[Resolvido] &nbspLentidão do micro

DigRam · Agosto 7, 2012

Boa Tarde! Soraya Lourenço

|- Somente uma pergunta! Nessa movimentação espontânea do cursor,você está com o Firefox aberto?

-/-

|- Baixe: < AD-Remover > ( ... de C-XX )

|- Ou... < Aqui! > <- Link!

|- Salve-o em C:\ ( Disco local )

|- Duplo clique em AD-R.exe

|- Para Windows Vista ou 7,dê clique direito no arquivo e execute-o como administrador!

|- Aperte a opção "Clean".

|- Ao concluir,aceite/confirme o reboot,para que Adwares sejam removidos.

|- Ou seja,o computador irá reiniciar!

|- Poste o relatório: C:\Ad-Report-CLEAN[1].txt

-/-

|- Selecione e copie,o conteúdo que está em "vermelho",para o Bloco de Notas.

|- Salve-o,no desktop,com o nome: CFScript <-- Texto!

#########

RegLock::

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

Firefox::

FF - prefs.js: network.proxy.type - 0

user_pref('extensions.dealply.partner', 'iron');

user_pref('extensions.dealply.channel', 'iron3');

user_pref('extensions.dealply.installId', 'v23900293429171670743002012080417283720');

user_pref('extensions.dealply.installIdSource', 'inst');

user_pref('extensions.dealply.sampleGroup', '0');

FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=113480&tt=010812_hpdel_3112_6

FF - user.js: extensions.BabylonToolbar_i.babExt -

FF - user.js: extensions.BabylonToolbar_i.srcExt - ss

FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://www.google.com/search?babsrc=TB_ggl&q=

FF - user.js: extensions.BabylonToolbar.id - d47eecd5000000000000e0ca9478f907

FF - user.js: extensions.BabylonToolbar.instlDay - 15556

FF - user.js: extensions.BabylonToolbar.vrsn - 1.5.29.1

FF - user.js: extensions.BabylonToolbar.vrsni - 1.5.29.1

FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.29.116:29

FF - user.js: extensions.BabylonToolbar.prtnrId - babylon

FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar

FF - user.js: extensions.BabylonToolbar.aflt - babsst

FF - user.js: extensions.BabylonToolbar_i.smplGrp - none

FF - user.js: extensions.BabylonToolbar.tlbrId - tb9

FF - user.js: extensions.BabylonToolbar.instlRef - sst

FF - user.js: extensions.BabylonToolbar.dfltLng - en

FF - user.js: extensions.BabylonToolbar.excTlbr - false

FF - user.js: extensions.BabylonToolbar.admin - false

File::

C:\user.js

Folder::

c:\programdata\Babylon

c:\users\Soraya\AppData\Roaming\Babylon

#########

|- Ps: Desabilite,temporariamente,seu antivírus.

|- Ps: Não utilizem este script em outra máquina!

|- Arraste,o CFScript.txt para o ícone/interior do ComboFix.

|- Veja a demonstração!

|- Atenda à solicitação,que deverá surgir,para rodar o ComboFix.

|- Ps: Faça o arraste,até surgir essa solicitação! ( janela )

|- Concluindo,poste: C:\ComboFix.txt

Abraços!

Soraya Lourenço · Agosto 9, 2012

Boa tarde, DigRam!

O movimento do mouse acontece com qualquer programa que estiver aberto.

Vou fazer os procedimentos e depois vou posta-los.

Um abraço!

Não estou conseguindo salvar o AD_Remover no drive c:. O que faço?

Agora o AVG travou o escaneamento do AD-Remover. Vou ter que refazer o ascaneamento.

Segue o primeiro scan:

======= REPORT FROM AD-REMOVER 2.0.0.2,G | ONLY XP/VISTA/7 =======

Updated by TeamXscript on 12/04/11

Contact: AdRemover[DOT]contact[AT]gmail[DOT]com

website: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [1]) -> Launched at 15:31:11 on 09/08/2012, Normal boot

Microsoft Windows 7 Starter Service Pack 1 (X86)

Soraya@LOURENÇO-PC (SAMSUNG ELECTRONICS CO., LTD. RV415/RV515)

============== ACTION(S) ==============

Folder deleted: C:\Users\Soraya\AppData\Roaming\OpenCandy

(!) -- Temporary files deleted.

Key deleted: HKLM\Software\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key deleted: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}

Key deleted: HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{4DF1E8FD-FBA0-36E8-4176-40D549A35E8E}

============== ADDITIONNAL SCAN ==============

**** Mozilla Firefox Version [14.0.1 (pt-BR)] ****

HKLM_MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin (x)

HKLM_MozillaPlugins\@pandonetworks.com/PandoWebPlugin (x)

HKLM_MozillaPlugins\Adobe Reader (x)

HKCU_MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin (x)

Searchplugins\avg-secure-search.xml ( hxxps://isearch.avg.com/search?cid={CECFBF51-F240-4F51-80BB-034C667A321D}&mid=0da03d91c6a747d0ab243183d2a17996-308ca89a0655160c05dcfa20e2aa9263276bc729&ds=AVG&lang=pt-br&v=12.1.0.21&pr=fr&d=&sap=dsp&q={searchTerms}/)

Searchplugins\babylon.xml (hxxp://search.babylon.com/)

Searchplugins\buscape.xml (hxxp://busca.buscape.com.br/cprocura)

Searchplugins\mercadolivre.xml (hxxp://pmstrk.mercadolivre.com.br/jm/PmsTrk)

Searchplugins\twitter.xml (hxxps://twitter.com/search/{searchTerms})

Searchplugins\wikipedia-br.xml (hxxp://pt.wikipedia.org/wiki/Especial:Busca)

Searchplugins\yahoo-br.xml (hxxp://br.search.yahoo.com/search)

Components\browsercomps.dll (Mozilla Foundation)

HKLM_Extensions|smartwebprinting@hp.com - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

HKLM_Extensions|support@vdownloader.com - C:\Program Files\VDownloader\Addons\FireFox (x)

HKLM_Extensions|{F53C93F1-07D5-430c-86D4-C9531B27DFAF} - C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\

HKLM_Extensions|avg@toolbar - C:\ProgramData\AVG Secure Search\12.1.0.21\

HKCU_Extensions|smartwebprinting@hp.com - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

-- C:\Users\Soraya\AppData\Roaming\Mozilla\FireFox\Profiles\d9gpgnfs.default --

Extensions\staged (?)

Searchplugins\Search.xml (?)

Prefs.js - browser.download.lastDir, C:\\Users\\Soraya\\Desktop

Prefs.js - browser.search.defaultenginename, AVG Secure Search

Prefs.js - browser.search.selectedEngine, Google

Prefs.js - browser.startup.homepage, hxxp://www.google.com.br/

Prefs.js - browser.startup.homepage_override.buildID, 20120713134347

Prefs.js - browser.startup.homepage_override.mstone, 14.0.1

Prefs.js - keyword.URL, hxxps://isearch.avg.com/search?cid=%7B2f010106-f734-4489-80e7-48293eda4da7%7D&mid=0da03d91c6a747d0ab243183d...

========================================

**** Internet Explorer Version [9.0.8112.16421] ****

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896

HKCU_Main|Start Page - hxxp://fr.msn.com/

HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896

HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm

HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM_Main|Start Page - hxxp://fr.msn.com/

HKCU_SearchScopes\{4DF1E8FD-FBA0-36E8-4176-40D549A35E8E} - "?" (?)

HKCU_SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} - "AVG Secure Search" (hxxps://isearch.avg.com/search?cid={CECFBF51-F240-4F51-80BB-034C667A321D}&mid=0d...)

HKLM_Toolbar|{95B7759C-8C7F-4BF1-B163-73684A933233} (C:\Program Files\AVG Secure Search\12.1.0.21\AVG Secure Search_toolbar.dll)

HKCU_ElevationPolicy\{1024F1BE-76DC-40d5-AB98-664A4185E5FA} - C:\Users\Soraya\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe (Skype Limited)

HKLM_ElevationPolicy\{07d873dc-b9b9-44f5-af0b-fb59fa54fb7a} - C:\Windows\System32\wpcer.exe (x)

HKLM_ElevationPolicy\{08FF730A-494F-4cba-AA0B-E4F1D44715F9} - C:\Program Files\Norton Internet Security\Engine\18.7.0.13\symerr.exe (x)

HKLM_ElevationPolicy\{0a402d70-1f10-4ae7-bec9-286a98240695} - C:\Windows\System32\winfxdocobj.exe (x)

HKLM_ElevationPolicy\{1024F1BE-76DC-40d5-AB98-664A4185E5FA} - C:\Users\Soraya\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe (Skype Limited)

HKLM_ElevationPolicy\{4E4F55C7-1B5E-448d-97DD-78B719829E0D} - C:\windows\system32\spool\drivers\w32x86\3\spd__sm.exe (Samsung Electronics)

HKLM_ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999} - C:\Program Files\Internet Explorer\iedw.exe (x)

HKLM_ElevationPolicy\{8DDBEC40-04EE-40E2-9AA5-AFE0025E0339} - C:\Program Files\Samsung AnyWeb Print\W2PServer.exe (?)

HKLM_ElevationPolicy\{C804A76B-FC71-47f6-B8B2-7D83C520864F} - C:\Program Files\Samsung AnyWeb Print\GwHH.exe (?)

HKLM_ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - C:\Program Files\AVG Secure Search\lip.exe (?)

HKLM_ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706} - C:\Program Files\Common Files\AVG Secure Search\ScriptHelperInstaller\12.1.5\ScriptHelper.exe (?)

HKLM_Extensions\{328ECD19-C167-40eb-A0C7-16FE7634105E} - "Samsung AnyWeb Print" (C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll,300)

HKLM_Extensions\{68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - "AVG Do Not Track" (C:\Program Files\AVG\AVG2012\avgdtiex.dll,202)

HKLM_Extensions\{CCA281CA-C863-46ef-9331-5C8D4460577F} - "@C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015" (C:\Program Files\WIDCOMM\Bluetooth Software\bt_cold_icon.ico)

BHO\{31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - "AVG Do Not Track" (C:\Program Files\AVG\AVG2012\avgdtiex.dll)

BHO\{95B7759C-8C7F-4BF1-B163-73684A933233} - "AVG Security Toolbar" (C:\Program Files\AVG Secure Search\12.1.0.21\AVG Secure Search_toolbar.dll)

BHO\{AA609D72-8482-4076-8991-8CDAE5B93BCB} - "Samsung BHO Class" (C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll)

========================================

C:\Program Files\Ad-Remover\Quarantine: 1 File(s)

C:\Program Files\Ad-Remover\Backup: 14 File(s)

C:\Ad-Report-CLEAN[1].txt - 09/08/2012 15:32:01 (6636 Byte(s))

End at: 15:34:25, 09/08/2012

============== E.O.F ==============

DigRam · Agosto 9, 2012

Boa tarde, DigRam!

O movimento do mouse acontece com qualquer programa que estiver aberto.

Vou fazer os procedimentos e depois vou posta-los.

Um abraço!

Não estou conseguindo salvar o AD_Remover no drive c:. O que faço?

Olá!

|- Pode salvá-lo no desktop!

Abs!

Soraya Lourenço · Agosto 9, 2012

Já fiz isso.

Salvei no DeskTop e depois transferi para o C: .

Segue o Scan feito depois que desativei o AVG:

======= REPORT FROM AD-REMOVER 2.0.0.2,G | ONLY XP/VISTA/7 =======

Updated by TeamXscript on 12/04/11

Contact: AdRemover[DOT]contact[AT]gmail[DOT]com

website: http://www.teamxscript.org

C:\Program Files\Ad-Remover\main.exe (CLEAN [2]) -> Launched at 15:42:14 on 09/08/2012, Normal boot