maicon_m 0 Denunciar post Postado Outubro 10, 2012 Bom dia. Nos últimos dias, a minha navegação web esta bastante lenta. Fiz o teste de velocidade e funcionou corretamente. Alguns sites entram normal, como Uol, outros demoram bastante para carregar. Passei o Malwarebytes e não encontrou nada. Abaixo o log do HijackThis: Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 09:09:43, on 10/10/2012 Platform: Windows 7 SP1 (WinNT 6.00.3505) MSIE: Internet Explorer v9.00 (9.00.8112.16450) Boot mode: Normal Running processes: C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe C:\Program Files\AVAST Software\Avast\AvastUI.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe C:\hijackthis\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=userinit.exe, O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll O2 - BHO: Auxiliar de Conexão do Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\Program Files (x86)\GbPlugin\gbieh.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" O4 - HKCU\..\Run: [Google Update] "C:\Users\Maicon\AppData\Local\Google\Update\GoogleUpdate.exe" /c O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO LOCAL') O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIÇO LOCAL') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO DE REDE') O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIÇO DE REDE') O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe O8 - Extra context menu item: &Enviar para o OneNote - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105 O8 - Extra context menu item: Add to WebSite-Watcher - C:\Users\Maicon\AppData\Roaming\aignes\WebSite-Watcher\config\settings\wswie.htm O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll O9 - Extra button: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll O9 - Extra 'Tools' menuitem: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics O15 - Trusted Zone: www.bancobrasil.com.br O15 - Trusted Zone: www14.bancobrasil.com.br O15 - Trusted Zone: www2.bancobrasil.com.br O15 - Trusted Zone: www.bb.com.br O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL O20 - AppInit_DLLs: acaptuser32.dll O20 - Winlogon Notify: GbPluginBb - C:\Program Files (x86)\GbPlugin\gbieh.dll O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe O23 - Service: avast! Firewall - AVAST Software - C:\Program Files\AVAST Software\Avast\afwServ.exe O23 - Service: Serviço do Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: FLEXnet Licensing Service 64 - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe O23 - Service: Gbp Service (GbpSv) - - C:\PROGRA~2\GbPlugin\GbpSv.exe O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing) O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe O23 - Service: mental ray 3.9 Satellite for Autodesk 3ds Max 2012 64-bit - English 64-bit (mi-raysat_3dsmax2012_64) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: NBService - Nero AG - C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing) O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing) O23 - Service: StarWind AE Service (StarWindServiceAE) - StarWind Software - C:\Program Files (x86)\Alcohol Soft\Alcohol 52\StarWind\StarWindServiceAE.exe O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.17\bin\httpd.exe O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.5.8\bin\mysqld.exe O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 12735 bytes Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Outubro 12, 2012 Bom Dia! maicon_m |- Execute escaneamento online em | | |- Utilize o navegador "Internet Explorer",para essa tarefa! |- Siga,conforme a imagem,essa verificação ou scan. |- Ao concluir,clique em "List of found threats" >> "Export to text file" |- Salve esse texto no desktop,com o nome: Esetlog |- Ps: Caso nada seja detectado,não teremos relatório ou lista presente. |- Poste o relatório que estará no desktop! ( Esetlog.txt ) Abs! Compartilhar este post Link para o post Compartilhar em outros sites
maicon_m 0 Denunciar post Postado Outubro 15, 2012 Bom dia DigRam. Log do Eset: C:\$Recycle.Bin\S-1-5-21-875019213-1501409631-4201425577-1000\$RWKBGKQ.exe a variant of Win32/InstallCore.AW application cleaned by deleting - quarantined C:\Users\Maicon\AppData\Local\Temp\ICReinstall_glary-utilities-24901600-baixaki-32-bits-410201212320.exe a variant of Win32/InstallCore.AW application cleaned by deleting - quarantined C:\Users\Maicon\Downloads\backup_info_1209240126.xml.tgz multiple threats deleted - quarantined Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Outubro 15, 2012 Bom Dia! maicon_m |- Baixe: < > ( ... by OldTimer Tools ) |- Clique em Salvar! |- Salve-o no desktop! |- Duplo clique em OTL.exe >> Executar. >> |- Configure "Verificação de Arquivos",segundo a screenshot! |- Ps: Faça o mesmo para estes! |- Em "Exame Extra do Registro",assinale "Nenhum". *crack* /s *keygen* /s *serial* /s *AutoKMS* /s *loader* /s %APPDATA%\Local\*. %APPDATA%\*.exe /s %APPDATA%\*. %USERPROFILE%\AppData\Local\*.* %USERPROFILE%\AppData\Roaming\*.* %systemroot%\assembly\tmp\*.* /S /MD5 %systemroot%\assembly\temp\*.* /S /MD5 %systemroot%\assembly\GAC\*.* /S /MD5 %systemroot%\assembly\GAC_32\*.* /S /MD5 %systemroot%\assembly\GAC_64\*.* /S /MD5 %USERPROFILE%\Desktop\registrybackup.reg /c %systemroot%\system32\config\systemprofile\AppData\Local\*.* %windir%\ServiceProfiles\LocalService\AppData\Local\Temp\*.* %windir%\ServiceProfiles\NetworkService\AppData\Local\Temp\*.* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes /md5start netsvcs explorer.exe userinit.exe winlogon.exe svchost.exe services.exe uninst.exe /md5stop regedit /e c:\registrybackup.reg /c type c:\boot.ini >> test.txt /c %systemroot%\system32\tasks\*.* /s /64 %systemroot%\system32\Tasks\*.* /s %windir%\tasks\*.* /s |- Cole estas informações,que estão no Code,para o campo "Exames Personalizados/Correções". |- Concluindo,poste o relatório: OTL.txt |- Para grandes relatórios,acesse: < > |- Maiores informações: < |Link| > Abraços! Compartilhar este post Link para o post Compartilhar em outros sites
maicon_m 0 Denunciar post Postado Outubro 15, 2012 Arquivo OTL.txt http://myfile.tk/3/5010OTLfile.txt Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Outubro 15, 2012 Boa Tarde! maicon_m |- Baixe: < > ( ... par Xplode ) |- Ao acessar,clique na imagem: < > |- Salve-o no desktop! |- Clique direito em adwcleaner.exe,e escolha sua execução como "administrador". |- Ps: Dê início ao scan,clicando em "Delete" ou "Suppression". |- Ao concluir,poste o relatório: C:\AdwCleaner[S1].txt -/- |- Execute o OTL.exe. |- Copie estas informações que estão no Code,para o campo "Exames Personalizados Correções". :OTL IE - HKU\S-1-5-21-875019213-1501409631-4201425577-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch IE - HKU\S-1-5-21-875019213-1501409631-4201425577-1000\..\SearchScopes\{4A1714DE-886B-471B-9F86-3C418F19ABE5}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ATU2&o=14670&src=crm&q={searchTerms}&locale=&apn_ptnrs=T8&apn_dtid=YYYYYYYYBR&apn_uid=84de6a5a-3aca-43a3-9dec-cc14e9009716&apn_sauid=38464C65-3BAB-439F-9C7D-9220BF2A4110& FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Ask.com" FF - prefs.js..browser.search.defaulturl: "http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.startup.homepage: "http://br.ask.com/?l=dis&o=14672" [2011/11/13 10:47:20 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Maicon\AppData\Roaming\mozilla\Firefox\Profiles\tfs3ddk7.default\extensions\ffxtlbr@babylon.com [2011/11/11 16:15:09 | 000,002,191 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml [2012/01/31 15:10:09 | 000,000,000 | ---D | M] -- C:\Users\Maicon\AppData\Roaming\Babylon CHR - homepage: http://search.babylon.com/home CHR - homepage: http://search.babylon.com/home O1 - Hosts: 127.0.0.1 genuine.microsoft.com O1 - Hosts: 127.0.0.1 mpa.one.microsoft.com O1 - Hosts: 127.0.0.1 sls.microsoft.com O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 practivate.adobe.com O1 - Hosts: 127.0.0.1 ereg.adobe.com O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com O1 - Hosts: 127.0.0.1 wip3.adobe.com O1 - Hosts: 127.0.0.1 3dns-3.adobe.com O1 - Hosts: 127.0.0.1 3dns-2.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com O1 - Hosts: 127.0.0.1 activate-sea.adobe.com O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com O1 - Hosts: 127.0.0.1 adobe.activate.com O1 - Hosts: 127.0.0.1 adobeereg.com O1 - Hosts: 127.0.0.1 www.adobeereg.com O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com O13:64bit: - gopher Prefix: missing O13 - gopher Prefix: missing :reg [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes] "Gopher"="gopher://" :Files C:\Users\Maicon\AppData\Roaming\Babylon C:\Users\Maicon\AppData\Local\{*} :Commands [CREATERESTOREPOINT] [purity] [resethosts] [emptytemp] [Reboot] |- Clique no botão Consertar -> Aguarde a conclusão! |- O computador vai reiniciar! -> Clique em "Executar". |- Para versões em Inglês,clique em Run Fix que é o mesmo que Consertar. |- Poste o relatório: C:\_OTL\MovedFiles\*.log Abs! Compartilhar este post Link para o post Compartilhar em outros sites
maicon_m 0 Denunciar post Postado Outubro 15, 2012 AdwCleaner log: # AdwCleaner v2.005 - Logfile created 10/15/2012 at 14:08:45 # Updated 14/10/2012 by Xplode # Operating system : Windows 7 Ultimate Service Pack 1 (64 bits) # User : Maicon - LAMACHINE # Boot Mode : Normal # Running from : C:\Users\Maicon\Desktop\adwcleaner1.exe # Option [Delete] ***** [services] ***** ***** [Files / Folders] ***** File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml File Deleted : C:\Users\Maicon\AppData\Roaming\Mozilla\Firefox\Profiles\tfs3ddk7.default\searchplugins\Askcom.xml Folder Deleted : C:\Program Files (x86)\Babylon Folder Deleted : C:\ProgramData\Babylon Folder Deleted : C:\ProgramData\boost_interprocess Folder Deleted : C:\Users\Maicon\AppData\Local\Babylon Folder Deleted : C:\Users\Maicon\AppData\LocalLow\BabylonToolbar Folder Deleted : C:\Users\Maicon\AppData\Roaming\Babylon Folder Deleted : C:\Users\Maicon\AppData\Roaming\Mozilla\Firefox\Profiles\tfs3ddk7.default\extensions\ffxtlbr@babylon.com ***** [Registry] ***** Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASMANCS Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Key Deleted : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}] ***** [internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Registry is clean. -\\ Mozilla Firefox v15.0.1 (pt-BR) Profile name : default File : C:\Users\Maicon\AppData\Roaming\Mozilla\Firefox\Profiles\tfs3ddk7.default\prefs.js Deleted : user_pref("browser.search.defaultengine", "Ask.com"); Deleted : user_pref("browser.search.defaultenginename", "Ask.com"); Deleted : user_pref("browser.search.defaulturl", "hxxp://search.babylon.com/web/{searchTerms}?babsrc=browserse[...] Deleted : user_pref("browser.search.order.1", "Ask.com"); Deleted : user_pref("browser.startup.homepage", "hxxp://br.ask.com/?l=dis&o=14672"); Deleted : user_pref("extensions.BabylonToolbar.aflt", "orgnl"); Deleted : user_pref("extensions.BabylonToolbar.bbDpng", 15); Deleted : user_pref("extensions.BabylonToolbar.lastDP", 15); Deleted : user_pref("extensions.BabylonToolbar.lastVrsnTs", ""); Deleted : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "7.0"); Deleted : user_pref("extensions.BabylonToolbar.propectorlck", 59914428); Deleted : user_pref("extensions.BabylonToolbar.smplGrp", "free"); -\\ Google Chrome v22.0.1229.94 File : C:\Users\Maicon\AppData\Local\Google\Chrome\User Data\Default\Preferences Deleted [l.8] : homepage = "hxxp://search.babylon.com/home", Deleted [l.1394] : homepage = "hxxp://search.babylon.com/home", -\\ Opera v12.2.1578.0 File : C:\Users\Maicon\AppData\Roaming\Opera\Opera\operaprefs.ini [OK] File is clean. ************************* AdwCleaner[s1].txt - [3662 octets] - [15/10/2012 14:08:45] ########## EOF - C:\AdwCleaner[s1].txt - [3722 octets] ########## OTL log: Files\Folders moved on Reboot... C:\Users\Maicon\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. C:\Windows\temp\_avast_\unp142608807.tmp moved successfully. C:\Windows\temp\_avast_\unp185864129.tmp moved successfully. File\Folder C:\Windows\temp\_avast_\unp206264894.tmp not found! C:\Windows\temp\_avast_\unp224482664.tmp moved successfully. C:\Windows\temp\_avast_\unp229988843.tmp moved successfully. C:\Windows\temp\_avast_\unp266518377.tmp moved successfully. C:\Windows\temp\_avast_\unp27247496.tmp moved successfully. File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot. PendingFileRenameOperations files... Registry entries deleted on Reboot.. A navegação continua lenta. A página carrega uns 90% e o restante fica travado. Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Outubro 15, 2012 Boa Tarde! maicon_m |- O log da OTL veio incompleto! |- Ps: Não vejo seu problema associado à malware(s). |- Baixe: < > ( ... par Nicolas Coolman ) |- Salve-o no desktop! |- Desabilite seu antivírus! |- Caso utilize o Avast,estabeleça esta configuração à SandBox. |- Para Windows Vista ou 7,clique direito e execute o arquivo como administrador. |- Aguarde a conclusão do scan e clique em "Copier". <- Aguarde! |- Além do relatório,teremos no desktop: ZHP_uninstall, MBRCheck, ZHPDiag, ZHPFix |- Poste e/ou cole aqui,o link que será gerado,logo após o relatório. Abs! Compartilhar este post Link para o post Compartilhar em outros sites
maicon_m 0 Denunciar post Postado Outubro 15, 2012 DigRam, os arquivos gerados no desktop podem ser apagados? http://pjjoint.malekal.com/files.php?read=ZHPDiag_20121015_z8g15v12t11u13 Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Outubro 15, 2012 Boa Tarde! maicon_m ##### Total RAM: 4095 MB (16% free) ##### |- você possui pouca memória RAM disponível ou livre. ( Desinstale Glary ) |- Desinstale softwares que não utiliza ou coloque mais RAM na máquina. |- Desinstale: C:\Program Files (x86)\uTorrent DigRam, os arquivos gerados no desktop podem ser apagados? |- No momento oportuno,serão removidos. -/- |- Feche programas/pastas que estejam abertas. |- Feche,também,o navegador! |- Para Windows Vista,desabilite a UAC. |- Para Windows Vista ou 7,clique direito em ZHPFix.exe e execute-o como administrador. |- Selecione e copie estas informações,que estão no Code,para o "Bloco de Notas". [MD5.00000000000000000000000000000000] [APT] [{40CC35BF-A81F-4B8C-B425-F44AF99435AE}] (...) -- C:\Users\Maicon\Desktop\DirectX.exe (.not file.) [MD5.00000000000000000000000000000000] [APT] [{7483F8CB-F233-4CCE-864A-5697926C9D3A}] (...) -- C:\Users\Maicon\Downloads\Plugins.PS.2011\plugins\Alien Skin Bundle \Alien.Skin.Blow.Up.v2.0.4.Incl.Keymaker-CORE\Alien.Skin.Blow.Up.v2.0.4.Incl.Keymaker-CORE O43 - CFD: 29/10/2011 - 13:01:01 - [0] ----D C:\Users\Maicon\AppData\Local\Dados de aplicativos O43 - CFD: 29/10/2011 - 13:01:01 - [0] ----D C:\Users\Maicon\AppData\Local\Histórico O43 - CFD: 15/10/2012 - 15:23:55 - [0] ----D C:\Users\Maicon\AppData\Local\{9272053F-7D69-42E5-985F-2C24504DC65E} O51 - MPSK:{46192d01-0244-11e1-aadb-806e6f6e6963}\AutoRun\command. (.LG Electronics - BlueBirds Module.) -- F:\BlueBirds.exe O53 - SMSR:HKLM\...\startupreg\Octoshape Streaming Services [Key] . (.Octoshape ApS - Main program for Octoshape client.) -- C:\Users\Maicon\AppData\Roaming\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe O87 - FAEL: "{AED13F8D-5D76-4773-A22D-BCCA02CB27D5}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files (x86)\Opera\pluginwrapper\opera_plugin_wrapper.exe (.not file.) O87 - FAEL: "{A02B4F66-CE5B-442B-9DBB-4CAD944AA1FC}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files (x86)\Opera\pluginwrapper\opera_plugin_wrapper.exe (.not file.) O87 - FAEL: "TCP Query User{75F347E7-EC91-4474-BB33-6ACAAF4C3B4B}C:\users\maicon\downloads\resident_evil\resident_evil_5\re5dx10.exe" |In - Private - P6 - TRUE | .(...) -- C:\users\maicon\downloads\resident_evil\resident_evil_5\re5dx10.exe (.not file.) O87 - FAEL: "UDP Query User{452B8EC6-F934-46F6-86B3-C732AD84FCE1}C:\users\maicon\downloads\resident_evil\resident_evil_5\re5dx10.exe" |In - Private - P17 - TRUE | .(...) -- C:\users\maicon\downloads\resident_evil\resident_evil_5\re5dx10.exe (.not file.) O87 - FAEL: "TCP Query User{31840A30-0094-49BD-93C5-242D1B47861D}C:\users\maicon\downloads\resident_evil\resident_evil_5\re5dx9.exe" |In - Private - P6 - TRUE | .(...) -- C:\users\maicon\downloads\resident_evil\resident_evil_5\re5dx9.exe (.not file.) O87 - FAEL: "UDP Query User{CB3DE5CC-56B8-46DA-95EE-9A2CAF60D2C6}C:\users\maicon\downloads\resident_evil\resident_evil_5\re5dx9.exe" |In - Private - P17 - TRUE | .(...) -- C:\users\maicon\downloads\resident_evil\resident_evil_5\re5dx9.exe (.not file.) O87 - FAEL: "TCP Query User{483415B5-138A-4635-8205-CCA32ABEE6FF}C:\windows\kmsemulator.exe" |In - Private - P6 - TRUE | .(...) -- C:\windows\kmsemulator.exe (.not file.) => Infection Diverse (Trojan.Keygen) O87 - FAEL: "UDP Query User{2A544F41-405C-419F-9A85-0DDC8E21A57C}C:\windows\kmsemulator.exe" |In - Private - P17 - TRUE | .(...) -- C:\windows\kmsemulator.exe (.not file.) => Infection Diverse (Trojan.Keygen) [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: Modified hostfix proxyfix emptytemp emptyflash firewallraz sysrestore |- Estando com o Bloco de Notas aberto,acione os atalhos: "Ctrl+A" -> "Ctrl+C" |- Minimize o Bloco de Notas. |- Clique no menu,"Paste ClipBoard". |- Clique em "GO" -> Oui. |- Ps: Temos,àcima,sequência de imagens para maior exclarecimento. |- Poste o relatório: C:\ZHP\ZHPFix[R1].txt Abs! Compartilhar este post Link para o post Compartilhar em outros sites
maicon_m 0 Denunciar post Postado Outubro 15, 2012 Rapport de ZHPFix 1.3.01 par Nicolas Coolman, Update du 22/09/2012 Fichier d'export Registre : Run by Maicon at 15/10/2012 17:09:28 Windows 7 Ultimate Edition, 64-bit Service Pack 1 (Build 7601) Web site : http://nicolascoolman.skyrock.com/ ========== Registry Key ========== DELETED CLSID MPSK: {46192d01-0244-11e1-aadb-806e6f6e6963} DELETED Key*: StartupReg: Octoshape Streaming Services ========== Registry Value ========== DELETED {AED13F8D-5D76-4773-A22D-BCCA02CB27D5} DELETED {A02B4F66-CE5B-442B-9DBB-4CAD944AA1FC} NOT FOUND TCP Query User{75F347E7-EC91-4474-BB33-6ACAAF4C3B4B}C:/users/maicon/downloads/resident_evil/resident_evil_5/re5dx10.exe NOT FOUND UDP Query User{452B8EC6-F934-46F6-86B3-C732AD84FCE1}C:/users/maicon/downloads/resident_evil/resident_evil_5/re5dx10.exe NOT FOUND TCP Query User{31840A30-0094-49BD-93C5-242D1B47861D}C:/users/maicon/downloads/resident_evil/resident_evil_5/re5dx9.exe NOT FOUND UDP Query User{CB3DE5CC-56B8-46DA-95EE-9A2CAF60D2C6}C:/users/maicon/downloads/resident_evil/resident_evil_5/re5dx9.exe NOT FOUND TCP Query User{483415B5-138A-4635-8205-CCA32ABEE6FF}C:/windows/kmsemulator.exe NOT FOUND UDP Query User{2A544F41-405C-419F-9A85-0DDC8E21A57C}C:/windows/kmsemulator.exe ProxyFix : Proxy killed successfully DELETED ProxyServer Value DELETED ProxyEnable Value DELETED EnableHttp1_1 Value DELETED ProxyHttp1.1 Value DELETED ProxyOverride Value ========== Registry Data Items ========== REMOVED Explorer Association Data Application: http://www.filefacts.net/redirect.php?ext=%s ========== Repertory ========== NOT FOUND C:\Users\Maicon\AppData\Local\Dados de aplicativos NOT FOUND C:\Users\Maicon\AppData\Local\Histórico DELETED Folder: C:\Users\Maicon\AppData\Local\{9272053F-7D69-42E5-985F-2C24504DC65E} DELETED Window Temporary: DELETED Flash Cookies: ========== File ========== NOT FOUND Folder/File: c:\users\maicon\downloads\plugins.ps.2011\plugins\alien skin bundle \alien.skin.blow.up.v2.0.4.incl.keymaker-core\alien.skin.blow.up.v2.0.4.incl.keymaker-core DELETE on Reboot f:\bluebirds.exe DELETED File: c:\users\maicon\appdata\roaming\octoshape\octoshape streaming services\octoshapeclient.exe DELETED Window Temporary: DELETED Flash Cookies: ========== Task ========== DELETED Task: {40CC35BF-A81F-4B8C-B425-F44AF99435AE} DELETED Task: {7483F8CB-F233-4CCE-864A-5697926C9D3A} ========== Summary ========== 2 : Registry Key 14 : Registry Value 1 : Registry Data Items 5 : Repertory 5 : File 2 : Task End of clean in 00mn 10s ========== Report File ========== C:\ZHP\ZHPFix[R1].txt - 15/10/2012 17:09:30 [2590] Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Outubro 15, 2012 Boa Tarde! maicon_m |- Desinstale ZHPDiag,clicando em "ZHP_uninstall". |- Abra a ferramenta AdwCleaner e clique em "Uninstall". -/- |- Abra o OTL.exe -> Clique em Limpeza. <-- Confirme! |- Ps: O computador irá reiniciar! -/- |- Seus logs estão limpos! |- Tudo Ok? Abs! Compartilhar este post Link para o post Compartilhar em outros sites
maicon_m 0 Denunciar post Postado Outubro 15, 2012 Obrigado pela atenção e orientações DigRam. Você pode me dizer qual o resultado de todos esses escaneamentos? Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Outubro 15, 2012 Obrigado pela atenção e orientações DigRam. Você pode me dizer qual o resultado de todos esses escaneamentos? Olá! |- Práticamente,remoção de adwares. |- Seu computador possui softwares desnecessários,o que causa consumo de memória,que seriam úteis em aplicações fundamentais. |- Ps: Cito como exemplo o Bonjour,Stardock,etc... |- O plugin de segurança bancária é um estorvo,mas...considero um mal necessário. rsr... |- O antivírus é outro 'mal' necessário,pois poucos sabem navegar sem sua presença. Abs! Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Outubro 21, 2012 PROBLEMA RESOLVIDO Caso o autor necessite que o tópico seja reaberto basta enviar uma Mensagem Privada para um Moderador com um link para o tópico. Compartilhar este post Link para o post Compartilhar em outros sites
