Program Files\Windows Media Player\wmpnetwk.exe (3896)

C:\Windows\System32\svchost.exe (2924)

C:\Windows\system32\wuauclt.exe (1956)

C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (2908)

C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE (3416)

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (1788)

C:\Program Files (x86)\Mozilla Firefox\firefox.exe (1304)

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\x64\klwtblfs.exe (3412)

C:\Windows\system32\AUDIODG.EXE (3196)

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (152)

C:\UsbFix\Go.exe (4724)

C:\Windows\system32\wbem\wmiprvse.exe (4884)

################## | Stopped processes |

Stopped! C:\PROGRA~2\GbPlugin\GbpSv.exe (880)

Stopped! C:\Windows\System32\spoolsv.exe (1376)

Stopped! C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe (1524)

Stopped! C:\Windows\system32\taskhost.exe (1596)

Stopped! C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe (2000)

Stopped! C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe (2044)

Stopped! C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe (1184)

Stopped! c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (572)

Stopped! C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (1960)

Stopped! C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (2088)

Stopped! C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe (2676)

Stopped! C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe (2748)

Stopped! C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe (2832)

Stopped! C:\Windows\system32\WUDFHost.exe (2528)

Stopped! C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (3132)

Stopped! C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (3244)

Stopped! C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cadastro.1.exe (3332)

Stopped! C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe (3384)

Stopped! C:\Windows\system32\SearchIndexer.exe (3636)

Stopped! C:\Program Files\Windows Media Player\wmpnetwk.exe (3896)

Stopped! C:\Windows\system32\wuauclt.exe (1956)

Stopped! C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (2908)

Stopped! C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE (3416)

Stopped! C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (1788)

Stopped! C:\Program Files (x86)\Mozilla Firefox\firefox.exe (1304)

Stopped! C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\x64\klwtblfs.exe (3412)

Stopped! C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (152)

################## | Files # Infected Folders |

################## | Registry |

################## | Mountpoints2 |

HKCU\.\.\.\.\Explorer\MountPoints2\{69d35927-6ec4-11e0-b56f-001b7806267d}

Shell\AutoRun\Command = J:\Autoplay.exe -auto

################## | Vaccin |

(!) This computer is not vaccinated!

################## | E.O.F |

Aguardo boas novas.

Veja que os processos ainda estão lá Domino.EXE e CADASTRO.1.EXE.

Valeu.

Felipe_88 · Outubro 18, 2011

O.Aprendiz.CSS, por gentileza...

*Execute o USBFix e clique [supressão]

*Cole o relatório apresentado

Fico no aguardo!

O.Aprendiz.CSS · Outubro 18, 2011

Este USBFix não tem esta opção.

Att.

Felipe_88 · Outubro 19, 2011

O.Aprendiz.CSS,

Manim...ao lado da opção pesquisa [supressão]...

Teste novamente...

O.Aprendiz.CSS · Outubro 19, 2011

O.Aprendiz.CSS,

Manim...ao lado da opção pesquisa [supressão]...

Teste novamente...

Bom na versão que baixei, não tem nem "pesquisa" quanto mais "supressão"..rs. mais tudo bem, as opções que tenho e que executei são "Research" onde postei o primeiro relatório e a opção ao lado dela é "Deletion".

Após este procedimento, segue novo relatório.

############################## | UsbFix V 7.062 | [Deletion]

User: Administrator (Administrator) # HP-PAVILLION

Updated 11/10/2011 by El Desaparecido

Started at 09:41:53 | 19/10/2011

Website: http://eldesaparecido.com

Suspicious file ? : http://eldesaparecido.com/support.php

Contact: contact@eldesaparecido.com

PC: Hewlett-Packard (HP Pavilion b2000br MT ) (x64-based PC) # Desktop Computer

CPU: Intel® Pentium® D CPU 2.80GHz (2800)

RAM -> [ Total : 3327 | Free : 1688 ]

BIOS: Phoenix - Award BIOS v6.00PG

BOOT: Normal boot

OS: Microsoft Windows 7 Ultimate (6.1.7600 64-Bit) #

WB: Windows Internet Explorer 8.0.7600.16385

SC: Security Center Service [ Enabled ]

WU: Windows Update Service [ Enabled ]

AV: Kaspersky Anti-Virus [ Enabled | Updated ]

FW: Windows FireWall Service [ Enabled ]

C:\ (%systemdrive%) -> Fixed drive # 39 Gb (3 Mb free - 7%) [] # NTFS

D:\ -> Fixed drive # 110 Gb (41 Mb free - 37%) [Pavillion HP ] # NTFS

E:\ -> CD-ROM

J:\ -> CD-ROM

################## | Active Processes |

C:\Windows\system32\csrss.exe (520)

C:\Windows\system32\wininit.exe (580)

C:\Windows\system32\csrss.exe (592)

C:\Windows\system32\services.exe (628)

C:\Windows\system32\lsass.exe (652)

C:\Windows\system32\lsm.exe (660)

C:\Windows\system32\winlogon.exe (720)

C:\Windows\system32\svchost.exe (804)

C:\PROGRA~2\GbPlugin\GbpSv.exe (864)

C:\Windows\system32\svchost.exe (928)

C:\Windows\System32\svchost.exe (980)

C:\Windows\System32\svchost.exe (536)

C:\Windows\system32\svchost.exe (756)

C:\Windows\system32\svchost.exe (1124)

C:\Windows\system32\svchost.exe (1272)

C:\Windows\System32\spoolsv.exe (1372)

C:\Windows\system32\svchost.exe (1412)

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe (1528)

C:\Windows\system32\taskhost.exe (1632)

C:\Windows\system32\Dwm.exe (1764)

C:\Windows\Explorer.EXE (1784)

C:\Windows\system32\svchost.exe (1860)

C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe (1904)

C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe (1948)

C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe (1996)

c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (1052)

C:\Windows\system32\svchost.exe (1308)

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (1236)

C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (2160)

C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe (2184)

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (2420)

C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe (2492)

C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe (2692)

C:\Windows\system32\svchost.exe (2480)

C:\Windows\system32\WUDFHost.exe (2680)

C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (3492)

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe (3588)

C:\Windows\system32\SearchIndexer.exe (3652)

C:\Program Files\Windows Media Player\wmpnetwk.exe (4068)

C:\Windows\system32\wuauclt.exe (736)

C:\Windows\System32\svchost.exe (3676)

C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE (380)

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (3280)

C:\Program Files (x86)\Mozilla Firefox\firefox.exe (876)

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\x64\klwtblfs.exe (1284)

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (2372)

C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (2988)

C:\UsbFix\Go.exe (2856)

C:\Windows\system32\wbem\wmiprvse.exe (2096)

C:\Windows\system32\AUDIODG.EXE (4208)

################## | Stopped processes |

Stopped! C:\PROGRA~2\GbPlugin\GbpSv.exe (864)

Stopped! C:\Windows\System32\spoolsv.exe (1372)

Stopped! C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe (1528)

Stopped! C:\Windows\system32\taskhost.exe (1632)

Stopped! C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe (1904)

Stopped! C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe (1948)

Stopped! C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe (1996)

Stopped! c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (1052)

Stopped! C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (1236)

Stopped! C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (2160)

Stopped! C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe (2184)

Stopped! C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (2420)

Stopped! C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe (2492)

Stopped! C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe (2692)

Stopped! C:\Windows\system32\WUDFHost.exe (2680)

Stopped! C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (3492)

Stopped! C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe (3588)

Stopped! C:\Windows\system32\SearchIndexer.exe (3652)

Stopped! C:\Program Files\Windows Media Player\wmpnetwk.exe (4068)

Stopped! C:\Windows\system32\wuauclt.exe (736)

Stopped! C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE (380)

Stopped! C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (3280)

Stopped! C:\Program Files (x86)\Mozilla Firefox\firefox.exe (876)

Stopped! C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\x64\klwtblfs.exe (1284)

Stopped! C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (2372)

Stopped! C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (2988)

################## | Files # Infected Folders |

Not deleted ! E:\SETUP.EXE

Deleted ! C:\$RECYCLE.BIN\S-1-5-21-2274267930-1155721500-2099844759-1000

Deleted ! C:\$RECYCLE.BIN\S-1-5-21-2274267930-1155721500-2099844759-500

Deleted ! D:\$RECYCLE.BIN\S-1-5-21-2274267930-1155721500-2099844759-500

Deleted ! D:\Recycler\S-1-5-21-1606980848-1202660629-839522115-1003

Not deleted ! E:\autorun.inf

Not deleted ! E:\Updates

(!) Temporary files deleted.

################## | Registry |

################## | Mountpoints2 |

Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{69d35927-6ec4-11e0-b56f-001b7806267d}

Deleted ! HKCU\.\.\.\.\Explorer\MountPoints2\{8fdca237-6c36-11e0-a120-806e6f6e6963}

################## | Listing |

[19/10/2011 - 09:45:49 | SHD ] C:\$Recycle.Bin

[11/10/2011 - 21:14:29 | N | 1024] C:\.rnd

[13/10/2011 - 23:56:01 | N | 3896] C:\Ad-Report-CLEAN[1].txt

[21/04/2011 - 19:43:04 | D ] C:\Boot

[13/07/2009 - 23:38:58 | RASH | 383562] C:\bootmgr

[21/04/2011 - 19:43:06 | N | 8192] C:\BOOTSECT.BAK

[21/04/2011 - 15:25:47 | SHD ] C:\Documents and Settings

[19/10/2011 - 08:52:26 | ASH | 2616107008] C:\hiberfil.sys

[17/10/2011 - 21:24:42 | D ] C:\kleaner.tmp

[26/05/2011 - 17:26:45 | D ] C:\Kpcms

[21/04/2011 - 15:44:50 | RHD ] C:\MSOCache

[19/10/2011 - 08:52:29 | ASH | 3488145408] C:\pagefile.sys

[14/07/2009 - 01:20:08 | D ] C:\PerfLogs

[15/10/2011 - 15:09:21 | D ] C:\Program Files

[17/10/2011 - 21:28:17 | D ] C:\Program Files (x86)

[17/10/2011 - 21:28:17 | HD ] C:\ProgramData

[21/04/2011 - 15:25:47 | SHD ] C:\Recovery

[18/10/2011 - 10:40:02 | SHD ] C:\System Volume Information

[19/10/2011 - 09:45:49 | D ] C:\UsbFix

[19/10/2011 - 09:42:24 | A | 7288] C:\UsbFix.txt

[11/10/2011 - 21:30:54 | D ] C:\Users

[21/04/2011 - 15:26:16 | N | 171136] C:\w7ldr

[17/10/2011 - 21:24:30 | D ] C:\Windows

[25/04/2011 - 14:13:43 | D ] C:\_rpcs

[19/10/2011 - 09:45:49 | SHD ] D:\$RECYCLE.BIN

[25/08/2010 - 21:02:01 | N | 573718] D:\APADI.pdf

[09/08/2010 - 15:02:16 | N | 52181] D:\AUTORIZAÇÃO DE PRODUÇÃO - SINTRACOOP.pdf

[15/11/2010 - 22:34:27 | N | 329146] D:\catalogo MP1500.pdf

[11/10/2011 - 09:41:57 | D ] D:\Cesar

[19/09/2011 - 13:06:02 | D ] D:\e98513c8ed8027cae99e

[13/05/2011 - 12:34:07 | N | 857317] D:\Figura1.cdr

[17/10/2011 - 21:11:50 | D ] D:\install

[14/06/2011 - 12:57:48 | N | 434058] D:\IPVA.pdf

[13/08/2010 - 14:27:04 | D ] D:\joomla

[26/07/2010 - 19:23:00 | N | 2266280] D:\Manual Disparo On Line.pdf

[29/09/2011 - 20:44:29 | D ] D:\MUSIC

[05/08/2010 - 12:27:05 | N | 1424669] D:\PosWebAntiSpam2006.pdf

[02/08/2010 - 18:39:50 | D ] D:\PROCESSO

[06/06/2010 - 23:36:01 | N | 1109335] D:\proposta_bompasto.pdf

[01/05/2011 - 16:37:23 | D ] D:\Recuperacao

[16/04/2010 - 00:35:59 | SHD ] D:\RECYCLER

[12/04/2011 - 10:05:00 | D ] D:\Rosalia

[04/08/2011 - 18:48:42 | N | 225429] D:\Sem Título-1.jpg

[13/08/2010 - 22:17:53 | N | 89189] D:\SERASA - ANACRISTINA.pdf

[13/08/2010 - 22:15:13 | N | 25890] D:\SERASA - ANACRISTINA_CREDNET.pdf

[14/06/2010 - 21:47:17 | N | 18283] D:\SERASA - escolavencer.pdf

[18/10/2011 - 08:59:55 | SHD ] D:\System Volume Information

[18/10/2011 - 18:49:44 | D ] D:\Temporaria

[05/10/2010 - 12:56:14 | SH | 44032] D:\Thumbs.db

[12/10/2011 - 09:49:37 | D ] D:\Trabalho

[18/10/2011 - 16:02:39 | N | 38040] D:\USBFix.jpg

[10/06/2011 - 18:10:54 | D ] D:\website

[15/10/2011 - 14:54:01 | D ] D:\_Backup C_

[27/04/2010 - 21:15:10 | D ] E:\Access.pt-br

[27/04/2010 - 21:15:10 | D ] E:\Catalog

[27/04/2010 - 21:15:10 | D ] E:\Excel.pt-br

[27/04/2010 - 21:15:09 | D ] E:\Groove.pt-br

[27/04/2010 - 21:15:09 | D ] E:\InfoPath.pt-br

[27/04/2010 - 21:15:08 | D ] E:\Office.pt-br

[27/04/2010 - 21:15:08 | D ] E:\Office32.pt-br

[27/04/2010 - 21:15:08 | D ] E:\OneNote.pt-br

[27/04/2010 - 21:15:07 | D ] E:\Outlook.pt-br

[27/04/2010 - 21:15:06 | D ] E:\PowerPoint.pt-br

[27/04/2010 - 21:15:04 | D ] E:\ProPlus.WW

[27/04/2010 - 21:15:04 | D ] E:\Proofing.pt-br

[27/04/2010 - 21:15:03 | D ] E:\Publisher.pt-br

[16/03/2010 - 12:16:20 | R | 1988] E:\README.HTM

[27/04/2010 - 21:15:03 | D ] E:\Updates

[27/04/2010 - 21:15:03 | D ] E:\Word.pt-br

[27/04/2010 - 21:15:03 | D ] E:\_ATIVADOR_

[22/03/2010 - 14:17:28 | R | 175] E:\autorun.inf

[12/03/2010 - 05:05:40 | R | 1377656] E:\setup.exe

################## | Vaccin |

C:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)

D:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)

################## | Upload |

Please send the file: C:\UsbFix_Upload_Me_HP-PAVILLION.zip

http://eldesaparecido.com/support.php

Thank you for your contribution.

################## | E.O.F |

Mais uma vez obrigado pela contribuição e fico no aguardo de novidades.

Felipe_88 · Outubro 20, 2011

O.Aprendiz.CSS,

Certo...rsrs. É porque ficou em outra linguagem, mas é esse procedimento mesmo!

*Baixe o MalwareBytes e salve-o no desktop

*Instale o programa e aguarde a atualização

*O programa será aberto automaticamente

*Na aba [Verificação], selecione [Verificação completa]

*Clique [Verificar] e selecione a partição onde o Windows está instalado

*Ao finalizar o scan, clique [sIM] > [OK] > [Ver Resultados] > [Remover Selecionados]

*Cole o relatório apresentado (C:\Documents and settings\Nome_do_Usuário\Dados de aplicativos\Malwarebytes\Malwarebytes Anti-Malware\Logs\mbam.txt)

Caso já tenhas o Malwarebytes instalado....

*Abra o Malwarebytes, clique [Atualização] > [baixar Atualizações]

*Na aba [Verificação], selecione [x] Verificação completa

*Clique [Verificar] e selecione a partição onde o Windows está instalado

*Ao finalizar o scan, clique [sIM] > [OK] > [Ver Resultados] > [Remover Selecionados]

*Cole o relatório apresentado

Fico no aguardo!

O.Aprendiz.CSS · Outubro 20, 2011

Segue relatório:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

Versão da Base de Dados: 7987

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

20/10/2011 12:29:57

mbam-log-2011-10-20 (12-29-57).txt

Tipo de Verificação: Verificação Completa (C:\|D:\|)

Objetos escaneados: 500741

Tempo decorrido: 1 hora(s), 15 minuto(s), 52 segundo(s)

Processos de Memória Infectados: 0

Módulos de Memória Infectados: 0

Chaves de Registro Infectadas: 0

Valores de Registro Infectados: 0

Itens de Dados no Registro Infectados: 0

Pastas Infectadas: 0

Arquivos Infectados: 1

Processos de Memória Infectados: