[Resolvido] &nbspnotebook cheio de virus

jgwerneck · Outubro 11, 2012

Olá Pessoal, seguem em o log do hijackthis. Acho q ta cheio de virus, fica derrubando a conexão da internet.

Obrigado

Joao Werneck

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 23:08:24, on 10/10/2012

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v9.00 (9.00.8112.16450)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Sony\ISB Utility\ISBMgr.exe

C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\AVAST Software\Avast\AvastUI.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Stardock\CursorFX\CursorFX.exe

C:\Program Files\Sony\SmartWi Connection Utility\CCP.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\taskeng.exe

C:\Program Files\Sony\VAIO Care\VAIOCareService.exe

C:\Program Files\Sony\SmartWi Connection Utility\SmartWi.exe

C:\Program Files\Sony\SmartWi Connection Utility\ThirdPartyAppMgr.exe

C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe

C:\Program Files\Sony\SmartWi Connection Utility\PowerManager.exe

C:\Program Files\Sony\VAIO Care\VCsystray.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\Program Files\Common Files\microsoft shared\virtualization handler\cvh.exe

C:\Program Files\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe

C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe

C:\Users\Amanda\Downloads\HiJackThis.exe

C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://sony.msn.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?affID=112454&tt=060612_6_&babsrc=HP_ss&mntrId=846d4deb00000000000090fba6fdcc0a

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - {e0301295-ab3e-4af3-979f-3d453c5f9f48} - (no file)

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Bcool - {1A865603-0D29-3D6A-558F-D913D12BEC1D} - C:\ProgramData\Bcool\bhoclass.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [smartWiHelper] "C:\Program Files\Sony\SmartWi Connection Utility\SmartWiHelper.exe" /WindowsStartup

O4 - HKLM\..\Run: [iSBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"

O4 - HKLM\..\Run: [PMBVolumeWatcher] C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe

O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"

O4 - HKLM\..\Run: [switchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O4 - HKLM\..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

O4 - HKCU\..\Run: [CursorFX] "C:\Program Files\Stardock\CursorFX\CursorFX.exe"

O4 - HKCU\..\Run: [Facebook Update] "C:\Users\Amanda\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

O4 - HKCU\..\Run: [Google Update] "C:\Users\Amanda\AppData\Local\Google\Update\GoogleUpdate.exe" /c

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIÇO LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO DE REDE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIÇO DE REDE')

O4 - Global Startup: Bluetooth.lnk = ?

O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe

O8 - Extra context menu item: Enviar imagem para Dispositivo &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O8 - Extra context menu item: Enviar página para Dispositivo &Bluetooth ... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe

O23 - Service: Serviço do Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

O23 - Service: PMBDeviceInfoProvider - Sony Corporation - C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe

O23 - Service: Intel® Sample Collector (SampleCollector) - Intel Corporation - C:\Program Files\Sony\VAIO Care\collsvc.exe

O23 - Service: VAIO Media plus Content Importer (SOHCImp) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\SOHLib\SOHCImp.exe

O23 - Service: VAIO Media plus Database Manager (SOHDBSvr) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe

O23 - Service: VAIO Media plus Digital Media Server (SOHDms) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\SOHLib\SOHDms.exe

O23 - Service: VAIO Media plus Device Searcher (SOHDs) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\SOHLib\SOHDs.exe

O23 - Service: VAIO Media plus Playlist Manager (SOHPlMgr) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe

O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe

O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

O23 - Service: VAIO Power Management - Sony Corporation - C:\Program Files\Sony\VAIO Power Management\SPMService.exe

O23 - Service: VAIO Content Folder Watcher (VCFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe

O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe

O23 - Service: VAIO Content Metadata Intelligent Network Service Manager (VcmINSMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe

O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe

O23 - Service: VUAgent - Sony Corporation - C:\Program Files\Sony\VAIO Update 5\VUAgent.exe

O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe

--

End of file - 9883 bytes

DigRam · Outubro 11, 2012

Bom Dia! jgwerneck

|- Baixe: < > ( ... par Xplode )

|- Ao acessar,clique na imagem: < >

|- Salve-o no desktop!

|- Clique direito em adwcleaner.exe,e escolha sua execução como "administrador".

|- Ps: Dê início ao scan,clicando em "Delete" ou "Suppression".

|- Ao concluir,poste o relatório: C:\AdwCleaner[S1].txt

|- Baixe: < > ( ... par Nicolas Coolman )

|- Salve-o no desktop!

|- Desabilite seu antivírus!

|- Caso utilize o Avast,estabeleça esta configuração à SandBox.

|- Para Windows Vista ou 7,clique direito e execute o arquivo como administrador.

|- Aguarde a conclusão do scan e clique em "Copier". <- Aguarde!

|- Além do relatório,teremos no desktop: ZHP_uninstall, MBRCheck, ZHPDiag, ZHPFix

|- Poste e/ou cole aqui,o link que será gerado,logo após o relatório.

Abs!

jgwerneck · Outubro 12, 2012

# AdwCleaner v2.004 - Logfile created 10/11/2012 at 22:08:43

# Updated 06/10/2012 by Xplode

# Operating system : Windows 7 Starter (32 bits)

# User : Amanda - AMANDA-VAIO

# Boot Mode : Normal

# Running from : C:\Users\Amanda\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

File Deleted : C:\user.js

Folder Deleted : C:\Program Files\Conduit

Folder Deleted : C:\ProgramData\Babylon

Folder Deleted : C:\ProgramData\InstallMate

Folder Deleted : C:\ProgramData\Premium

Folder Deleted : C:\Users\Amanda\AppData\Local\Conduit

Folder Deleted : C:\Users\Amanda\AppData\Local\Temp\BabylonToolbar

Folder Deleted : C:\Users\Amanda\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\Amanda\AppData\LocalLow\PriceGong

Folder Deleted : C:\Users\Amanda\AppData\Roaming\Babylon

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKLM\Software\Babylon

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL

Key Deleted : HKLM\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho

Key Deleted : HKLM\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2851643

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.babylon.com/?affID=112454&tt=060612_6_&babsrc=HP_ss&mntrId=846d4deb00000000000090fba6fdcc0a --> hxxp://www.google.com

-\\ Google Chrome v23.0.1271.26

File : C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.12] : homepage = "hxxp://search.babylon.com/?affID=112454&tt=060612_6_&babsrc=HP_ss&mntrId=846d4deb00000000000090fba6fdcc0a",

Deleted [l.40] : icon_url = "hxxp://www.babylon.com/favicon.ico",

Deleted [l.43] : keyword = "babylon.com",

Deleted [l.46] : search_url = "hxxp://search.babylon.com/?q={searchTerms}&babsrc=SP_crm",

Deleted [l.1363] : homepage = "hxxp://search.babylon.com/?affID=112454&tt=060612_6_&babsrc=HP_ss&mntrId=846d4deb00000000000090fba6fdcc0a",

*************************

AdwCleaner[s1].txt - [3379 octets] - [11/10/2012 22:08:43]

########## EOF - C:\AdwCleaner[s1].txt - [3439 octets] ##########

DigRam · Outubro 12, 2012

Bom Dia! jgwerneck

|- Restou postar o link ao relatório,de ZHPDiag_silent.

|- Outra possibilidade,seria enviar o relatório a myfile.tk.

|- Cole,aqui,o endereço que lhe for disponibilizado.

Abs!

jgwerneck · Outubro 12, 2012

http://pjjoint.malekal.com/files.php?read=ZHPDiag_20121012_t9o11b12f7y10

Desculpa, n tava conseguindo faze o scan c o avast...

agora foi

DigRam · Outubro 12, 2012

Boa Tarde! jgwerneck

|- Feche programas/pastas que estejam abertas.

|- Feche,também,o navegador!

|- Para Windows Vista,desabilite a UAC.

|- Para Windows Vista ou 7,clique direito em ZHPFix.exe e execute-o como administrador.

|- Selecione e copie estas informações,que estão no Code,para o "Bloco de Notas".

G1 - GCS: Preference [user Data\Default] http://search.babylon.com
O2 - BHO: (no name) - {1A865603-0D29-3D6A-558F-D913D12BEC1D} Orphean Key
O43 - CFD: 07/03/2011 - 12:18:59 - [0] ----D C:\Users\Amanda\AppData\Local\Dados de aplicativos
O43 - CFD: 07/03/2011 - 12:18:59 - [0] ----D C:\Users\Amanda\AppData\Local\Histórico
O43 - CFD: 08/03/2011 - 22:42:04 - [0] ----D C:\Users\Amanda\AppData\Local\{CE895ABA-26FC-4F7B-8834-91181F3EF204}
O43 - CFD: 07/03/2011 - 22:30:23 - [0] ----D C:\Users\Amanda\AppData\Local\{D11E28D8-4AD1-4B47-B9F0-9621F5D08B27}
O51 - MPSK:{3e36f386-5b63-11e1-a0ec-54424977edb9}\AutoRun\command. (...) -- D:\Windows\AutoRun.exe (.not file.)    => Infection USB (Trojan.USB)
[MD5.2D2894581D355D5F44EAE38898A66846] [sPRF][01/01/2012] (.Conduit Ltd. - Conduit Toolbar.) -- C:\Users\Amanda\AppData\Local\Temp\tbuTo0.dll   [4398888]

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified

C:\Users\Amanda\AppData\LocalLow\Conduit    => Toolbar.Conduit

proxyfix
emptytemp
emptyflash
emptyclsid
firewallraz
sysrestore

|- Estando com o Bloco de Notas aberto,acione os atalhos: "Ctrl+A" -> "Ctrl+C"

|- Minimize o Bloco de Notas.

|- Clique no menu,"Paste ClipBoard".

|- Clique em "GO" -> Oui.

|- Ps: Temos,àcima,sequência de imagens para maior exclarecimento.

|- Poste o relatório: C:\ZHP\ZHPFix[R1].txt

Abs!

jgwerneck · Outubro 12, 2012

Rapport de ZHPFix 1.3.01 par Nicolas Coolman, Update du 22/09/2012

Fichier d'export Registre :

Run by Amanda at 12/10/2012 16:24:20

Windows 7 Starter Edition, 32-bit (Build 7600)

Web site : http://nicolascoolman.skyrock.com/

========== Memory Module ==========

DELETED Memory Module: C:\Users\Amanda\AppData\Local\Temp\tbuTo0.dll

========== Registry Key ==========

DELETED Key: CLSID BHO: {1A865603-0D29-3D6A-558F-D913D12BEC1D}

DELETED CLSID MPSK: {3e36f386-5b63-11e1-a0ec-54424977edb9}

========== Registry Value ==========

ProxyFix : Proxy killed successfully

DELETED ProxyServer Value

DELETED ProxyEnable Value

DELETED EnableHttp1_1 Value

DELETED ProxyHttp1.1 Value

DELETED ProxyOverride Value

No Value in Standard Profile Register Key FirewallRaz :

No Value in Domain Profile Register Key FirewallRaz :

DELETED FirewallRaz (None) : {D72942EE-71F2-4EBD-A4DD-B608DD270959}

========== Registry Data Items ==========

REPLACED Value EnableLUA : Good (1) - Bad (0)

========== Browser Profiles ==========

FOUND Chrome File: C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Preferences

DELETED Chrome Site: http://search.babylon.com

========== Repertory ==========

========== File ==========

DELETED File: c:\users\amanda\appdata\local\temp\tbuto0.dll

DELETED Window Temporary:

DELETED Flash Cookies:

========== Restoration ==========

Restore System Point created succefully

========== Summary ==========

1 : Memory Module

2 : Registry Key

9 : Registry Value

1 : Registry Data Items

3 : File

2 : Browser Profiles

1 : Restoration

End of clean in 02mn 11s

========== Report File ==========

C:\ZHP\ZHPFix[R1].txt - 12/10/2012 16:24:45 [1674]

DigRam · Outubro 12, 2012

Boa Tarde! jgwerneck

|- Execute escaneamento online em | |

|- Utilize o navegador "Internet Explorer",para essa tarefa!

|- Siga,conforme a imagem,essa verificação ou scan.

|- Ao concluir,clique em "List of found threats" >> "Export to text file"

|- Salve esse texto no desktop,com o nome: Esetlog

|- Ps: Caso nada seja detectado,não teremos relatório ou lista presente.

|- Poste o relatório que estará no desktop! ( Esetlog.txt )

Abs!

jgwerneck · Outubro 13, 2012

C:\ProgramData\Bcool\bhoclass.dll Win32/Adware.MultiPlug.A application cleaned by deleting - quarantined

C:\ProgramData\Bcool\uninstall.exe Win32/Adware.MultiPlug.A application cleaned by deleting - quarantined

C:\Users\Amanda\Downloads\203498_Planilha-Simplificada-de-Orcamento-Domestico-DW.exe a variant of Win32/InstallCore.AT application cleaned by deleting - quarantined

C:\Users\Amanda\Downloads\Para_Imprimir_Reaviso_233301817novoBocleto_pdf-.zip Win32/TrojanDownloader.Banload.RLB trojan deleted - quarantined

DigRam · Outubro 13, 2012

Bom Dia! jgwerneck

|- Abra a ferramenta AdwCleaner e clique em "Uninstall".

|- Desinstale ZHPDiag,clicando em "ZHP_uninstall".

-/-

|- Seus logs estão limpos!

|- Tudo Ok?

Abs!

jgwerneck · Outubro 13, 2012

Obrigado DigRam...

Abs

DigRam, meu note ficava caindo a conexão toda hora, qdo outros computadores na mesma conexão não caiam, e acabou de cair de novo. N tem mais nada de virus? Vou postar o log do hijackthis denovo.

Obrigado

Abs

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 14:47:35, on 13/10/2012

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v9.00 (9.00.8112.16450)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskhost.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Sony\VAIO Care\VAIOCareService.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Sony\ISB Utility\ISBMgr.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files\Sony\PMB\PMBVolumeWatcher.exe

C:\Program Files\Sony\SmartWi Connection Utility\CCP.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\Stardock\CursorFX\CursorFX.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\Sony\SmartWi Connection Utility\SmartWi.exe

C:\Program Files\Sony\SmartWi Connection Utility\ThirdPartyAppMgr.exe

C:\Program Files\Sony\SmartWi Connection Utility\PowerManager.exe

C:\Program Files\Sony\VAIO Care\VCsystray.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\Windows\system32\taskhost.exe

C:\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://sony.msn.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - {e0301295-ab3e-4af3-979f-3d453c5f9f48} - (no file)

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (file missing)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (file missing)