[Resolvido] &nbspLog para analise

Edvan · Dezembro 18, 2012

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 07:54:45, on 18/12/2012

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.17099)

Boot mode: Normal

Running processes:

C:\windows\System32\smss.exe

C:\windows\system32\csrss.exe

C:\windows\system32\winlogon.exe

C:\windows\system32\services.exe

C:\windows\system32\lsass.exe

C:\ARQUIV~1\GbPlugin\GbpSv.exe

C:\windows\system32\svchost.exe

C:\windows\System32\svchost.exe

C:\windows\system32\svchost.exe

C:\windows\system32\spoolsv.exe

C:\windows\system32\svchost.exe

C:\Arquivos de programas\Java\jre6\bin\jqs.exe

C:\windows\Explorer.EXE

C:\windows\System32\spool\DRIVERS\W32X86\3\HP1006MC.EXE

C:\windows\System32\alg.exe

C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe

C:\windows\system32\ctfmon.exe

C:\Arquivos de programas\Malwarebytes' Anti-Malware\mbam.exe

C:\ARQUIV~1\ARQUIV~1\SpeedBit\SBUpdate\SBUpdate.exe

C:\windows\notepad.exe

C:\Arquivos de programas\Mozilla Firefox\firefox.exe

C:\Arquivos de programas\Mozilla Firefox\plugin-container.exe

C:\HiJackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005

O1 - Hosts: 200.252.20.12 www5.infoseg.gov.br # gbplugin

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: CompSegIB - {2E3C3651-B19C-4DD9-A979-901EC3E930AF} - C:\Arquivos de programas\Scpad\scpsssh2.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre6\bin\ssv.dll

O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Arquivos de programas\Alwil Software\Avast5\aswWebRepIE.dll (file missing)

O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\ARQUIV~1\GBPLUGIN\gbieh.dll

O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\ARQUIV~1\GbPlugin\gbiehcef.dll

O2 - BHO: G-Buster Browser Defense Banco Real - {C41A1C0E-EA6C-11D4-B1B8-444553540007} - C:\ARQUIV~1\GbPlugin\gbiehabn.dll

O2 - BHO: G-Buster Browser Defense Itaú Unibanco - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\ARQUIV~1\GbPlugin\gbiehuni.dll

O2 - BHO: G-Buster Browser Defense Sicredi - {C41A1C0E-EA6C-11D4-B1B8-444553540011} - C:\ARQUIV~1\GbPlugin\gbiehscd.dll

O2 - BHO: G-Buster Browser Defense ISG - {C41A1C0E-EA6C-11D4-B1B8-444553540015} - C:\ARQUIV~1\GbPlugin\gbiehisg.dll

O2 - BHO: LinkVerifierBHO - {D5974A72-C81C-4DC3-BE77-A8A7BBC8864E} - C:\Arquivos de programas\DAP\LinkVerifier.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Arquivos de programas\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [AnySend Updater] C:\Arquivos de programas\AnySend\AnySendUpdater.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe"

O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\Documents and Settings\All Users\Dados de aplicativos\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript

O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe

O8 - Extra context menu item: &Download with &DAP - C:\Arquivos de programas\DAP\dapextie.htm

O8 - Extra context menu item: &Verify with DAP - C:\Arquivos de programas\DAP\dapverify.htm

O8 - Extra context menu item: Download &all with DAP - C:\Arquivos de programas\DAP\dapextie2.htm

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe

O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp

O15 - Trusted Zone: www.bancobrasil.com.br

O15 - Trusted Zone: http://www.bancobrasil.com.br

O15 - Trusted Zone: www14.bancobrasil.com.br

O15 - Trusted Zone: www2.bancobrasil.com.br

O15 - Trusted Zone: http://www.bancoreal.com.br

O15 - Trusted Zone: http://www.bancosantander.com.br

O15 - Trusted Zone: www.bb.com.br

O15 - Trusted Zone: http://www.bb.com.br

O15 - Trusted Zone: http://www.itau.com.br

O15 - Trusted Zone: wwws.realsecureweb.com.br

O15 - Trusted Zone: www.santander.com.br

O15 - Trusted Zone: http://www.santander.com.br

O15 - Trusted Zone: www.santanderempresarial.com.br

O15 - Trusted Zone: http://www.santanderempresarial.com.br

O15 - Trusted Zone: www.santandernet.com.br

O15 - Trusted Zone: wwws.santandernet.com.br

O15 - Trusted Zone: wwws2.santandernet.com.br

O15 - Trusted Zone: www.santandernetibe.com.br

O15 - Trusted Zone: www.secureweb.com.br

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O20 - AppInit_DLLs: c:\docume~1\alluse~1\dadosd~1\browse~1\25986~1.67\{c16c1~1\browse~1.dll

O20 - Winlogon Notify: GbPluginAbn - C:\ARQUIV~1\GbPlugin\gbiehAbn.dll

O20 - Winlogon Notify: GbPluginBb - C:\ARQUIV~1\GbPlugin\gbieh.dll

O20 - Winlogon Notify: GbPluginCef - C:\ARQUIV~1\GbPlugin\gbiehCef.dll

O20 - Winlogon Notify: GbPluginIsg - C:\ARQUIV~1\GbPlugin\gbiehIsg.dll

O20 - Winlogon Notify: GbPluginScd - C:\ARQUIV~1\GbPlugin\gbiehScd.dll

O20 - Winlogon Notify: GbPluginUni - C:\ARQUIV~1\GbPlugin\gbiehUni.dll

O21 - SSODL: CompIBBrd - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Arquivos de programas\Scpad\scpLIB.dll

O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\windows\system32\browseui.dll

O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\windows\system32\browseui.dll

O22 - SharedTaskScheduler: scpLIB - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Arquivos de programas\Scpad\scpLIB.dll

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: Gbp Service (GbpSv) - - C:\ARQUIV~1\GbPlugin\GbpSv.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Arquivos de programas\Java\jre6\bin\jqs.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Arquivos de programas\Mozilla Maintenance Service\maintenanceservice.exe

O24 - Desktop Component 0: (no name) - http://t1.gstatic.com/images?q=tbn:ANd9GcTowRwj4hNj8WH8DGMEiwx0p8DZmY3A4KvJEwPQBB76GF5lJFnzeR--vofO

--

End of file - 8166 bytes

---------------xx----------------------

Malwarebytes Anti-Malware 1.65.1.1000

www.malwarebytes.org

Versão da Base de Dados: v2012.12.17.09

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 7.0.5730.13

f001869 :: FUN0105 [administrador]

17/12/2012 17:56:33

mbam-log-2012-12-17 (17-56-33).txt

Tipo de Verificação: Verificação Completa (C:\|)

Opções de verificação desativadas: P2P

Objetos escaneados: 415585

Tempo decorrido: 1 hora(s), 14 minuto(s), 13 segundo(s)

Processos de Memória Detectados: 0

(Não foram detectados ítens maliciosos)

Módulos de Memória Detectados: 0

(Não foram detectados ítens maliciosos)

Chaves de Registro Detectadas: 2

HKCU\SOFTWARE\InstallCore\funmoods (PUP.FunMoods) -> Enviado para a Quarentena e deletado com sucesso.

HKCU\Software\sistemanet (Malware.Trace) -> Enviado para a Quarentena e deletado com sucesso.

Valores de Registro Detectadas: 0

(Não foram detectados ítens maliciosos)

Itens de Dados no Registro Detectadas: 1

HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Ruim: (1) Bom: (0) -> Enviado para a Quarentena e reparado com sucesso.

Pastas Detectadas: 0

(Não foram detectados ítens maliciosos)

Arquivos Detectados: 5

C:\Documents and Settings\f001869\Configurações locais\temp\ICReinstall_windows-media-player-11-final-baixaki-32-bits.exe (PUP.AdBundle) -> Enviado para a Quarentena e deletado com sucesso.

C:\Documents and Settings\f001869\Configurações locais\temp\arquivo_f.exe (Adware.Bundler) -> Enviado para a Quarentena e deletado com sucesso.

C:\Documents and Settings\f001869\Configurações locais\temp\10831687.Uninstall\Uninstall.exe (Adware.Agent) -> Enviado para a Quarentena e deletado com sucesso.

C:\Documents and Settings\f001869\Configurações locais\temp\2178609.Uninstall\Uninstall.exe (Adware.Agent) -> Enviado para a Quarentena e deletado com sucesso.

C:\Documents and Settings\f001869\Meus documentos\Downloads\cd.exe (PUP.FunMoods) -> Enviado para a Quarentena e deletado com sucesso.

(fim)

----------------------------xxx---------------------------------

# AdwCleaner v2.006 - Logfile created 12/17/2012 at 17:42:47

# Updated 30/10/2012 by Xplode

# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)

# User : f001869 - FUN0105

# Boot Mode : Normal

# Running from : C:\Documents and Settings\f001869\Desktop\AdwCleaner\AdwCleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

File Deleted : C:\Arquivos de programas\Mozilla Firefox\searchplugins\babylon.xml

File Deleted : C:\user.js

Folder Deleted : C:\Documents and Settings\All Users\Dados de aplicativos\Babylon

Folder Deleted : C:\Documents and Settings\All Users\Menu Iniciar\Programas\Media Finder

Folder Deleted : C:\Documents and Settings\f001869\Dados de aplicativos\Babylon

Folder Deleted : C:\Documents and Settings\f001869\Dados de aplicativos\Funmoods

Folder Deleted : C:\Documents and Settings\f001869\Dados de aplicativos\Media Finder

Folder Deleted : C:\Documents and Settings\f001869\Dados de aplicativos\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\gencrawler@some.com

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software

Key Deleted : HKCU\Software\BabylonToolbar

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\ConduitSearchScopes

Key Deleted : HKCU\Software\DataMngr

Key Deleted : HKCU\Software\DataMngr_Toolbar

Key Deleted : HKCU\Software\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh

Key Deleted : HKCU\Software\MediaFinder

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Download with &Media Finder

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Translate this web page with Babylon

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\MenuExt\Translate with Babylon

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AD4DF010-E2FD-43CE-864A-6BD1EDC59AC2}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CA4520F3-AE13-4FB1-A513-58E23991C86D}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{DB4E9724-F518-4DFD-9C7C-78B52103CAB9}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2D360201-FFF5-11D1-8D03-00A0C959BC0A}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64182481-4F71-486B-A045-B233BD0DA8FC}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{99079A25-328F-4BD4-BE04-00955ACAA0A7}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9CFACCB6-2F3F-4177-94EA-0D2B72D384C1}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A40DC6C5-79D0-4CA8-A185-8FF989AF1115}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AD4DF010-E2FD-43CE-864A-6BD1EDC59AC2}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CA4520F3-AE13-4FB1-A513-58E23991C86D}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DB4E9724-F518-4DFD-9C7C-78B52103CAB9}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F72841F0-4EF1-4DF5-BCE5-B3AC8ACF5478}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

Key Deleted : HKCU\Software\PriceGong

Key Deleted : HKCU\Software\searchqutoolbar

Key Deleted : HKCU\Software\SmartBar

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKLM\Software\Babylon

Key Deleted : HKLM\Software\BrowserMngr

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B16632F1-24E0-4D99-A68D-70BFB6447C48}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\BabylonIEPI.DLL

Key Deleted : HKLM\SOFTWARE\Classes\BabylonIEPI.BabylonIEBho

Key Deleted : HKLM\SOFTWARE\Classes\BabylonIEPI.BabylonIEBho.1

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2D360201-FFF5-11D1-8D03-00A0C959BC0A}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CA4520F3-AE13-4FB1-A513-58E23991C86D}

Key Deleted : HKLM\SOFTWARE\Classes\esrv.funmoodsESrvc

Key Deleted : HKLM\SOFTWARE\Classes\esrv.funmoodsESrvc.1

Key Deleted : HKLM\SOFTWARE\Classes\gencrawler_gc.GenCrawler

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5F339F0B-716F-408F-A627-DEEB5DEB4020}

Key Deleted : HKLM\SOFTWARE\Classes\MF

Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap

Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard

Key Deleted : HKLM\SOFTWARE\Classes\SearchQUIEHelper.DNSGuard.1

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2233703

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{A1489C85-4F6F-48C4-AC9E-18B63AF4703E}

Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api

Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1

Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Layers

Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\Software\DataMngr

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dednnpigldgdbpgcdpfppmlcnnbjciel

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\lpmkgpnbiojfaoklbkpfneikocaobfai

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA4520F3-AE13-4FB1-A513-58E23991C86D}

***** [internet Browsers] *****

-\\ Internet Explorer v7.0.5730.13

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - BrowserMngr Start Page] = hxxp://search.babylon.com/?affID=110823&tt=3712_6&babsrc=HP_ss&mntrId=18f54a890000000000000022684e4d8a --> hxxp://www.google.com

*************************

AdwCleaner[s1].txt - [8569 octets] - [17/12/2012 17:42:47]

########## EOF - C:\AdwCleaner[s1].txt - [8629 octets] ##########

---------------------xx-------------------------

é aconselhado rodar o combofix??

DigRam · Dezembro 18, 2012

Olá! Edvan

|- O que ocorre?

-/-

|- Sim! Execute o ComboFix e relate algum incidente.

A+

Edvan · Dezembro 18, 2012

Maquina lenta, alguns arquivos sumiram do nada e notei arquivos, Dll suspeitos na raiz do "c".

ComboFix 12-12-17.02 - f001869 18/12/2012 17:39:23.2.2 - x86

Executando de: C:\Documents and Settings\f001869\Desktop\ComboFix.exe

ATENÇAO - ESTA MAQUINA NAO TEM O CONSOLE DE RECUPERAÇÃO INSTALADO !!

ADS - system32: deleted 2 bytes in 1 streams.

ADS - drivers: deleted 679 bytes in 2 streams.

((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))

C:\Documents and Settings\All Users\Dados de aplicativos\TEMP

C:\Documents and Settings\f001869\WINDOWS

C:\install.exe

C:\windows\system32\URTTemp

C:\windows\system32\URTTemp\fusion.dll

C:\windows\system32\URTTemp\mscoree.dll

C:\windows\system32\URTTemp\mscoree.dll.local

C:\windows\system32\URTTemp\mscorsn.dll

C:\windows\system32\URTTemp\mscorwks.dll

C:\windows\system32\URTTemp\msvcr71.dll

C:\windows\system32\URTTemp\regtlib.exe

(((((((((((((((( Arquivos/Ficheiros criados de 2012-11-18 to 2012-12-18 ))))))))))))))))))))))))))))

2012-12-18 20:42:00 . 2012-12-18 20:42:00 0 ----a-w- C:\windows\system32\drivers\ntndis.sys

2012-12-18 11:16:12 . 2012-10-30 22:51:56 21256 ----a-w- C:\windows\system32\drivers\aswFsBlk.sys

2012-12-18 11:16:11 . 2012-10-30 22:51:58 361032 ----a-w- C:\windows\system32\drivers\aswSP.sys

2012-12-18 11:15:56 . 2012-10-30 22:51:58 35928 ----a-w- C:\windows\system32\drivers\aswRdr.sys

2012-12-18 11:15:55 . 2012-10-30 22:51:58 54232 ----a-w- C:\windows\system32\drivers\aswTdi.sys

2012-12-18 11:15:53 . 2012-10-30 22:51:58 738504 ----a-w- C:\windows\system32\drivers\aswSnx.sys

2012-12-18 11:15:52 . 2012-10-30 22:51:57 97608 ----a-w- C:\windows\system32\drivers\aswmon2.sys

2012-12-18 11:15:52 . 2012-10-30 22:51:57 89752 ----a-w- C:\windows\system32\drivers\aswmon.sys

2012-12-18 11:15:51 . 2012-10-30 22:51:56 25256 ----a-w- C:\windows\system32\drivers\aavmker4.sys

2012-12-18 11:15:40 . 2012-10-30 22:51:07 41224 ----a-w- C:\windows\avastSS.scr

2012-12-18 11:15:40 . 2012-10-30 22:50:59 227648 ----a-w- C:\windows\system32\aswBoot.exe

2012-12-18 11:15:26 . 2012-12-18 11:15:26 -------- d-----w- C:\Arquivos de programas\AVAST Software

2012-12-17 20:47:43 . 2012-12-17 20:47:43 -------- d-----w- C:\Documents and Settings\f001869\Dados de aplicativos\Malwarebytes

2012-12-17 20:40:16 . 2012-12-17 20:40:16 -------- d-----w- C:\LinhaDefensiva

2012-12-13 18:33:44 . 2012-12-11 16:13:28 64048 ----a-r- C:\windows\system32\drivers\360SpOEM.sys

2012-12-13 18:33:35 . 2012-12-14 11:11:25 -------- d-----w- C:\Documents and Settings\All Users\Dados de aplicativos\PSafe

2012-12-11 19:15:06 . 2012-12-11 19:15:06 -------- d-----w- C:\Documents and Settings\f001869\Configurações locais\Dados de aplicativos\Google

2012-12-11 17:14:21 . 2012-12-11 18:27:17 16363960 ----a-w- C:\windows\system32\FlashPlayerInstaller.exe

2012-12-11 14:24:13 . 2012-12-11 18:27:20 697272 ----a-w- C:\windows\system32\FlashPlayerApp.exe

2012-12-04 14:36:38 . 2012-12-04 14:36:38 -------- d-----w- C:\Documents and Settings\f001869\Configurações locais\Dados de aplicativos\SpeedBIT

2012-12-04 14:36:38 . 2012-12-04 14:36:38 -------- d-----w- C:\Documents and Settings\All Users\Dados de aplicativos\SpeedBit

2012-12-04 14:36:29 . 2012-12-04 14:36:29 -------- d-----w- C:\Arquivos de programas\Arquivos comuns\SpeedBit

2012-12-04 14:36:26 . 2012-12-04 14:36:08 90824 ----a-w- C:\windows\system32\EasyHook32.dll

2012-12-04 14:36:26 . 2012-12-04 14:36:08 109256 ----a-w- C:\windows\system32\EasyHook64.dll

2012-12-04 14:36:25 . 2012-12-04 14:36:41 -------- d-----w- C:\Arquivos de programas\DAP

2012-12-04 14:36:06 . 2012-12-04 14:36:06 172032 ----a-w- C:\windows\system32\AniGIF.ocx

.

((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

2012-12-18 20:36:30 . 2012-07-17 11:29:56 12568 ----a-w- C:\windows\system32\drivers\PROCEXP113.SYS

2012-12-18 10:54:02 . 2012-07-16 18:49:25 388608 ----a-w- C:\HiJackThis.exe

2012-12-11 18:27:20 . 2011-06-27 20:15:41 73656 ----a-w- C:\windows\system32\FlashPlayerCPLApp.cpl

2012-11-05 17:36:14 . 2009-10-19 13:51:09 47856 ----a-w- C:\windows\system32\drivers\gbpkm.sys

2012-09-29 22:54:26 . 2012-07-16 17:49:56 22856 ----a-w- C:\windows\system32\drivers\mbam.sys

2011-07-28 17:57:08 . 2011-07-28 17:57:08 1809920 ----a-w- C:\Arquivos de programas\SpringPublisher.exe

2012-10-29 13:58:53 . 2012-10-29 13:58:45 261600 ----a-w- C:\Arquivos de programas\mozilla firefox\components\browsercomps.dll

(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))

*Nota* entradas vazias e legítimas por padrão não são apresentadas.

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D5974A72-C81C-4DC3-BE77-A8A7BBC8864E}]

2012-12-04 14:36:06 431784 ----a-w- C:\Arquivos de programas\DAP\LinkVerifier.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2012-10-30 22:50:38 121528 ----a-w- C:\Arquivos de programas\AVAST Software\Avast\ashShell.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"="C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe" [2012-07-03 12:04:54 252848]

"avast"="C:\Arquivos de programas\AVAST Software\Avast\avastUI.exe" [2012-10-30 22:50:59 4297136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{E37CB5F0-51F5-4395-A808-5FA49E399008}"= "C:\ARQUIV~1\GbPlugin\gbiehuni.dll" [2012-02-01 13:41:58 601592]

"{E37CB5F0-51F5-4395-A808-5FA49E399015}"= "C:\ARQUIV~1\GbPlugin\gbiehisg.dll" [2011-10-21 18:34:56 694960]

"{E37CB5F0-51F5-4395-A808-5FA49E399011}"= "C:\ARQUIV~1\GbPlugin\gbiehscd.dll" [2012-08-24 13:07:26 603224]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginAbn]

2012-11-05 17:30:20 1608176 ------w- C:\ARQUIV~1\GbPlugin\gbiehabn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginBb]

2012-11-22 19:05:56 1585768 ----a-w- C:\ARQUIV~1\GbPlugin\gbieh.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginCef]

2012-10-04 18:05:54 650088 ------w- C:\ARQUIV~1\GbPlugin\gbiehcef.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginIsg]

2011-10-21 18:34:56 694960 ------w- C:\ARQUIV~1\GbPlugin\gbiehisg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginScd]

2012-08-24 13:07:26 603224 ------w- C:\ARQUIV~1\GbPlugin\gbiehscd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ GbPluginUni]

2012-02-01 13:41:58 601592 ------w- C:\ARQUIV~1\GbPlugin\gbiehuni.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^Administrador^Menu Iniciar^Programas^Inicializar^Internet Explorer.lnk]

path=C:\Documents and Settings\Administrador\Menu Iniciar\Programas\Inicializar\Internet Explorer.lnk

backup=C:\windows\pss\Internet Explorer.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Post-it® Digital Notes.lnk]

path=C:\Documents and Settings\All Users\Menu Iniciar\Programas\Inicializar\Post-it® Digital Notes.lnk

backup=C:\WINDOWS\pss\Post-it® Digital Notes.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\init]

01 [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-07-27 20:51:26 919008 ----a-w- C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]

2008-04-13 22:21:26 110592 ----a-w- C:\WINDOWS\system32\bthprops.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-13 22:20:56 15360 ----a-w- C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator]

2012-12-04 14:36:06 3811544 ----a-w- C:\Arquivos de programas\DAP\DAP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

2008-12-18 06:28:14 178712 ----a-r- C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPUsageTracking]

2007-05-04 16:05:36 36864 ----a-w- C:\Arquivos de programas\HP\HP UT\bin\hppusg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

2008-12-18 06:28:32 150040 ----a-r- C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]

2008-12-18 06:28:26 150040 ----a-r- C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]

2009-03-02 08:01:18 17530368 -c--a-w- C:\WINDOWS\RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-10-19 13:48:08 149280 ----a-w- C:\Arquivos de programas\Java\jre6\bin\jusched.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Program Files\\Foxit Software\\PDF Editor\\PDFEdit.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\HP1006MC.EXE"=

"C:\\Arquivos de programas\\Auslogics\\Auslogics Disk Defrag\\DiskDefrag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

R3 Ambfilt;Ambfilt;C:\windows\system32\drivers\Ambfilt.sys [x]

R3 btnetBUs;Bluetooth PAN Bus Service;C:\windows\system32\Drivers\btnetBus.sys [x]

R3 IvtBtBUs;IVT Bluetooth Bus Service;C:\windows\system32\Drivers\IvtBtBus.sys [x]

R3 Ndisrd;GAS Tecnologia Service;C:\windows\system32\DRIVERS\gbpndisrd.sys [x]

S0 BtHidBus;Bluetooth HID Bus Service;C:\windows\System32\Drivers\BtHidBus.sys [x]

S0 GbpKm;Gbp KernelMode;C:\windows\system32\drivers\gbpkm.sys [x]

S1 aswSnx;aswSnx; [x]

S1 aswSP;aswSP; [x]

S2 aswFsBlk;aswFsBlk; [x]

S2 GbpSv;Gbp Service;C:\ARQUIV~1\GbPlugin\GbpSv.exe [x]

S3 NdisrdMP;NdisrdMP;C:\windows\system32\DRIVERS\gbpndisrd.sys [x]

Conteúdo da pasta 'Tarefas Agendadas'

2012-12-18 C:\windows\Tasks\Adobe Flash Player Updater.job

- C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-11 14:24:13 . 2012-12-11 18:27:20]

2012-12-18 C:\windows\Tasks\avast! Emergency Update.job

- C:\Arquivos de programas\AVAST Software\Avast\AvastEmUpdate.exe [2012-12-18 11:20:21 . 2012-10-30 22:50:59]

2012-12-18 C:\windows\Tasks\SBWUpdateTask_Logon_18f54a89-0022684E4D8A.job

- C:\ARQUIV~1\ARQUIV~1\SpeedBit\SBUpdate\SBUpdate.exe [2012-12-04 14:36:29 . 2012-12-04 14:36:08]

2012-12-18 C:\windows\Tasks\SBWUpdateTask_Time_18f54a89-0022684E4D8A.job

- C:\ARQUIV~1\ARQUIV~1\SpeedBit\SBUpdate\SBUpdate.exe [2012-12-04 14:36:29 . 2012-12-04 14:36:08]

2012-12-18 C:\windows\Tasks\User_Feed_Synchronization-{0C7BE09E-5960-4C06-8686-765A8F491B06}.job

- C:\WINDOWS\system32\msfeedssync.exe [2007-08-13 21:36:40 . 2007-08-13 21:36:40]

2012-12-18 C:\windows\Tasks\User_Feed_Synchronization-{16250015-7DF9-4DD2-A276-22084A105D91}.job

- C:\WINDOWS\system32\msfeedssync.exe [2007-08-13 21:36:40 . 2007-08-13 21:36:40]

------- Scan Suplementar -------

uStart Page = hxxp://www.google.com.br/

mStart Page = hxxp://www.google.com.br/

IE: &Download with &DAP - C:\Arquivos de programas\DAP\dapextie.htm

IE: &Verify with DAP - C:\Arquivos de programas\DAP\dapverify.htm

IE: Download &all with DAP - C:\Arquivos de programas\DAP\dapextie2.htm

IE: E&xportar para o Microsoft Excel - C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000

Trusted Zone: bancobrasil.com.br\www

Trusted Zone: bancobrasil.com.br\www14

Trusted Zone: bancobrasil.com.br\www2

Trusted Zone: bancoreal.com.br\www

Trusted Zone: bancosantander.com.br\www

Trusted Zone: bb.com.br\www

Trusted Zone: itau.com.br\bankline

Trusted Zone: itau.com.br\guardiao

Trusted Zone: itau.com.br\www

Trusted Zone: realsecureweb.com.br\www

Trusted Zone: realsecureweb.com.br\www2

Trusted Zone: realsecureweb.com.br\wwws

Trusted Zone: santander.com.br\www

Trusted Zone: santanderempresarial.com.br\www

Trusted Zone: santandernet.com.br\www

Trusted Zone: santandernet.com.br\wwws

Trusted Zone: santandernet.com.br\wwws2

Trusted Zone: santandernetibe.com.br\www

Trusted Zone: secureweb.com.br\www

TCP: DhcpNameServer = 10.4.65.16

Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - C:\Arquivos de programas\DAP\dapie.dll

Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - C:\Arquivos de programas\DAP\dapie.dll

FF - ProfilePath - C:\Documents and Settings\f001869\Dados de aplicativos\Mozilla\Firefox\Profiles\elmohjy7.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.speedbit.com/search.aspx?s=CC4a105&q=

FF - prefs.js: browser.search.selectedEngine - Speedbit Search

FF - prefs.js: browser.startup.homepage - hxxp://search.speedbit.com/?s=CC4a105

FF - prefs.js: keyword.URL - hxxp://search.speedbit.com/search.aspx?s=CC4a105&q=

FF - ExtSQL: 2012-10-23 14:13; {87F8774F-B485-47E2-A755-A40A8A5E8874}; C:\Documents and Settings\f001869\Dados de aplicativos\Mozilla\Firefox\Profiles\elmohjy7.default\extensions\{87F8774F-B485-47E2-A755-A40A8A5E8874}

FF - ExtSQL: 2012-12-04 11:36; {F17C1572-C9EC-4e5c-A542-D05CBB5C5A08}; C:\Arquivos de programas\DAP\DAPFireFox

FF - ExtSQL: 2012-12-04 11:36; daplinkchecker@speedbit.com; C:\Arquivos de programas\DAP\daplinkchecker

FF - ExtSQL: 2012-12-18 08:22; wrc@avast.com; C:\Arquivos de programas\AVAST Software\Avast\WebRep\FF

user_pref('extensions.dealply.partner', 'iron');

user_pref('extensions.dealply.channel', 'iron3');

user_pref('extensions.dealply.installId', 'v23900275641024203017042012082117282521');

user_pref('extensions.dealply.installIdSource', 'inst');

user_pref('extensions.dealply.sampleGroup', '1');

FF - user.js: extensions.claro.id - 18f54a890000000000000022684e4d8a

FF - user.js: extensions.claro.instlDay - 15582

FF - user.js: extensions.claro.vrsn - 1.6.4.1

FF - user.js: extensions.claro.vrsni - 1.6.4.1

FF - user.js: extensions.claro_i.vrsnTs - 1.6.4.19:43:09

FF - user.js: extensions.claro.prtnrId - claro

FF - user.js: extensions.claro.prdct - claro

FF - user.js: extensions.claro.aflt - babsst

FF - user.js: extensions.claro_i.smplGrp - none

FF - user.js: extensions.claro.tlbrId - iclaro

FF - user.js: extensions.claro.instlRef - sst

FF - user.js: extensions.claro.dfltLng - en

FF - user.js: extensions.claro.excTlbr - false

FF - user.js: extensions.claro.admin - false

user_pref('extensions.dealply.partner', 'vn');

user_pref('extensions.dealply.channel', 'pcdealply');

user_pref('extensions.dealply.installId', 'v24300298056394650005402012121116144223');

user_pref('extensions.dealply.installIdSource', 'inst');

user_pref('extensions.dealply.sampleGroup', '3');

FF - user.js: extensions.funmoods.hmpg - true

FF - user.js: extensions.funmoods.hmpgUrl - hxxp://searchfunmoods.com/?f=1&a=pcmega1&ir=pcmega1&cd=2XzuyEtN2Y1L1QzutDtDtBtByCzzyE0EyE0Dzz0AyE0AzzzytN0D0Tzu0CtAyEyCtN1L2XzutBtFtBtFtCtFyEtDyB&cr=431002285

FF - user.js: extensions.funmoods.dfltSrch - true

FF - user.js: extensions.funmoods.srchPrvdr - Funmoods

FF - user.js: extensions.funmoods.dnsErr - true

FF - user.js: extensions.funmoods_i.newTab - true

FF - user.js: extensions.funmoods.newTabUrl - hxxp://searchfunmoods.com/?f=2&a=pcmega1&ir=pcmega1&cd=2XzuyEtN2Y1L1QzutDtDtBtByCzzyE0EyE0Dzz0AyE0AzzzytN0D0Tzu0CtAyEyCtN1L2XzutBtFtBtFtCtFyEtDyB&cr=431002285

FF - user.js: extensions.funmoods.tlbrSrchUrl - hxxp://searchfunmoods.com/?f=3&a=pcmega1&ir=pcmega1&cd=2XzuyEtN2Y1L1QzutDtDtBtByCzzyE0EyE0Dzz0AyE0AzzzytN0D0Tzu0CtAyEyCtN1L2XzutBtFtBtFtCtFyEtDyB&cr=431002285&q=

FF - user.js: extensions.funmoods.id - 0022684E4D8A4A89

FF - user.js: extensions.funmoods.instlDay - 15685

FF - user.js: extensions.funmoods.vrsn - 1.5.23.22

FF - user.js: extensions.funmoods.vrsni - 1.5.23.22

FF - user.js: extensions.funmoods_i.vrsnTs - 1.5.23.2216:14:41

FF - user.js: extensions.funmoods.prtnrId - funmoods

FF - user.js: extensions.funmoods.prdct - funmoods

FF - user.js: extensions.funmoods.aflt - pcmega1

FF - user.js: extensions.funmoods_i.smplGrp - none

FF - user.js: extensions.funmoods.tlbrId - base

FF - user.js: extensions.funmoods.instlRef - pcmega1

FF - user.js: extensions.funmoods.dfltLng -

FF - user.js: extensions.funmoods.excTlbr - false

FF - user.js: extensions.funmoods.autoRvrt - false

FF - user.js: extensions.funmoods.envrmnt - production

FF - user.js: extensions.funmoods.isdcmntcmplt - true

FF - user.js: extensions.funmoods.mntrvrsn - 1.3.0

FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=18f54a890000000000000022684e4d8a&q=

FF - user.js: extensions.BabylonToolbar.id - 18f54a890000000000000022684e4d8a

FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB}

FF - user.js: extensions.BabylonToolbar.instlDay - 15687

FF - user.js: extensions.BabylonToolbar.vrsn - 1.8.4.9

FF - user.js: extensions.BabylonToolbar.vrsni - 1.8.4.9

FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.8.4.915:33:06

FF - user.js: extensions.BabylonToolbar.prtnrId - babylon

FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar

FF - user.js: extensions.BabylonToolbar_i.smplGrp - none

FF - user.js: extensions.BabylonToolbar.tlbrId - base

FF - user.js: extensions.BabylonToolbar.instlRef - sst

FF - user.js: extensions.BabylonToolbar.dfltLng - en

FF - user.js: extensions.BabylonToolbar_i.excTlbr - false

FF - user.js: extensions.BabylonToolbar.excTlbr - false

FF - user.js: extensions.BabylonToolbar.admin - false

FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110824&tt=5012_8

FF - user.js: extensions.BabylonToolbar_i.babExt -

FF - user.js: extensions.BabylonToolbar_i.srcExt - ss

FF - user.js: extensions.BabylonToolbar.autoRvrt - false

FF - user.js: extensions.BabylonToolbar.rvrt - false

- - - - ORFÃOS REMOVIDOS - - - -

HKLM-Run-AnySend Updater - C:\Arquivos de programas\AnySend\AnySendUpdater.exe

MSConfigStartUp-Media Finder - C:\Arquivos de programas\Media Finder\Media Finder.exe

AddRemove-Google Chrome - C:\Documents and Settings\f001869\Configurações locais\Dados de aplicativos\Google\Chrome\Application\20.0.1132.57\Installer\setup.exe

AddRemove-{9FDEF7FC-0D03-4CAE-9DC3-1F436A93BDA4} - C:\Documents and Settings\f001869\Configurações locais\Dados de aplicativos\{A91C477B-655B-4FEA-8B8E-CC6820970F3A}\setup.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-12-18 17:44:49

Windows 5.1.2600 Service Pack 3 NTFS

Procurando processos ocultos ...

Procurando entradas auto inicializáveis ocultas ...

Procurando ficheiros/arquivos ocultos ...

Varredura completada com sucesso

arquivos/ficheiros ocultos: 0

**************************************************************************

--------------------- CHAVES DO REGISTRO BLOQUEADAS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@C:\\windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="C:\\windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EA9A8FA-F5D2-49E1-99E8-C26EE07FCEEB}\Elevation]

@DACL=(02 0000)

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EA9A8FA-F5D2-49E1-99E8-C26EE07FCEEB}\LocalServer32]

@DACL=(02 0000)

@="C:\\ARQUIV~1\\ARQUIV~1\\MICROS~1\\OFFICE12\\OFFICE~1\\SETUP.EXE"

[HKEY_LOCAL_MACHINE\software\Classes\contact_oe_auto_file\shell]

@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\03076BB64DB02933C93976B1AC698DE0\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"114"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\0EB7ECFEE015239449574FC49DD01EA6\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"21693"=";Microsoft .NET Framework 1.1 Security Update (KB2572067)"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\13CA5F6F338977E3CAE8E819C0BA93EA\SourceList\Media]

@DACL=(02 0000)

"102"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\17AFD8C1970420F48BBB741BC2A165F5\SourceList\Media]

@DACL=(02 0000)

"100"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\17BB7F68F8EF60333A529FE30E46718B\SourceList\Media]

@DACL=(02 0000)

"111"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\1FA98C108219B99448EDF4C3B1EC100C\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="Microsoft's Silverlight Installation [1]"

"106"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\1FDE42FC632E233438BCC407A1B9BC0F\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"107"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\2451D69CF585D214C8A52004DB1A469B\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"106"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\24DF66A32D05A9E3185BCE3E5E3C90A7\SourceList\Media]

@DACL=(02 0000)

"111"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\256917180E811B74A9218FB20F574DBD\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"105"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\28C9EA2BB7CD1463FB8C7872C5F46370\SourceList\Media]

@DACL=(02 0000)

"101"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\295DC294DD789E13083868560A521636\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"111"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\2F2AEE7ADCFB45A45A57B7187A686E85\SourceList\Media]

@DACL=(02 0000)

"100"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\37297481046CEAF47BC8DC52A6399760\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="Microsoft's Silverlight Installation [1]"

"104"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\39A42FFE0FC238638B828E356BCFABA0\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"115"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\39D9350CFCD18153BBE9C69E85245243\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"114"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\3D90EFE177C6D6E478F667BC032D50C6\SourceList\Media]

@DACL=(02 0000)

"101"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\4152E9034D92C5043B1B417D32B1AF61\SourceList\Media]

@DACL=(02 0000)

"102"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\41A670B5874F6653EBA789C5C326F94A\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"111"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\425A33BDE5485584E9095A16B9DC5D72\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="Microsoft's Silverlight Installation [1]"

"103"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\43F3D5FAA348FB140A3FF2BB0AB09A9B\SourceList\Media]

@DACL=(02 0000)

"104"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\44D51B2A7D3B696448850A89C682FA0D\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="Microsoft's Silverlight Installation [1]"

"102"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\484CA1D2615EC8048852CA1B3C65CAA7\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"101"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\4C9878626E35BDD4F833D8F0E900B0AE\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"100"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\55399781A9D2FFB32AEFF88353F1ADAB\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"114"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\5E903427217EC6249BD46B4B52112CF9\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"104"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\5EDEE27DAF3D979329DEF894846ED2F0\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"114"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\645BC568E92815C458A6C140B262F43E\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="Microsoft's Silverlight Installation [1]"

"108"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\6BE374011DC2CCB3D99A1D1081FE29FF\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"113"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\6D0233A2508C08244B326B56DB3ED3F8\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"21685"=";Microsoft .NET Framework 1.1 Security Update (KB979906)"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\6ECFE6F2FD019F94E946A93E77B55288\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"21689"=";Microsoft .NET Framework 1.1 Security Update (KB2416447)"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\82B28DCEEB84C6245BB5E60C22162658\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"108"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\881B67FDBD11CD343A98012492599A97\SourceList\Media]

@DACL=(02 0000)

"107"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\8D81D36F6C56F404CB6CCB6111055157\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="Microsoft's Silverlight Installation [1]"

"101"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\91C30D4F0ACD90B4387EEBB3608C4DCD\SourceList\Media]

@DACL=(02 0000)

"109"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\91EFD319CE23990498CA72CF94A3A7E2\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="Microsoft Office Enterprise 2007"

"117"="OFFICE12;1"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\91F4988A8C952D83A857630CCC5EA6B5\SourceList\Media]

@DACL=(02 0000)

"102"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\9E0DE89293FE9BB33898F24ED18CCF08\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"109"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\A2A49AADD8A2B3D4D98B65BFCEDE80D2\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"21624"=";Microsoft .NET Framework 1.1 Security Update (KB953297)"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\B4C419EC05CA8E13D92A51BD928D65F8\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"113"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\B4DC2171CF6DE183589FF2E42C91F993\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"116"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\B8F6D1795C8E4A94E93D980C010B8D2D\SourceList\Media]

@DACL=(02 0000)

"103"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\BBBC54B31AC5BF448958CA8CF16725E1\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="Microsoft's Silverlight Installation [1]"

"107"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\BE7C28545F39D804F992A5B51E7E8654\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"103"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\C3CFBEEB1B8483A43A5C18AB91FDF504\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"109"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\CD9B5C7DC4E6EED4A9B71438ADD41C2C\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="Microsoft's Silverlight Installation [1]"

"100"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\DE6BA3F2C1597EC4A89C5864DFFCF1A5\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"102"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\E0337B0F8B42AE34C86D1D4124A8C1CE\SourceList\Media]

@DACL=(02 0000)

"108"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\E54DA494170E9184E8511E40F1FB0F37\SourceList\Media]

@DACL=(02 0000)

"110"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\E6C461BDA4E80374796CED4868BE63F7\SourceList\Media]

@DACL=(02 0000)

"106"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\E9030CAD6F70DA545BFBB5D0FE17FFEE\SourceList\Media]

@DACL=(02 0000)

"105"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\F3F86E863D2A6B148B1252798C5CCBBB\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="Microsoft's Silverlight Installation [1]"

"105"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\F9DC276355B3ECF3D85A5DC7A31B1005\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"114"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Patches\FA6C3120265590D488C4A2CDCFC8F253\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"21704"=";Microsoft .NET Framework 1.1 Security Update (KB2656353)"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\00002109030000000000000000F01FEC\Patches]

@DACL=(02 0000)

"6D6C63B08D5FFAE4FB4934672A03DAB5"=":9000300000000012.0.4518.1014;:#9000300000000012.0.4518.1014"

"D582444CF4E54A8419DD74AAAA869ED2"=":9000300000000012.0.4518.1014;:#9000300000000012.0.4518.1014"

"9B247DCF55A7CB447A677F592FF1DECD"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"84125F966FB9CDC4FB6701D3AE3FDD80"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"ACD702F79933BC049A86E695191B24A1"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"895910D395B7A74408EA18B507B348FF"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"77772117C2B879F4FAA7C68FAC8C22D4"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"9A05092308FE9F046B334705F8451CFF"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"A187BCC8B6FCBCF46B8D956CD45F6CBD"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"3B0D90113AFE3554AADEC4E3A91D038E"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"CECC24119ACAB484AB093C5AAC91885C"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"5D34E4A5F858DB94AB27F8031E970306"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"B0F794C516029CC46AC1B6548B7653D4"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"AF47B5A729A79CF428A1D25D4D7EE384"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"205BF635F5774944ABEC0CC29CB0A7B5"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"733967DCCA8CBD647ACD46E305802936"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"EAEEC4B088AAC094CB2BAA3C2491184A"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"162039D5B5AA1D8439F124C5D9674709"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"DBC1F3FBC50B4464EA34E60ECF2C724A"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"38512CDB1065B2B4883F97916FEDF81B"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"95AC4D1007070244B9CCE0AFC7D567EB"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"D7FBC1A34074CB043BC1AA6781483A4E"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"2A21C346A9FA21748BEBB36705FA0EA0"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"7A46902C18155E54E928275F4D00EDFB"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"5FD3787BC1E9EE5488592DC9A60E2120"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"948F5D0A5D9DDE84990D7CD4B7AFA690"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"0F2378A5F02CB9A42A9A66EFA785C653"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"1D301765DC6967B4399B62181A78EDFF"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"BF4D0FE032BB5154AAAE2104CAD25A52"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"72A61AEA79B0076418F89AD860CEA0F6"=":9000300000000012.0.6425.1000;:#9000300000000012.0.6425.1000"

"72D202844D6A46241A48156A8EDAC704"=":9000300000000012.0.4518.1014;:#9000300000000012.0.4518.1014"

"Patches"=multi:"6D6C63B08D5FFAE4FB4934672A03DAB5\0095AC4D1007070244B9CCE0AFC7D567EB\00EAEEC4B088AAC094CB2BAA3C2491184A\00BF4D0FE032BB5154AAAE2104CAD25A52\003B0D90113AFE3554AADEC4E3A91D038E\00CECC24119ACAB484AB093C5AAC91885C\009A05092308FE9F046B334705F8451CFF\00D7FBC1A34074CB043BC1AA6781483A4E\00895910D395B7A74408EA18B507B348FF\00205BF635F5774944ABEC0CC29CB0A7B5\001D301765DC6967B4399B62181A78EDFF\005D34E4A5F858DB94AB27F8031E970306\000F2378A5F02CB9A42A9A66EFA785C653\00B0F794C516029CC46AC1B6548B7653D4\00162039D5B5AA1D8439F124C5D9674709\002A21C346A9FA21748BEBB36705FA0EA0\0084125F966FB9CDC4FB6701D3AE3FDD80\0077772117C2B879F4FAA7C68FAC8C22D4\00AF47B5A729A79CF428A1D25D4D7EE384\00ACD702F79933BC049A86E695191B24A1\00A187BCC8B6FCBCF46B8D956CD45F6CBD\00948F5D0A5D9DDE84990D7CD4B7AFA690\0072A61AEA79B0076418F89AD860CEA0F6\005FD3787BC1E9EE5488592DC9A60E2120\0038512CDB1065B2B4883F97916FEDF81B\00DBC1F3FBC50B4464EA34E60ECF2C724A\007A46902C18155E54E928275F4D00EDFB\00D582444CF4E54A8419DD74AAAA869ED2\00733967DCCA8CBD647ACD46E305802936\009B247DCF55A7CB447A677F592FF1DECD\0072D202844D6A46241A48156A8EDAC704\00\00"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\00002109030000000000000000F01FEC\SourceList]

@DACL=(02 0000)

"PackageName"="EnterpriseWW.msi"

"LastUsedSource"=expand:"n;1;C:\\MSOCache\\All Users\\{90120000-0030-0000-0000-0000000FF1CE}-C\\"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\000021599B0090400000000000F01FEC\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="Microsoft Application Error Reporting"

"1"="OFFICE12;1"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\00002159FA0061400000000000F01FEC\Patches]

@DACL=(02 0000)

"4328B5719D5860B4F81118A6D7D61E61"=":9500AF0416000012.0.4518.1019;:#9500AF0416000012.0.4518.1019"

"895910D395B7A74408EA18B507B348FF"=":9500AF0416000012.0.6425.1000;:#9500AF0416000012.0.6425.1000"

"EAEEC4B088AAC094CB2BAA3C2491184A"=":9500AF0416000012.0.6425.1000;:#9500AF0416000012.0.6425.1000"

"DBC1F3FBC50B4464EA34E60ECF2C724A"=":9500AF0416000012.0.6425.1000;:#9500AF0416000012.0.6425.1000"

"95AC4D1007070244B9CCE0AFC7D567EB"=":9500AF0416000012.0.6425.1000;:#9500AF0416000012.0.6425.1000"

"2A21C346A9FA21748BEBB36705FA0EA0"=":9500AF0416000012.0.6425.1000;:#9500AF0416000012.0.6425.1000"

"948F5D0A5D9DDE84990D7CD4B7AFA690"=":9500AF0416000012.0.6425.1000;:#9500AF0416000012.0.6425.1000"

"BF4D0FE032BB5154AAAE2104CAD25A52"=":9500AF0416000012.0.6425.1000;:#9500AF0416000012.0.6425.1000"

"306448DBD245F124E9CC86EE999FD556"=":9500AF0416000012.0.6425.1000;:#9500AF0416000012.0.6425.1000"

"Patches"=multi:"4328B5719D5860B4F81118A6D7D61E61\0095AC4D1007070244B9CCE0AFC7D567EB\00EAEEC4B088AAC094CB2BAA3C2491184A\00BF4D0FE032BB5154AAAE2104CAD25A52\00895910D395B7A74408EA18B507B348FF\002A21C346A9FA21748BEBB36705FA0EA0\00948F5D0A5D9DDE84990D7CD4B7AFA690\00DBC1F3FBC50B4464EA34E60ECF2C724A\00306448DBD245F124E9CC86EE999FD556\00\00"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\00002159FA0061400000000000F01FEC\SourceList]

@DACL=(02 0000)

"PackageName"="ppviewer.msi"

"LastUsedSource"=expand:"n;1;C:\\Arquivos de programas\\MSECache\\PPTViewer\\"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\080E7FFA4791FB54390101EDA1F1E50D\SourceList\Media]

@DACL=(02 0000)

"1"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\0D756077321A70C3E844C138CE981581\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"1"=";1"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\0DC1503A46F231838AD88BCDDC8E8F7C\SourceList\Media]

@DACL=(02 0000)

"1"=";1"

"100"=";"

"101"=";"

"102"=";"

"103"=";"

"104"=";"

"105"=";"

"106"=";"

"107"=";"

"108"=";"

"109"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\26DDC2EC4210AC63483DF9D4FCC5B59D\SourceList\Media]

@DACL=(02 0000)

"1"=";1"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\313E2097F0FF3944CA1B8A41B787CD0D\SourceList]

@DACL=(02 0000)

"PackageName"="HPSSupply.msi"

"LastUsedSource"=expand:"n;1;C:\\hp_P1000_P1500_Full_Solution\\DTSS\\"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\4EA42A62D9304AC4784BF238120661FF\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"1"="DISK1;1"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\6E58EC68CABDDFF39B774E7BF9389C90\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"1"=";1"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"1"=";1"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\A35E09D5C7DB23F8B92877330D0FCBE8\SourceList\Media]

@DACL=(02 0000)

"1"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"1"=";Microsoft Visual C++ 2005 Redistributable [Disk 1]"

"2"=";Microsoft Visual C++ 2005 Redistributable [Disk 1]"

"3"=";Microsoft Visual C++ 2005 Redistributable [Disk 1]"

"4"=";Microsoft Visual C++ 2005 Redistributable [Disk 1]"

"5"=";Microsoft Visual C++ 2005 Redistributable [Disk 1]"

"6"=";Microsoft Visual C++ 2005 Redistributable [Disk 1]"

"7"=";Microsoft Visual C++ 2005 Redistributable [Disk 1]"

"8"=";Microsoft Visual C++ 2005 Redistributable [Disk 1]"

"9"=";Microsoft Visual C++ 2005 Redistributable [Disk 1]"

"10"=";Microsoft Visual C++ 2005 Redistributable [Disk 1]"

"11"=";Microsoft Visual C++ 2005 Redistributable [Disk 1]"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\C3B02CB566F11584AAC07B1BA5F7D368\SourceList\Media]

@DACL=(02 0000)

"1"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\CFD2C1F142D260E3CB8B271543DA9F98\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"1"=";1"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"1"=";1"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\Patches]

@DACL=(02 0000)

"CD9B5C7DC4E6EED4A9B71438ADD41C2C"=":oldTocurrent;:#oldTocurrent"

"8D81D36F6C56F404CB6CCB6111055157"=":oldTocurrent;:#oldTocurrent"

"44D51B2A7D3B696448850A89C682FA0D"=":oldTocurrent;:#oldTocurrent"

"425A33BDE5485584E9095A16B9DC5D72"=":oldTocurrent;:#oldTocurrent"

"37297481046CEAF47BC8DC52A6399760"=":oldTocurrent;:#oldTocurrent"

"F3F86E863D2A6B148B1252798C5CCBBB"=":oldTocurrent;:#oldTocurrent"

"1FA98C108219B99448EDF4C3B1EC100C"=":oldTocurrent;:#oldTocurrent"

"BBBC54B31AC5BF448958CA8CF16725E1"=":oldTocurrent;:#oldTocurrent"

"645BC568E92815C458A6C140B262F43E"=":oldTocurrent;:#oldTocurrent"

"Patches"=multi:"CD9B5C7DC4E6EED4A9B71438ADD41C2C\008D81D36F6C56F404CB6CCB6111055157\0044D51B2A7D3B696448850A89C682FA0D\00425A33BDE5485584E9095A16B9DC5D72\0037297481046CEAF47BC8DC52A6399760\00F3F86E863D2A6B148B1252798C5CCBBB\001FA98C108219B99448EDF4C3B1EC100C\00BBBC54B31AC5BF448958CA8CF16725E1\00645BC568E92815C458A6C140B262F43E\00\00"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\D7314F9862C648A4DB8BE2A5B47BE100\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="Microsoft's Silverlight Installation [1]"

"1"=";1"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\DC3BF90CC0D3D2F398A9A6D1762F70F3\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"1"=";"

"100"=";"

"101"=";"

"102"=";"

"103"=";"

"104"=";"

"105"=";"

"106"=";"

"107"=";"

"108"=";"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\DD3E9A158B73BB74E876B5673BFECB84\SourceList]

@DACL=(02 0000)

"PackageName"="wllogin.msi"

"LastUsedSource"=expand:"n;1;C:\\Arquivos de programas\\Arquivos comuns\\Windows Live\\.cache\\8c88ce841ca4d01\\"

[HKEY_LOCAL_MACHINE\software\Classes\Installer\Products\DDE7F2BCF1D91C3409CFF425AE1E271A\SourceList\Media]

@DACL=(02 0000)

"DiskPrompt"="[1]"

"1"=";Microsoft .NET Framework 1.1 [Disk 1]"

"2"=";Microsoft .NET Framework 1.1 [Disk 1]"

"3"=";Microsoft .NET Framework 1.1 [Disk 1]"

"4"=";Microsoft .NET Framework 1.1 [Disk 1]"

"5"=";Microsoft .NET Framework 1.1 [Disk 1]"

"6"=";Microsoft .NET Framework 1.1 [Disk 1]"

"7"=";Microsoft .NET Framework 1.1 [Disk 1]"

"8"=";Microsoft .NET Framework 1.1 [Disk 1]"

"9"=";Microsoft .NET Framework 1.1 [Disk 1]"

"10"=";Microsoft .NET Framework 1.1 [Disk 1]"

"11"=";Microsoft .NET Framework 1.1 [Disk 1]"

"12"=";Microsoft .NET Framework 1.1 [Disk 1]"

"13"=";Microsoft .NET Framework 1.1 [Disk 1]"

"14"=";Microsoft .NET Framework 1.1 [Disk 1]"

"15"=";Microsoft .NET Framework 1.1 [Disk 1]"

"16"=";Microsoft .NET Framework 1.1 [Disk 1]"

"17"=";Microsoft .NET Framework 1.1 [Disk 1]"

"18"=";Microsoft .NET Framework 1.1 [Disk 1]"

"19"=";Microsoft .NET Framework 1.1 [Disk 1]"

"20"=";Microsoft .NET Framework 1.1 [Disk 1]"

"21"="URTSTDD1;Microsoft .NET Framework 1.1 [Disk 1]"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Macromedia\FlashPlayerActiveX\Components]

@DACL=(02 0000)

"Main"="1"

--------------------- DLLs Carregadas Sob os Processos em Execução ---------------------

- - - - - - - > 'winlogon.exe'(1004)

C:\ARQUIV~1\GBPLUGIN\gbieh.dll

C:\ARQUIV~1\GbPlugin\gbiehscd.dll

C:\ARQUIV~1\GbPlugin\gbiehcef.dll

C:\ARQUIV~1\GbPlugin\gbiehabn.dll

C:\ARQUIV~1\GbPlugin\gbiehuni.dll

C:\ARQUIV~1\GbPlugin\gbiehisg.dll

C:\windows\system32\MPRUI.dll

Tempo para conclusão: 2012-12-18 17:45:56

ComboFix-quarantined-files.txt 2012-12-18 20:45:54

ComboFix2.txt 2012-07-17 11:35:27

Pré-execução: 19 pasta(s) 286.826.930.176 bytes disponíveis

Pós execução: 20 pasta(s) 288.123.437.056 bytes disponíveis

- - End Of File - - 51210C31B7B89575A7023D775F045AFD

DigRam · Dezembro 19, 2012

Boa Noite! Edvan

|- Baixe: < > ( ... par Nicolas Coolman )

|- Salve-o no desktop!

|- Desabilite seu antivírus!

|- Caso utilize o Avast,estabeleça esta configuração à SandBox.

|- Para Windows Vista ou 7,clique direito e execute o arquivo como

|- Aguarde a conclusão do scan e clique em "Copier". <- Aguarde!

|- Além do relatório,teremos no desktop: ZHP_uninstall, MBRCheck, ZHPDiag, ZHPFix

|- Poste e/ou cole aqui,o link que será gerado,logo após o relatório.

|- Ou acesse:

|- Maiores informações: < |Link| >

A+

Edvan · Dezembro 19, 2012

Logs: http://pjjoint.malekal.com/files.php?read=ZHPDiag_20121219_f12v9l6t7w5

ou

Link: http://cjoint.com/12dc/BLtmEzZbEbK.htm

Veja esse log no perfil do usuário, veja se muda alguma coisa;

Link http://pjjoint.malekal.com/files.php?read=ZHPDiag_20121219_q14v9n8z10n11

ou

Link: http://cjoint.com/12dc/BLtmW4V2LCQ.htm

DigRam · Dezembro 19, 2012

Bom Dia! Edvan

|- Caso possua,desinstale: C:\Arquivos de programas\Spybot - Search & Destroy <<

-/-

|- Feche programas/pastas que estejam abertas.

|- Feche,também,o navegador!

|- Para Windows Vista,desabilite a UAC.

|- Para Windows Vista ou 7,clique direito em ZHPFix.exe e execute-o como administrador.

|- Selecione e copie estas informações,que estão no Code,para o "Bloco de Notas".

R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs = http://search.speedbit.com
O2 - BHO: (no name) - {D5974A72-C81C-4DC3-BE77-A8A7BBC8864E} Orphean Key
O2 - BHO: (no name) - {C41A1C0E-EA6C-11D4-B1B8-444553540003} Orphean Key  
O2 - BHO: (no name) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} Orphean Key     
O2 - BHO: (no name) - {2E3C3651-B19C-4DD9-A979-901EC3E930AF} Orphean Key     
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} Orphean Key     
O2 - BHO: (no name) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} Orphean Key     
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} Orphean Key     
O2 - BHO: (no name) - {C41A1C0E-EA6C-11D4-B1B8-444553540000} Orphean Key         
O2 - BHO: (no name) - {C41A1C0E-EA6C-11D4-B1B8-444553540007} Orphean Key     
O2 - BHO: (no name) - {C41A1C0E-EA6C-11D4-B1B8-444553540008} Orphean Key     
O2 - BHO: (no name) - {C41A1C0E-EA6C-11D4-B1B8-444553540011} Orphean Key     
O2 - BHO: (no name) - {C41A1C0E-EA6C-11D4-B1B8-444553540015} Orphean Key     
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} Orphean Key     
O2 - BHO: (no name) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} Orphean Key     
O3 - Toolbar: (no name) - [HKLM]{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} . (...) --  (.not file.)     
O39 - APT:Automatic Planified Task  - C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
O39 - APT:Automatic Planified Task  - C:\WINDOWS\Tasks\avast! Emergency Update.job
O39 - APT:Automatic Planified Task  - C:\WINDOWS\Tasks\SBWUpdateTask_Logon_18f54a89-0022684E4D8A.job
O39 - APT:Automatic Planified Task  - C:\WINDOWS\Tasks\SBWUpdateTask_Time_18f54a89-0022684E4D8A.job
O43 - CFD: 04/01/2012 - 09:23:29 - [1,114] ----D C:\Arquivos de programas\Spybot - Search & Destroy    
O44 - LFC:[MD5.3C0D63FBA3CA416471F90C9BDF7BF8E2] - 18/12/2012 - 07:54:45 ---A- . (...) -- C:\hijackthis.log   [8167]

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: Modified   
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Intl: Modified    => Infection BT (Hijacker.Intl)
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] XMLLookup: Modified   
[HKLM\Software\360Safe]    => Infection Diverse (Lozavita.Troj)

proxyfix
emptytemp
emptyflash
firewallraz
sysrestore

|- Estando com o Bloco de Notas aberto,acione os atalhos: "Ctrl+A" -> "Ctrl+C"

|- Minimize o Bloco de Notas.

|- Clique no menu,"Paste ClipBoard".

|- Clique "GO" -> Oui.

|- Ps: Temos,àcima,sequência de imagens para maior exclarecimento.

|- Poste o relatório: C:\ZHP\ZHPFix[R1].txt

A+

Edvan · Dezembro 19, 2012

Rapport de ZHPFix 1.3.05 par Nicolas Coolman, Update du 09/10/2012

Fichier d'export Registre :

Run by f001869 at 19/12/2012 10:24:37

Windows XP Professional Service Pack 3 (Build 2600)

Web site : http://nicolascoolman.skyrock.com/

========== Registry Key ==========

DELETED Key: CLSID BHO: {D5974A72-C81C-4DC3-BE77-A8A7BBC8864E}

DELETED Key: CLSID BHO: {C41A1C0E-EA6C-11D4-B1B8-444553540003}

DELETED Key: CLSID BHO: {18DF081C-E8AD-4283-A596-FA578C2EBDC3}

DELETED Key: CLSID BHO: {2E3C3651-B19C-4DD9-A979-901EC3E930AF}

DELETED Key: CLSID BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}

DELETED Key: CLSID BHO: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06}

DELETED Key: CLSID BHO: {9030D464-4C02-4ABF-8ECC-5164760863C6}

DELETED Key: CLSID BHO: {C41A1C0E-EA6C-11D4-B1B8-444553540000}

DELETED Key: CLSID BHO: {C41A1C0E-EA6C-11D4-B1B8-444553540007}

DELETED Key: CLSID BHO: {C41A1C0E-EA6C-11D4-B1B8-444553540008}

DELETED [HKLM\SOFTWARE\Classes\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540008}]

DELETED [HKCR\CLSID\{C41A1C0E-EA6C-11D4-B1B8-444553540008}]

DELETED Key: CLSID BHO: {C41A1C0E-EA6C-11D4-B1B8-444553540011}

DELETED Key: CLSID BHO: {C41A1C0E-EA6C-11D4-B1B8-444553540015}

DELETED Key: CLSID BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9}

DELETED Key: CLSID BHO: {E7E6F031-17CE-4C07-BC86-EABFE594F69C}

DELETED Key: HKLM\Software\360Safe

========== Registry Value ==========

DELETED Toolbar: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06}

ProxyFix : Proxy killed successfully

DELETED ProxyServer Value

DELETED ProxyEnable Value

DELETED EnableHttp1_1 Value

DELETED ProxyHttp1.1 Value

DELETED ProxyOverride Value

DELETED FirewallRaz (SP) : %windir%\system32\sessmgr.exe

DELETED FirewallRaz (SP) : %windir%\Network Diagnostic\xpnetdiag.exe

DELETED FirewallRaz (DP) : %windir%\system32\sessmgr.exe

DELETED FirewallRaz (DP) : %windir%\Network Diagnostic\xpnetdiag.exe

No Value in Firewall Exception Register Key (FirewallRaz)

========== Registry Data Items ==========

REMOVED R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs

REMOVED Explorer Association Data Application: http://www.fileextensionpro.com/redir.aspx?LangID=%04x&Ext=%s

REMOVED Explorer Association Data Intl: http://www.fileextensionpro.com/redir.aspx?LangID=%04x&Ext=%s

REMOVED Explorer Association Data XMLLookup: http://www.fileextensionpro.com/redir.aspx?LangID=%04x&Ext=%s

========== Repertory ==========

DELETED Folder: C:\Arquivos de programas\Spybot - Search & Destroy

DELETED Window Temporary:

DELETED Flash Cookies:

========== File ==========

DELETED File: c:\windows\tasks\adobe flash player updater.job

DELETED File: c:\windows\tasks\avast! emergency update.job

DELETED File: c:\windows\tasks\sbwupdatetask_logon_18f54a89-0022684e4d8a.job

DELETED File: c:\windows\tasks\sbwupdatetask_time_18f54a89-0022684e4d8a.job

DELETED File: c:\hijackthis.log

DELETED Window Temporary:

DELETED Flash Cookies:

========== Restoration ==========

Restore System Point created succefully

========== Summary ==========

17 : Registry Key

12 : Registry Value

4 : Registry Data Items

3 : Repertory

7 : File

1 : Restoration

End of clean in 01mn 09s

========== Report File ==========

C:\ZHP\ZHPFix[R1].txt - 19/12/2012 10:24:43 [3210]

DigRam · Dezembro 19, 2012

Bom Dia! Edvan

|- Desabilite seu antivírus!

|- Vá em Iniciar -> Executar -> Digite ou cole: combofix.exe /uninstall -> Clique OK.

|- Clique em Executar -> Aguarde!

|- Surgirá,finalmente,a mensagem: "ComboFix está desinstalado" -> Clique OK.

|- Caso encontre,apague: C:\ComboFix <- A pasta! + C:\ComboFix.txt <- Relatório!

|- Ou,vá em Iniciar -> Executar -> Digite ou cole ( Paste ):

|-

"%userprofile%\desktop\combofix" /uninstall

|- Clique OK.

|- Aguarde a desinstalação,e clique OK na mensagem.

|- Ps: Outra opção,seria renomear o Combofix.exe para uninstall.exe e executá-lo.

|- Ps: Muitos confundem com nova execução,mas a ferramenta fará a auto-desinstalação.

-/-

|- Baixe: < Pre_Scan > ( ... par g3n-h@ckm@n & Saachaa )

|- Ou aqui: < Pre-Scan > Mirror!

|- Ou aqui: < Pre_Scan.pif > Caso ocorra impedimentos por malwares!

|- Estando na página,clique na seta verde ou Mirror 1.

|- Salve-o no desktop! < ( winlogon ) >

|- Desabilite seu antivírus,antispyware,sandbox e/ou firewall.

|- Feche programas que estejam abertos e execute a ferramenta!

|- Duplo-clique em Pre_scan.exe. < >

|- Ps: Durante o scan,sua área de trabalho irá desaparecer e janelas pretas irão surgir na tela. Tudo isso é normal e faz parte do funcionamento da ferramenta.

|- Encontrando infecções,pode ocorrer reinicialização e aparecer essa tela,logo àcima.

|- Ps: Caso apareça e não mostre nenhuma solicitação,clique em "Kill".

|- Neste caso,haverá novo scan e,ao final,será disponibilizado o relatório.

|- Poderá haver reboot(s) e prosseguimento do scan. << Aguarde!

|- Poste ao concluir,o relatório! ( Pre_Scan.txt ) << Link ao relatório!

|- Para enviar,acesse!:

|- Ou...1fichier.com

|- Ou...myfile.tk

A+

Edvan · Dezembro 19, 2012

Boa tarde amigo.

Ao tentar rodar o Pre_Scan > gerou o erro abaixo:

Ao executar o scan a área de trabalho e ícones desapareceram e gerou esse erro.

Daí precionei Alt+Ctrl, entrei no Gerenciador de tarefas do windows e ativei o explorer.exe para aparecer novamente a área de trabalho.

DigRam · Dezembro 19, 2012

Boa Tarde! Edvan

|- Utilize Pre_Scan.pif que,ao operar,não dará stop ao desktop.

|- Ao surgir essa tela,dê a opção diagnóstico ao clicar "DiaG".

|- Ao concluir,poste o link ao relatório. ( CJoint.com ou MyFile.tk )

A+

Edvan · Dezembro 19, 2012

Boa Tarde! Edvan

|- Utilize Pre_Scan.pif que,ao operar,não dará stop ao desktop.

|- Ao surgir essa tela,dê a opção diagnóstico ao clicar "DiaG".

|- Ao concluir,poste o link ao relatório. ( CJoint.com ou MyFile.tk )

A+

Estranho amigo, pois ao clicar "DiaG" gera o erro.

No "C" encontrei esse log aqui.

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Diag | 2.1219 | g3n-h@ckm@n & Saachaa ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

~ ¤¤¤¤¤ XP | Vista | 7 | 8 - 32/64 bits ¤¤¤¤¤

~ Update on 19/12/2012 | 18.30 by g3n-h@ckm@n

~ Evolution : http://gen-hackman.forum-pro.fr/t64-historique-de-l-outil

~ Pre_Script Infos : http://gen-hackman.forum-pro.fr/t89-les-switchs

~ Pre_scan Feedbacks : http://gen-hackman.forum-pro.fr/t93-feedback-pre_scan#505

~ [f001869 (Administrator)] - [FUN0105]

~ SID = S-1-5-21-2586132527-314635491-3328972525-21052

~ System : Microsoft Windows XP (32 bits) Service Pack 3

~ ProcessorNameString : Pentium® Dual-Core CPU E5300 @ 2.60GHz

~ Identifier : x86 Family 6 Model 23 Stepping 10

17:10:04

¤¤¤¤¤¤¤¤¤¤ | MD5 Control

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Diag | 2.1219 | g3n-h@ckm@n & Saachaa ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

~ ¤¤¤¤¤ XP | Vista | 7 | 8 - 32/64 bits ¤¤¤¤¤

~ Update on 19/12/2012 | 18.30 by g3n-h@ckm@n

~ Evolution : http://gen-hackman.forum-pro.fr/t64-historique-de-l-outil

~ Pre_Script Infos : http://gen-hackman.forum-pro.fr/t89-les-switchs

~ Pre_scan Feedbacks : http://gen-hackman.forum-pro.fr/t93-feedback-pre_scan#505

~ [f001869 (Administrator)] - [FUN0105]

~ SID = S-1-5-21-2586132527-314635491-3328972525-21052

~ System : Microsoft Windows XP (32 bits) Service Pack 3

~ ProcessorNameString : Pentium® Dual-Core CPU E5300 @ 2.60GHz

~ Identifier : x86 Family 6 Model 23 Stepping 10

17:14:17

¤¤¤¤¤¤¤¤¤¤ | MD5 Control

DigRam · Dezembro 19, 2012

Boa Noite! Edvan

|- Vamos tentar com a OTL. Delete Pre_Scan.exe ou winlogon.exe ou Pre_Scan.pif.

-/-

|- Baixe: < > ( ... by OldTimer Tools )

|- Salve-o no desktop!

|- Duplo clique em OTL.exe >> Executar ou

|- Ps: Tendo dificuldades ao executar OTL.exe,delete o arquivo e baixe-o daqui ou aqui.

|- Configure a ferramenta,segundo a screenshot!

|- Em "Exame Extra do Registro",assinale "Nenhum".

*crack* /s 
*keygen* /s 
*serial* /s 
*AutoKMS* /s
*loader* /s
%SYSTEMDRIVE%\*.*
%APPDATA%\Local\*.
%APPDATA%\*.exe /s
%APPDATA%\*.
%systemdrive%\drivers\*.exe
%USERPROFILE%\AppData\Local\*.*
%USERPROFILE%\AppData\Roaming\*.*
%systemroot%\system32\drivers\*.* /90
%systemroot%\assembly\tmp\*.* /S /MD5
%systemroot%\assembly\temp\*.* /S /MD5
%systemroot%\assembly\GAC\*.* /S /MD5
%systemroot%\assembly\GAC_32\*.* /S /MD5
%systemroot%\system32\config\systemprofile\AppData\Local\*.*
%windir%\ServiceProfiles\LocalService\AppData\Local\Temp\*.*
%windir%\ServiceProfiles\NetworkService\AppData\Local\Temp\*.* 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes
/md5start
services.exe
/md5stop
regedit /e c:\registrybackup.reg /c
%windir%\tasks\*.* /s

|- Copie estas informações que estão no Code,para o Bloco de Notas.

|- Salve-as em Meus Documentos ou desktop,com o nome scan. << Texto!

|- Clique na área "Exames Personalizados/Correções".

|- Clique em Ok para procurar um arquivo com exame personalizado.

|- Clique "Abrir". ( scan.txt )

|- Após colar as informações na área branca,clique em

|- Concluindo,poste o relatório: OTL.txt << Link ao relatório!

|- Para enviar,acesse: < MyFile.tk >

|- Ou acesse: < >

|- Maiores informações: < |Link| >

Abraços!

Edvan · Dezembro 20, 2012

Link http://cjoint.com/12dc/BLumScMzmXc.htm

Estamos com um problema aqui no IE 8.0, não consigo ativar os cookites, usamos um sistema aqui que precisa dos cookites, já desinstalei e instalei o IE e nada.

Ate para bater o ponto que é online nao conseguimos, já pelo FF consigo normalmente, rodei o Fix it da MS e nada.

O que pode ser amigo?

DigRam · Dezembro 20, 2012

Link http://cjoint.com/12dc/BLumScMzmXc.htm

Estamos com um problema aqui no IE 8.0, não consigo ativar os cookites, usamos um sistema aqui que precisa dos cookites, já desinstalei e instalei o IE e nada.

Ate para bater o ponto que é online nao conseguimos, já pelo FF consigo normalmente, rodei o Fix it da MS e nada.

O que pode ser amigo?

Bom Dia! Edvan

|- Já tentou inserir ou configurar,esse link,com endereço preferencial ao IE?

-/-

|- Baixe: < FixPolicies > ( ... by Bill Castner )

|- Salve-o no desktop!

|- Execute o arquivo FixPolicies.exe,com um duplo-clique.

|- Clique em Install.

|- Abra a pasta FixPolicies,que foi criada.

|- Duplo-clique em Fix_policies.cmd.

|- Surgirá,por breve momento,uma caixa preta.

-/-

|- Execute o OTL.exe.

|- Copie estas informações que estão no Code,para o campo clipboard da ferramenta. ( "Exames Personalizados/Correções" )

:OTL
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\f001869\CONFIG~1\Temp\catchme.sys -- (catchme)
IE - HKLM\..\SearchScopes\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}: "URL" = http://search.speedbit.com/search.aspx?s=CC4a105&q={searchTerms}
IE - HKU\S-1-5-21-2586132527-314635491-3328972525-21052\..\SearchScopes\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}: "URL" = http://search.speedbit.com/search.aspx?s=CC4a105&q={searchTerms}
FF - user.js - File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\f001869\Configurações locais\Dados de aplicativos\Google\Update\1.3.21.111\npGoogleUpdate3.dll File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\f001869\Configurações locais\Dados de aplicativos\Google\Update\1.3.21.111\npGoogleUpdate3.dll File not found
O3 - HKU\S-1-5-21-2586132527-314635491-3328972525-21052\..\Toolbar\ShellBrowser: (no name) - {61628E2A-4FF9-4454-992D-D92A8CD27399} - No CLSID value found.
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
[2012/12/19 14:07:58 | 000,000,000 | ---D | C] -- C:\Pre_Scan
[2012/12/19 08:29:16 | 000,000,000 | ---D | C] -- C:\Arquivos de programas\ZHPDiag
[2012/12/18 17:37:20 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012/12/13 15:33:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dados de aplicativos\PSafe
[2012/12/11 16:14:43 | 000,031,465 | ---- | M] () -- C:\Documents and Settings\f001869\Configurações locais\Dados de aplicativos\funmoods.crx
[2012/12/18 17:46:27 | 000,000,489 | ---- | C] () -- C:\Documents and Settings\f001869\Meus documentos\Atalho para ComboFix.exe.lnk
[2011/01/21 10:17:38 | 000,012,288 | ---- | C] () -- C:\Documents and Settings\f001869\Configurações locais\Dados de aplicativos\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/12/19 17:14:17 | 000,001,442 | ---- | M] () -- C:\Pre_Diag.txt

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope" = ""

:Commands 
[CLEARALLRESTOREPOINTS]
[purity] 
[resethosts]
[emptytemp] 
[Reboot]

|- Clique no botão Consertar -> Aguarde a conclusão!

|- O computador vai reiniciar! -> Clique em "Executar".

|- Para versões em Inglês,clique em Run Fix que é o mesmo que Consertar.

|- Poste o relatório: C:\_OTL\MovedFiles\*.log

A+

Edvan · Dezembro 20, 2012

Bom Dia! Edvan

|- Já tentou inserir ou configurar,esse link,com endereço preferencial ao IE?

Feito tudo amigo.

O que o FixPolicies faz? pois nao gerou nada de log!.

All processes killed

========== OTL ==========

Service WDICA stopped successfully!

Service WDICA deleted successfully!

Service PDRFRAME stopped successfully!

Service PDRFRAME deleted successfully!

Service PDRELI stopped successfully!

Service PDRELI deleted successfully!

Service PDFRAME stopped successfully!

Service PDFRAME deleted successfully!

Service PDCOMP stopped successfully!

Service PDCOMP deleted successfully!

Service PCIDump stopped successfully!

Service PCIDump deleted successfully!

Service lbrtfdc stopped successfully!

Service lbrtfdc deleted successfully!

Service i2omgmt stopped successfully!

Service i2omgmt deleted successfully!

Service Changer stopped successfully!

Service Changer deleted successfully!

Service catchme stopped successfully!

Service catchme deleted successfully!

File C:\DOCUME~1\f001869\CONFIG~1\Temp\catchme.sys not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}\ not found.

Registry key HKEY_USERS\S-1-5-21-2586132527-314635491-3328972525-21052\Software\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}\ not found.

Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.

Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.

Registry value HKEY_USERS\S-1-5-21-2586132527-314635491-3328972525-21052\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{61628E2A-4FF9-4454-992D-D92A8CD27399} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{61628E2A-4FF9-4454-992D-D92A8CD27399}\ not found.

Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.

Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}

Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\DownloadInformation\\INF .

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.

C:\Pre_Scan\Save\Scan\Users\00000002 folder moved successfully.

C:\Pre_Scan\Save\Scan\Users\00000001 folder moved successfully.

C:\Pre_Scan\Save\Scan\Users folder moved successfully.

C:\Pre_Scan\Save\Scan folder moved successfully.

C:\Pre_Scan\Save folder moved successfully.

C:\Pre_Scan\Replace folder moved successfully.

C:\Pre_Scan\Quarantine folder moved successfully.

C:\Pre_Scan\Process folder moved successfully.

C:\Pre_Scan\MBR folder moved successfully.

C:\Pre_Scan\Infected folder moved successfully.

C:\Pre_Scan\dll folder moved successfully.

C:\Pre_Scan folder moved successfully.

C:\Arquivos de programas\ZHPDiag\Quarantine folder moved successfully.

C:\Arquivos de programas\ZHPDiag\Liste Spéciale folder moved successfully.

C:\Arquivos de programas\ZHPDiag folder moved successfully.

C:\ComboFix folder moved successfully.

C:\Documents and Settings\All Users\Dados de aplicativos\PSafe\logs folder moved successfully.

C:\Documents and Settings\All Users\Dados de aplicativos\PSafe folder moved successfully.

C:\Documents and Settings\f001869\Configurações locais\Dados de aplicativos\funmoods.crx moved successfully.

C:\Documents and Settings\f001869\Meus documentos\Atalho para ComboFix.exe.lnk moved successfully.

C:\Documents and Settings\f001869\Configurações locais\Dados de aplicativos\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini moved successfully.

C:\Pre_Diag.txt moved successfully.

========== REGISTRY ==========

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7F4EFF06-7032-458e-AE16-1C1D8255C28A}\ not found.

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\\"DefaultScope" | "" /E : value set successfully!

========== COMMANDS ==========

System Restore Service not available.

File move failed. C:\windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.

Error: Unble to create default HOSTS file!

[EMPTYTEMP]

User: Administrador

->Temp folder emptied: 508778 bytes

->Temporary Internet Files folder emptied: 112094 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 33981709 bytes

->Flash cache emptied: 492 bytes

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: e0021

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Java cache emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: f001869

->Temp folder emptied: 90708 bytes

->Temporary Internet Files folder emptied: 32822404 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 90656977 bytes

->Flash cache emptied: 5885 bytes

User: f002024

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: f002873

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: f003140

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Java cache emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: LocalService

->Temp folder emptied: 65748 bytes

->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 16384 bytes

RecycleBin emptied: 4326337 bytes

Total Files Cleaned = 155,00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 12202012_140255

Files\Folders moved on Reboot...

C:\windows\System32\drivers\etc\Hosts moved successfully.

C:\Documents and Settings\f001869\Configurações locais\Temporary Internet Files\SuggestedSites.dat moved successfully.

File move failed. C:\windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

DigRam · Dezembro 20, 2012

Boa Noite! Edvan

O que o FixPolicies faz? pois nao gerou nada de log!.

|- Essa ferramenta não gera relatório e corrige políticas incorretas,que costumam ser impostas por malwares ou adwares,ao registro.

Estamos com um problema aqui no IE 8.0, não consigo ativar os cookites, usamos um sistema aqui que precisa dos cookites, já desinstalei e instalei o IE e nada.

|- Aqui,você está referindo-se à cookies?

A+

Edvan · Dezembro 21, 2012

Aqui,você está referindo-se à cookies?

Isso mesmo amigo, usamos um sistema aqui na empresa, quando vamos gerar um relatório para poder imprimir, a tela com o relatório vem com alguns erros, daí quando clicamos em imprimir nao mostra as impressoras para poder imprimir.

P>S:, vou lá na maquina agora para dar um print screen, para você ter uma ideia do que se trata, isso só acontece na maquina dessa menina, o programador disse para mim que nosso sistema usa cookies e nao estava conseguindo ativar o mesmo no IE da maquina dela, daí fui lá e desinstalei e instalei denovo e nada, passei o fix it mais nada resolveu, muito estranho isso.

Veja na imagem onde circulei em vermelho:

Quando clico em imprimir não sai nada como se estivesse travado tudo.

Acho que vou agendar com a menina para formatar essa maquina em Janeiro/2013, esse pc deve está todo bugado. hehehe.

DigRam · Dezembro 21, 2012

Bom Dia! Edvan

< html_associationfix >

|- Utilize este Fix,ao descompactá-lo.

< Microsoft Fix it 50198 >

|- Utilize este FixIt.

|- Se não resolver,pode formatar!

A+

Edvan · Dezembro 21, 2012

Ok.. mais eu executo primeiro o html_associationfix > depois o Microsoft Fix it 50198 >??

DigRam · Dezembro 21, 2012

Ok.. mais eu executo primeiro o html_associationfix > depois o Microsoft Fix it 50198 >??

Olá! Edvan

|- Execute,primeiramente,o html_associationfix.

-/-

|- Baixe: < Re-Enable > ( ... by TangoSoft )

|- Clique em "Download Now" e salve "Installer, Setup.exe" no desktop!

|- Instale-o com um duplo-clique!

|- Ps: A sua funcionalidade,requer primeiro a instalação do .Net Framework 3.5.

|- Desejando a versão portable,essa instalação pode ser dispensada.

|- Para Windows Vista ou 7: Clique direto em "Setup.exe e escolha sua execução como "Administrador".

|- Desmarque todos os botões,clicando em 'Check/Uncheck All'

|- Marque: As funções que estejam 'bugadas'

|- Clique em "Re-Enable" -> Aguarde!

|- À seguir,ao concluir,reinicie o computador!

A+

Arquivado

[Resolvido] &nbspLog para analise

Recommended Posts

Edvan 30

Compartilhar este post

Link para o post

Compartilhar em outros sites

DigRam 144

Compartilhar este post

Link para o post

Compartilhar em outros sites

Edvan 30

Compartilhar este post

Link para o post

Compartilhar em outros sites

DigRam 144

Compartilhar este post

Link para o post

Compartilhar em outros sites

Edvan 30

Compartilhar este post

Link para o post

Compartilhar em outros sites

DigRam 144

Compartilhar este post

Link para o post

Compartilhar em outros sites

Edvan 30

Compartilhar este post

Link para o post

Compartilhar em outros sites

DigRam 144

Compartilhar este post

Link para o post

Compartilhar em outros sites

Edvan 30

Compartilhar este post

Link para o post

Compartilhar em outros sites

DigRam 144

Compartilhar este post

Link para o post

Compartilhar em outros sites

Edvan 30

Compartilhar este post

Link para o post

Compartilhar em outros sites

DigRam 144

Compartilhar este post

Link para o post

Compartilhar em outros sites

Edvan 30

Compartilhar este post

Link para o post

Compartilhar em outros sites

DigRam 144

Compartilhar este post

Link para o post

Compartilhar em outros sites

Edvan 30

Compartilhar este post

Link para o post

Compartilhar em outros sites

DigRam 144

Compartilhar este post

Link para o post

Compartilhar em outros sites

Edvan 30

Compartilhar este post

Link para o post

Compartilhar em outros sites

DigRam 144

Compartilhar este post

Link para o post

Compartilhar em outros sites

Edvan 30

Compartilhar este post

Link para o post

Compartilhar em outros sites

DigRam 144