[Resolvido] &nbspVários icones do windows update ficam aparecendo na b

wrongdoer · Junho 29, 2013

Vários icones do windows update ficam aparecendo na barra tarefas, não consigo executar programas, somente consigo executar os programas em modo de segurança.

Log Hijack

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 12:50:04, on 01/07/2013

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16385)

Boot mode: Safe mode with network support

Running processes:

C:\hijack\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.baixaki.com.br/portal/?utm_source=core&utm_medium=ppi&utm_campaign=portal

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: Lyrics On - {73C1CE1A-2075-4350-A7B4-EBA78BA45FA8} - C:\Program Files (x86)\LyricsOn\lrcson.dll

O2 - BHO: Auxiliar de Conexão do Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll

O2 - BHO: G-Buster Browser Defense Banco Real - {C41A1C0E-EA6C-11D4-B1B8-444553540007} - C:\Program Files (x86)\GbPlugin\gbiehabn.dll

O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui

O4 - HKLM\..\Run: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe

O4 - HKCU\..\Run: [58915] C:\Users\Fabiana\AppData\Roaming\4e8\58915.js

O4 - Startup: 0fd.js

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll

O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O15 - Trusted Zone: wwws.realsecureweb.com.br

O15 - Trusted Zone: www.santander.com.br

O15 - Trusted Zone: www.santanderempresarial.com.br

O15 - Trusted Zone: www.santandernet.com.br

O15 - Trusted Zone: wwws.santandernet.com.br

O15 - Trusted Zone: wwws2.santandernet.com.br

O15 - Trusted Zone: www.santandernetibe.com.br

O15 - Trusted Zone: www.secureweb.com.br

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O20 - Winlogon Notify: GbPluginAbn - C:\Program Files (x86)\GbPlugin\gbiehAbn.dll

O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - (no file)

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Gbp Service (GbpSv) - - C:\PROGRA~2\GbPlugin\GbpSv.exe

O23 - Service: Serviço do Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: PMBDeviceInfoProvider - Sony Corporation - C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 8095 bytes

DigRam · Junho 29, 2013

Boa Tarde! wrongdoer

|- Baixe: <

> ( ... par Xplode )

|- Ao acessar,clique na imagem: <

>

|- Ps: Se utilizar o navegador IE9,desabilite o filtro "SmartScreen".

|- Salve-o no desktop!

|- Clique direito em adwcleaner.exe,e escolha sua execução como

|- Ps: Dê início ao scan,clicando em "Remover". <

>

|- Ao concluir,poste o relatório: C:\AdwCleaner[S1].txt

-/-

|- Baixe: <

> ( ... par Nicolas Coolman )

|- Salve-o no desktop!

ZHPDiag_silent_Abrir_link_zps77a6fb10.jp

|- Ou clique direto na imagem,e escolha: "Abrir link em uma nova guia"

|- Salve-o no desktop!

|- Desabilite seu antivírus!

|- Caso utilize o Avast,estabeleça esta configuração à SandBox.

|- Para Windows Vista ou 7,clique direito e execute o arquivo como

|- Aguarde a conclusão do scan e clique em "Copier". <- Aguarde!

|- Além do relatório,teremos no desktop: ZHP_uninstall, MBRCheck, ZHPDiag, ZHPFix

|- Poste e/ou cole aqui,o link que será gerado,logo após o relatório.

|- Ou acesse:

|- Maiores informações: < |Link| >

A+

wrongdoer · Junho 29, 2013

ADW

# AdwCleaner v2.303 - Relatório criado em 01/07/2013 às 13:33:14

# Atualizado em 08/06/2013 por Xplode

# Sistema Operacional : Windows 7 Ultimate (64 bits)

# Usuário : Fabiana - FABIANA-PC

# Modo de Boot : Modo Seguro com Rede

# Executado de : C:\Users\Fabiana\Desktop\adwcleaner.exe

# Opção [Remover]

***** [serviços] *****

***** [Arquivos/Pastas] *****

Removido Durante o reboot : C:\Program Files (x86)\WebCake

Removido Durante o reboot : C:\Windows\Installer\{E55E7026-EF2A-4A17-AAA7-DB98EA3FD1B1}

***** [Registro] *****

***** [Navegadores] *****

-\\ Internet Explorer v8.0.7600.16385

[OK] Registro está limpo.

-\\ Google Chrome v27.0.1453.116

Arquivo : C:\Users\Fabiana\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Arquivo está limpo.

*************************

AdwCleaner[s1].txt - [3451 octets] - [01/07/2013 12:32:01]

AdwCleaner[s2].txt - [894 octets] - [01/07/2013 13:33:14]

########## EOF - C:\AdwCleaner[s2].txt - [953 octets] ##########

____________________________________________________________--

ZHP

http://cjoint.com/13jn/CFDsUTqUGxY.htm

DigRam · Junho 29, 2013

Boa Tarde! wrongdoer

|- Baixe: <

> ( ... by Oleg N. Scherbakov )

|- Salve-o no desktop!

|- Para Windows 7,clique direito em JRT.exe e execute-o ...

|- Aguarde a conclusão e poste o relatório. ( JRT.txt )

-/-

|- Feche programas/pastas que estejam abertas.

|- Feche,também,o navegador!

|- Para Windows Vista,desabilite a UAC.

|- Para Windows Vista ou 7,clique direito em ZHPFix.exe e execute-o como administrador.

|- Selecione e copie estas informações,que estão no Code,para o "Bloco de Notas".



[MD5.00000000000000000000000000000000] [APT] [Norton Security Scan for Fabiana] (...) -- C:\Program Files (x86)\NORTON~2\Engine\351~1.8\Nss.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [DealPly] (...) -- C:\Users\Fabiana\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.exe (.not file.)   [0]    => Infection PUP (PUP.DealPly)

[MD5.00000000000000000000000000000000] [APT] [DealPlyUpdate] (...) -- C:\Program Files (x86)\DealPly\DealPlyUpdate.exe (.not file.)   [0]    => Infection PUP (PUP.DealPly)

O2 - BHO: Lyrics On [64Bits] - {73C1CE1A-2075-4350-A7B4-EBA78BA45FA8} . (.Cisum Software - Lyrics On.) -- C:\Program Files (x86)\LyricsOn\lrcson.dll

O4 - GS\Desktop: Lixeira - Atalho.lnk - Orphean Key

O43 - CFD: 28/02/2010 - 23:26:17 - [0] ----D C:\Users\Fabiana\AppData\Local\Dados de aplicativos

O43 - CFD: 28/02/2010 - 23:26:17 - [0] ----D C:\Users\Fabiana\AppData\Local\Histórico

O43 - CFD: 15/06/2013 - 19:18:27 - [0] ----D C:\Users\Fabiana\AppData\Local\Programs


C:\Program Files (x86)\LyricsOn\lrcson.dll


[HKCU\Software\MLSync]    => MLSync

[HKLM\Software\Wow6432Node\360Safe]    => Infection Diverse (Lozavita.Troj)


proxyfix

emptytemp

emptyclsid

emptyflash

firewallraz

sysrestore

|- Estando com o Bloco de Notas aberto,acione os atalhos: "Ctrl+A" -> "Ctrl+C"

|- Minimize o Bloco de Notas.

|- Clique no menu,"Paste ClipBoard".

|- Clique "GO" -> Oui.

|- Ps: Temos,àcima,sequência de imagens para maior exclarecimento.

|- Poste o relatório: C:\ZHP\ZHPFix[R1].txt

ZHPDiag_ReportSuppression_zps6b8f97d4.jp

|- Ps: Para obter o relatório,basta clicar no ícone "Report of suppression".

|- À seguir,abra o Bloco de Notas e clique no ícone "Copy ClipBoard". << Colar!

A+

wrongdoer · Junho 29, 2013

JRT

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 4.9.4 (05.06.2013:1)

OS: Windows 7 Ultimate x64

Ran by Fabiana on 01/07/2013 at 17:10:39,70

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 01/07/2013 at 17:18:10,85

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

______________________________________________________________________________________________

ZHP

Rapport de ZHPFix 2013.6.12.3 par Nicolas Coolman, Update du 12/06/2013

Fichier d'export Registre :

Run by Fabiana at 01/07/2013 17:23:18

High Elevated Privileges : OK

Windows 7 Ultimate Edition, 64-bit (Build 7600)

Recycle Files Deleted

========== Registry Key ==========

DELETED Key: CLSID BHO: {73C1CE1A-2075-4350-A7B4-EBA78BA45FA8}

DELETED Key: HKCU\Software\MLSync

DELETED Key: HKLM\Software\Wow6432Node\360Safe

========== Registry Value ==========

ProxyFix : Proxy killed successfully

DELETED ProxyServer Value

DELETED ProxyEnable Value

DELETED EnableHttp1_1 Value

DELETED ProxyHttp1.1 Value

DELETED ProxyOverride Value

No Value in Standard Profile Register Key FirewallRaz :

No Value in Domain Profile Register Key FirewallRaz :

DELETED FirewallRaz (None) : {91508F75-A9F2-4DE9-A32B-9A8BFCAA9173}

========== Repertory ==========

No Empty CLSID Directories

DELETED Flash Cookies

========== File ==========

DELETED File: c:\program files (x86)\lyricson\lrcson.dll

DELETED File: c:\users\fabiana\desktop\lixeira - atalho.lnk

NOT FOUND Folder/File: c:\program files (x86)\lyricson\lrcson.dll

DELETED Window Temporary

DELETED Flash Cookies

========== Task ==========

DELETED Task: Norton Security Scan for Fabiana

DELETED Task: DealPly

DELETED Task: DealPlyUpdate

========== Restoration ==========

Restore System Point created succefully

========== Summary ==========

3 : Registry Key

9 : Registry Value

2 : Repertory

5 : File

3 : Task

1 : Restoration

End of clean in 00mn 37s

========== Report File ==========

C:\ZHP\ZHPFix[R1].txt - 01/07/2013 17:23:18 [1587]

DigRam · Junho 30, 2013

Bom Dia! wrongdoer

O4 - HKCU\..\Run: [58915] C:\Users\Fabiana\AppData\Roaming\4e8\58915.js

O4 - Startup: 0fd.js

|- Caso encontre,dê Fix nestas entradas!

|- Abra o HijackThis >> Marque as entradas! >> Clique "Fix Checked".

|- Confirme e reinicie o computador.

-/-

|- Baixe: < zoek > ( ... by Smeenk )

|- Salve-o no desktop!

|- Desabilite seu antivírus!

|- Para Windows 7,execute zoek.exe como administrador.

startupall;

autoclean;

filesrcm;

emptyalltemp;

|- Copie e cole estas informações,em vermelho,no campo da ferramenta.

|- Clique "Run Script". <- Aguarde!

|- Aceite e/ou confirme o reboot!

zoek.hta failed by unknown error.

Restart computer, and try again.

|- Ps: Ao obter algun erro,reinicie o PC e execute,novamente,a ferramenta.

|- Poste o relatório,que estará em C:\zoek-results.txt <<

|- Poste,também,HijackThis atualizado.

A+

wrongdoer · Julho 1, 2013

Essa entra não achei: O4 - Startup: 0fd.js

HIJACK

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 08:39:15, on 03/07/2013