[Resolvido] &nbsppossível virus

Edvan · Janeiro 18, 2012

Uma bobeira que dei e saí da sala, plugaram um pendriver infectado na minha maquina, resultado a pagina do IE muito lenta e as vezes dar algumas travadas..

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 14:30:12, on 18/01/2012

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Arquivos de programas\Arquivos comuns\Acronis\Schedule2\schedul2.exe

C:\Arquivos de programas\Arquivos comuns\Acronis\CDP\afcdpsrv.exe

C:\Arquivos de programas\Diskeeper Corporation\Diskeeper\DkService.exe

C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\WINDOWS\System32\alg.exe

C:\Arquivos de programas\Arquivos comuns\Nero\Lib\NMIndexingService.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\ARQUIV~1\ALWILS~1\Avast5\avastUI.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

C:\Arquivos de programas\Acronis\TrueImageHome\TrueImageMonitor.exe

C:\Arquivos de programas\Arquivos comuns\Acronis\Schedule2\schedhlp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Arquivos de programas\Arquivos comuns\Nero\Lib\NMIndexStoreSvr.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Arquivos de programas\SlimDrivers\SlimDrivers.exe

C:\Arquivos de programas\Internet Explorer\iexplore.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Mozilla Firefox\plugin-container.exe

C:\Arquivos de programas\Adobe\Reader 8.0\Reader\AcroRd32.exe

C:\HiJackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\Arquivos de programas\GbPlugin\gbieh.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [avast5] C:\ARQUIV~1\ALWILS~1\Avast5\avastUI.exe /nogui

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Nero\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [NBKeyScan] "C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Arquivos de programas\Acronis\TrueImageHome\TrueImageMonitor.exe

O4 - HKLM\..\Run: [Acronis Serviço Scheduler2] "C:\Arquivos de programas\Arquivos comuns\Acronis\Schedule2\schedhlp.exe"

O4 - HKLM\..\Run: [APSDaemon] "C:\Arquivos de programas\Arquivos comuns\Apple\Apple Application Support\APSDaemon.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

O4 - HKCU\..\Run: [slimDrivers] "C:\Arquivos de programas\SlimDrivers\SlimDrivers.exe" -boot

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O15 - Trusted Zone: www.bancobrasil.com.br

O15 - Trusted Zone: www14.bancobrasil.com.br

O15 - Trusted Zone: www2.bancobrasil.com.br

O15 - Trusted Zone: www.bb.com.br

O16 - DPF: {108D3206-846A-4A93-BACB-F0572D043ED7} (SurveillanceCtrl Control) - http://fabiodvr1.sytes.net:37779/webrec.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab

O20 - Winlogon Notify: GbPluginBb - C:\Arquivos de programas\GbPlugin\gbieh.dll

O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Acronis Serviço Scheduler2 (AcrSch2Svc) - Acronis - C:\Arquivos de programas\Arquivos comuns\Acronis\Schedule2\schedul2.exe

O23 - Service: Serviço de Acronis Nonstop Backup (afcdpsrv) - Acronis - C:\Arquivos de programas\Arquivos comuns\Acronis\CDP\afcdpsrv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: Diskeeper - Diskeeper Corporation - C:\Arquivos de programas\Diskeeper Corporation\Diskeeper\DkService.exe

O23 - Service: Gbp Service (GbpSv) - - C:\ARQUIV~1\GbPlugin\GbpSv.exe

O23 - Service: Serviço do Google Update (gupdate) (gupdate) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe

O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Nero\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--

End of file - 9852 bytes

DigRam · Janeiro 18, 2012

Boa Tarde! Edvan

|- Iniciemos somente os diagnósticos,envolvendo ferramentas especializadas!

/////°°°°°/////

|- Baixe: < GabKiller > ( ... par 2011N2 )

|- Salve-o no desktop!

|- Feche pastas que estejam abertas e execute a ferramenta.

|- Para Windows Vista ou 7,clique direito e execute como administrador.

|- Escolha a opção 1. Rechercher -> Aperte Enter!

|- Aguarde a conclusão e poste o relatório: Rapport de recherche de GabKiller

|- Para sair,aperte a opção "4. Quitter" -> Enter!

/////°°°°°/////

|- Baixe: < UsbFix > ( ...de C_XX & El Desaparecido )

|- Salve-o no desktop!

|- Siga com sua instalação.

|- Execute o arquivo UsbFix.exe,com um duplo clique.

|- Escolha a opção "Recherche".

|- Aguarde a conclusão e poste o relatório. ( C:\UsbFix.txt )

Abraços!

Edvan · Janeiro 19, 2012

Mais uma vez obrigado pela força caro Digram, no final de tudo queria algumas orientações sua...pode ser?

====================================== Informations ======================================

Rapport de recherche de GabKiller

Outil développé par 2011N2

Contact : lot12@hotmail.fr

Site : http://2011n2.forumgratuit.fr/

Mis à jour le : 04/08/2011 à 13h | 1.45 par 2011N2

Début du scan de recherche : 17:10:58

Nom du PC : FUN0055

Système d'exploitation : VERSION 3.0

Système d'exploitation : Microsoft Windows XP

Internet Explorer : VERSION 3.0

Internet Explorer : 8.0.6001.18702

Mozilla Firefox : VERSION 3.0

Mozilla Firefox : 9.0.1 (pt-BR)

Mozilla Firefox : version 5

Mozilla Firefox : version 6

############################# Éléments infectieux #############################

============================ Section HKLM ============================

Présent : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NetworkCrawler\Objects\WorkgroupCrawler

Présent : HKLM\Software\Classes\CLSID\{72B3882F-453A-4633-AAC9-8C3DCED62AFF}

Présent : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NetworkCrawler\Objects\WorkgroupCrawler

Présent : HKLM\Software\Classes\CLSID\{72B3882F-453A-4633-AAC9-8C3DCED62AFF}

Présent : HKLM\Software\Classes\CLSID\{9461b922-3c5a-11d2-bf8b-00c04fb93661}

============================ Section HKCU ============================

============================ Section HKCR ============================

========================== Dossiers/Fichiers ==========================

================================================================================================

Fin du scan de recherche : 17:15:42

############### EOF ###############

----------------x-------------------------------

############################## | UsbFix V 7.078 | [Pesquisa]

Usuário: f003589 (Administrador) # FUN0055

Atualizado em 06/01/2012 por El Desaparecido

Começou em 17:37:29 | 18/01/2012

Site: http://eldesaparecido.com

Arquivo suspeito ? : http://eldesaparecido.com/upload.html

Contato: contact@eldesaparecido.com

PC: Intel (DG41WV) (X86-based PC) # Desktop Computer

CPU: Processador Intel Pentium III Xeon (2593)

RAM -> [ Total : 2009 | Free : 664 ]

BIOS: BIOS Date: 01/07/09 15:28:41 Ver: 08.00.10

BOOT: Normal boot

OS: Microsoft Windows XP Professional (5.1.2600 32-Bit) # Service Pack 3

WB: Windows Internet Explorer 8.0.6001.18702

SC: Security Center Service [ Enabled ]

WU: Windows Update Service [ Enabled ]

FW: Windows FireWall Service [ Enabled ]

C:\ (%systemdrive%) -> Disco fixo # 233 Gb (191 Mb livre - 82%) [] # NTFS

D:\ -> CD-ROM

F:\ -> Disco removível # 4 Gb (448 Mb livre - 12%) [EDVAN] # FAT32

################## | Processos Ativos |

C:\WINDOWS\System32\smss.exe (952)

C:\WINDOWS\system32\csrss.exe (1020)

C:\WINDOWS\system32\winlogon.exe (1044)

C:\WINDOWS\system32\services.exe (1088)

C:\WINDOWS\system32\lsass.exe (1100)

C:\ARQUIV~1\GbPlugin\GbpSv.exe (1272)

C:\WINDOWS\system32\svchost.exe (1348)

C:\WINDOWS\system32\svchost.exe (1420)

C:\WINDOWS\System32\svchost.exe (1544)

C:\WINDOWS\system32\svchost.exe (1688)

C:\WINDOWS\system32\svchost.exe (1784)

C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe (1896)

C:\WINDOWS\system32\spoolsv.exe (504)

C:\Arquivos de programas\Arquivos comuns\Acronis\Schedule2\schedul2.exe (756)

C:\Arquivos de programas\Arquivos comuns\Acronis\CDP\afcdpsrv.exe (792)

C:\Arquivos de programas\Diskeeper Corporation\Diskeeper\DkService.exe (824)

C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBService.exe (1016)

C:\WINDOWS\system32\wdfmgr.exe (1224)

C:\WINDOWS\System32\alg.exe (2688)

C:\Arquivos de programas\Arquivos comuns\Nero\Lib\NMIndexingService.exe (1756)

C:\WINDOWS\Explorer.EXE (2624)

C:\WINDOWS\RTHDCPL.EXE (2964)

C:\WINDOWS\system32\igfxtray.exe (2132)

C:\WINDOWS\system32\hkcmd.exe (2904)

C:\WINDOWS\system32\igfxpers.exe (3508)

C:\ARQUIV~1\ALWILS~1\Avast5\avastUI.exe (2276)

C:\WINDOWS\system32\igfxsrvc.exe (3688)

C:\Arquivos de programas\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (936)

C:\Arquivos de programas\Acronis\TrueImageHome\TrueImageMonitor.exe (2976)

C:\Arquivos de programas\Arquivos comuns\Acronis\Schedule2\schedhlp.exe (3332)

C:\WINDOWS\system32\ctfmon.exe (2788)

C:\Arquivos de programas\Arquivos comuns\Nero\Lib\NMIndexStoreSvr.exe (1764)

C:\WINDOWS\system32\wuauclt.exe (4092)

C:\Arquivos de programas\SlimDrivers\SlimDrivers.exe (1288)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (1144)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (1208)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (1652)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (1668)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (2316)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (3344)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (728)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (1564)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (2416)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (804)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (800)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (3824)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (5736)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (3944)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (4348)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (4264)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (3560)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (4780)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (1192)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (5440)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (4996)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (4148)

C:\Arquivos de programas\Adobe\Reader 8.0\Reader\AcroRd32.exe (5964)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (3700)

C:\Arquivos de programas\Internet Explorer\iexplore.exe (5656)

C:\WINDOWS\system32\wbem\wmiprvse.exe (2148)

C:\UsbFix\Go.exe (5180)

################## | Ficheiros # pastas infeciosos |

Presente ! S:\Recycler\S-1-5-21-1482476501-3352491937-682996330-1013\server.exe

Presente ! F:\AUTORUN.INF

################## | Registro |

################## | Mountpoints2 |

HKCU\.\.\.\.\Explorer\MountPoints2\{00ad370e-2ca3-11e1-a031-7071bc658018}

Shell\AutoRun\Command = E:\AutoRun.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{00ad3711-2ca3-11e1-a031-7071bc658018}

Shell\AutoRun\Command = E:\AutoRun.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{9310918c-2cd9-11e1-a032-7071bc658018}

Shell\AutoRun\Command = E:\urDrive.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{b43cbff7-272c-11e1-a028-7071bc658018}

Shell\AutoRun\Command = E:\urDrive.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{c1533f15-4051-11e1-b56e-7071bc658018}

Shell\AutoRun\Command = Play.exe

################## | Vaccin |

(!) Este computador não é vacinada!

################## | E.O.F |

DigRam · Janeiro 19, 2012

Bom Dia! Edvan

Mais uma vez obrigado pela força caro Digram, no final de tudo queria algumas orientações sua...pode ser?

|- Se estiver ao meu alcance...lhe darei as orientações!

/////°°°°°/////

|- Lance,novamente,as ferramentas e escolha a opção Suppression.

|- Poste seus relatórios!

/////°°°°°/////

|- Baixe: < > ( ...by OldTimer Tools )

|- Clique em Salvar! < 0e5c629f14858f5bf77e61d46c160e317c6d8c5d3ee101e311e440e99d7fd7b06g.jpg >

|- Salve-o no desktop! < 98c0f1ab3823c58ea05c695fd153839feac6fb6b44aaa3f7f5a2cd4a87354c946g.jpg >

|- Duplo clique em OTL.exe --> Executar:

c19ede0bf8817fba1b9a9c0e9dae6ede3b8983c41017d8926efac3638b95aee16g.jpg

|- Configure "Verificação de Arquivos",segundo a screenshot!

|- Ps: Faça o mesmo para estes!

|- Em "Exame Extra do Registro",assinale "Nenhum".

netsvcs
%SYSTEMDRIVE%\*.*

%systemdrive%\drivers\*.exe

%systemroot%\system32\drivers\*.* /64

%PROGRAMFILES%\*.*

%LOCALAPPDATA%\*.exe

%LOCALAPPDATA%\*.txt

%LOCALAPPDATA%\*.ini

%LOCALAPPDATA%\*.dll

%LOCALAPPDATA%\*.dat

%USERPROFILE%\*.exe

%USERPROFILE%\*.txt

%USERPROFILE%\*.ini

%USERPROFILE%\*.dll

%USERPROFILE%\*.dat /30

%systemroot%\system32\tasks\*.* /s /64

%windir%\tasks\*.* /s

CREATERESTOREPOINT

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMP

/md5start

iexplore.exe

/md5stop

SAVEMBR:0

6659d256325569c6e621117dc332966313a07d11cb5fb0ea4d9176217c7aefa76g.jpg

|- Cole estas informações,que estão em vermelho,para o campo "Exames Personalizados/Correções".

|- Clique em Verificar< 49e6f2665be35b3681ba584e7c765651ce4e159059fd54e9cc162579633ccaf56g.jpg >

|- Concluindo,poste o relatório: OTL.txt

Abraços!

Edvan · Janeiro 19, 2012

=========== Informations ===========

Mis à jour le : 07/08/2011 à 16h12 | 1.45 par 2011N2

Rapport de suppression de GabKiller par 2011N2

Contact : lot12@hotmail.fr

Site : http://2011n2.forumgratuit.fr/

Début du nettoyage : 9:55:28

###################################### Clés supprimées ####################################

============================ Section HKLM ============================

supprimé !! HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NetworkCrawler\Objects\WorkgroupCrawler

supprimé !! HKLM\Software\Classes\CLSID\{72B3882F-453A-4633-AAC9-8C3DCED62AFF}

supprimé !! HKLM\Software\Classes\CLSID\{9461b922-3c5a-11d2-bf8b-00c04fb93661}

============================ Section HKCU ============================

============================ Section HKCR ============================

========================== Dossiers/Fichiers ========================

===================================

Fin du nettoyage : 10:01:04

======== EOF ========

############################## | UsbFix V 7.078 | [supressão]

Usuário: f003589 (Administrador) # FUN0055

Atualizado em 06/01/2012 por El Desaparecido

Começou em 10:02:11 | 19/01/2012

Site: http://eldesaparecido.com

Arquivo suspeito ? : http://eldesaparecido.com/upload.html

Contato: contact@eldesaparecido.com

PC: Intel (DG41WV) (X86-based PC) # Desktop Computer

CPU: Processador Intel Pentium III Xeon (2593)

RAM -> [ Total : 2009 | Free : 510 ]