[Resolvido] &nbspNotebook travando muito, suspeita de virus

Nayara Batista · Agosto 30, 2013

Eu utilizei meu pendrive num computador diferente que passou vírus pra ele, depois quando coloquei

meu pen drive no meu notebook o antivírus avisou que tinha detectado um "cavalo de troia".

Depois disso meu computador começou travar muito, mesmo depois que eu transferi o vírus para

a quarentena.

Não to conseguindo mexer no notebook porque ele literalmente para e não funciona nada.

So to conseguindo mexer nele pelo modo "safe with networking", que ai funciona normalmente sem travar.

Ai vai o log, por favor me ajudem

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 13:03:39, on 30/08/2013

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v10.0 (10.00.9200.16660)

Boot mode: Safe mode with network support

Running processes:

C:\Users\nayara\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\nayara\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=userinit.exe,

O2 - BHO: Buscape Na Hora BHO Class - {051FB9EC-79EA-4F8E-9EC2-F1FF4462FB09} - C:\Program Files (x86)\Buscapé\Buscapé na Hora\IE\BphBHO.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

O2 - BHO: Auxiliar de Conexão do Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: G-Buster Browser Defense Banco Real - {C41A1C0E-EA6C-11D4-B1B8-444553540007} - C:\Program Files (x86)\GbPlugin\gbiehabn.dll

O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

O3 - Toolbar: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

O4 - HKLM\..\Run: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

O4 - HKLM\..\Run: [iSBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe"

O4 - HKLM\..\Run: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [WSMTask] "C:\Program Files (x86)\WSDIR\wTask.exe"

O4 - HKLM\..\Run: [APF] "C:\Program Files (x86)\WM Manager\mw.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [Google Update] "C:\Users\nayara\AppData\Local\Google\Update\GoogleUpdate.exe" /c

O4 - HKCU\..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED

O4 - HKCU\..\Run: [Facebook Update] "C:\Users\nayara\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

O4 - HKCU\..\Run: [Pokki] C:\Windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\LaunchDeskband.dll",RunLaunchDeskband

O4 - HKCU\..\Run: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun

O4 - HKCU\..\Run: [HW_OPENEYE_OUC_Claro] "C:\Program Files (x86)\Claro\UpdateDog\ouc.exe"

O4 - HKCU\..\Run: [d9c7d] C:\Users\nayara\AppData\Roaming\cfd1\d9c7d.js

O4 - HKCU\..\RunOnce: [Application Restart #4] C:\Users\nayara\AppData\Local\Pokki\Engine\pokki.exe --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable-client-side-phishing-detection --disable-sync --disable-breakpad --disable-bundled-ppapi-flash --disable-sync-tabs --disable-speech-input --disable-custom-jumplist --process-per-tab --debug-devtools-frontend="C:\Users\nayara\AppData\Local\Pokki\Engine\inspector" --no-first-run --lang=en-US --disable-component-update --disable-prompt-on-repost --no-startup-window --disable-translate --disable-logging --disable-desktop-notifications --flag-switches-begin --flag-switches-end --restore-last-session

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIÇO LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO DE REDE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIÇO DE REDE')

O4 - HKUS\S-1-5-18\..\RunOnce: [Del95200608] cmd.exe /Q /D /c del "C:\Windows\TEMP\0.del" (User 'SISTEMA')

O4 - HKUS\.DEFAULT\..\RunOnce: [Del95200608] cmd.exe /Q /D /c del "C:\Windows\TEMP\0.del" (User 'Default user')

O4 - Startup: 8e858.js

O4 - Global Startup: 8e858.js

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O15 - Trusted Zone: wwws.realsecureweb.com.br

O15 - Trusted Zone: www.santander.com.br

O15 - Trusted Zone: www.santanderempresarial.com.br

O15 - Trusted Zone: www.santandernet.com.br

O15 - Trusted Zone: wwws.santandernet.com.br

O15 - Trusted Zone: wwws2.santandernet.com.br

O15 - Trusted Zone: www.santandernetibe.com.br

O15 - Trusted Zone: www.secureweb.com.br

O17 - HKLM\System\CCS\Services\Tcpip\..\{79169420-BC17-4933-83F1-82AF4D5A8D8E}: NameServer = 0.0.0.0

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O20 - Winlogon Notify: GbPluginAbn - C:\Program Files (x86)\GbPlugin\gbiehAbn.dll

O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: Gbp Service (GbpSv) - GAS Tecnologia - C:\PROGRA~2\GbPlugin\GbpSv.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: HWDeviceService64.exe - Unknown owner - C:\ProgramData\DatacardService\HWDeviceService64.exe

O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

O23 - Service: IconMan_R - Realsil Microelectronics Inc. - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

O23 - Service: IviRegMgr - InterVideo - C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: Wireless PAN DHCP Server (MyWiFiDHCPDNS) - Unknown owner - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Oasis2Service - Digital Delivery Networks, Inc. - C:\Program Files (x86)\DDNi\Oasis2Service\Oasis2Service.exe

O23 - Service: PMBDeviceInfoProvider - Sony Corporation - C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: VAIO Care Performance Service (SampleCollector) - Sony Corporation - C:\Program Files\Sony\VAIO Care\VCPerfService.exe

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Skype C2C Service - Skype Technologies S.A. - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: VAIO Content Importer (SOHCImp) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe

O23 - Service: VAIO Device Searcher (SOHDs) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe

O23 - Service: VAIO Entertainment Common Service (SpfService) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: CamMonitor (uCamMonitor) - ArcSoft, Inc. - C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: Intel® Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: VAIO Content Folder Watcher (VCFw) - Sony Corporation - C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe

O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe

O23 - Service: VAIO Content Metadata Intelligent Network Service Manager (VcmINSMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe

O23 - Service: VAIO Content Metadata XML Interface (VcmXmlIfHelper) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe

O23 - Service: VCService - Sony Corporation - C:\Program Files\Sony\VAIO Care\VCService.exe

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: VSNService - Sony Corporation - C:\Program Files\Sony\VAIO Smart Network\VSNService.exe

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: VUAgent - Sony Corporation - C:\Program Files\Sony\VAIO Update 5\VUAgent.exe

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 16614 bytes

DigRam · Agosto 30, 2013

Boa Tarde! Nayara Batista

Devido a infecção presente o UsbFix deve ser executado em Modo Diagnóstico.

Outros procedimentos serão adotados,posteriormente,na limpeza do Note.

-/-

|- Baixe: < http://general-changelog-team.fr/fr/downloads/viewdownload/15-outils-de-el-desaparecido/79-usbfix'>UsbFix > ( ...de C_XX & El Desaparecido )

http://services.service-webmaster.fr/cpt-clics/clics-30453-6505.html'>

|- Salve-o no desktop!

|- Siga com sua instalação.

|- Desmarque: "Desativar Autorun/AutoPlay automaticamente" -> OK

|- Aperte a tecla "Shift" e conecte seu pendrive ao computador!

|- Execute o arquivo UsbFix.exe,com um duplo clique.

|- Escolha a opção "Pesquisa".

|- Aguarde a conclusão e poste o relatório. ( C:\UsbFix.txt )

A+

Nayara Batista · Agosto 30, 2013

Eu fiz como dito na primeira mensagem

olha o log

############################## | UsbFix V 7.133 | [supressão]

Usuário: nayara (Administrador) # NAYARA-VAIO

Atualizado em 27/08/2013 por El Desaparecido

Começou em 13:47:40 | 30/08/2013

Site: http://sosvirus.net/

Upload Malware: http://sosvirus.net/viewtopic.php?f=6&t=489

Contato: eldesaparecido@sosvirus.net

PC: Sony Corporation (VPCEG36FX) (x64-based PC)

CPU: Intel® Core i5-2450M CPU @ 2.50GHz (2494)

RAM -> [Total : 6092 | Free : 4953]

BIOS: InsydeH2O Version 03.61.04R0230Z8

BOOT: Fail-safe with network boot

OS: Microsoft Windows 7 Home Premium (6.1.7601 64-Bit) # Service Pack 1

WB: Windows Internet Explorer 10.0.9200.16660

SC: Security Center Service [(!) Disabled]

WU: Windows Update Service [Enabled]

AV: avast! Antivirus [Enabled | Updated]

FW: Windows FireWall Service [(!) Disabled]

C:\ (%systemdrive%) -> Disco fixo # 585 Gb (457 Mb livre - 78%) [] # NTFS

D:\ -> CD-ROM

E:\ -> CD-ROM

F:\ -> Disco removível # 4 Gb (1 Mb livre - 30%) [KINGSTON] # FAT32

################## | El Desaparecido Section |

HKLM\SOFTWARE | Run : [iAStorIcon] - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

HKLM\SOFTWARE | Run : [iSBMgr.exe] - "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe"

HKLM\SOFTWARE | Run : [PMBVolumeWatcher] - C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe

HKLM\SOFTWARE | Run : [GrooveMonitor] - "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

HKLM\SOFTWARE | Run : [WSMTask] - "C:\Program Files (x86)\WSDIR\wTask.exe"

HKLM\SOFTWARE | Run : [APF] - "C:\Program Files (x86)\WM Manager\mw.exe"

HKLM\SOFTWARE | Run : [] -

HKLM\SOFTWARE | Run : [sunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

HKLM\SOFTWARE | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

HKLM\SOFTWARE\wow6432Node | Run : [iAStorIcon] - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

HKLM\SOFTWARE\wow6432Node | Run : [iSBMgr.exe] - "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe"

HKLM\SOFTWARE\wow6432Node | Run : [PMBVolumeWatcher] - C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe

HKLM\SOFTWARE\wow6432Node | Run : [GrooveMonitor] - "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

HKLM\SOFTWARE\wow6432Node | Run : [WSMTask] - "C:\Program Files (x86)\WSDIR\wTask.exe"

HKLM\SOFTWARE\wow6432Node | Run : [APF] - "C:\Program Files (x86)\WM Manager\mw.exe"

HKLM\SOFTWARE\wow6432Node | Run : [] -

HKLM\SOFTWARE\wow6432Node | Run : [sunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

HKLM\SOFTWARE\wow6432Node | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui

HKLM\SOFTWARE | RunOnce : [] -

HKLM\SOFTWARE\wow6432Node | RunOnce : [] -

HKU\S-1-5-19\SOFTWARE | Run : [sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun

HKU\S-1-5-20\SOFTWARE | Run : [sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun

HKU\S-1-5-21-2145815782-204095044-2885066785-1005\SOFTWARE | Run : [sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

HKU\S-1-5-21-2145815782-204095044-2885066785-1005\SOFTWARE | Run : [Google Update] - "C:\Users\nayara\AppData\Local\Google\Update\GoogleUpdate.exe" /c

HKU\S-1-5-21-2145815782-204095044-2885066785-1005\SOFTWARE | Run : [uTorrent] - "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED

HKU\S-1-5-21-2145815782-204095044-2885066785-1005\SOFTWARE | Run : [Facebook Update] - "C:\Users\nayara\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

HKU\S-1-5-21-2145815782-204095044-2885066785-1005\SOFTWARE | Run : [Pokki] - C:\Windows\system32\rundll32.exe "%LOCALAPPDATA%\Pokki\Engine\LaunchDeskband.dll",RunLaunchDeskband

HKU\S-1-5-21-2145815782-204095044-2885066785-1005\SOFTWARE | Run : [skype] - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

HKU\S-1-5-21-2145815782-204095044-2885066785-1005\SOFTWARE | Run : [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun

HKU\S-1-5-21-2145815782-204095044-2885066785-1005\SOFTWARE | Run : [HW_OPENEYE_OUC_Claro] - "C:\Program Files (x86)\Claro\UpdateDog\ouc.exe"

HKU\S-1-5-21-2145815782-204095044-2885066785-1005\SOFTWARE | Run : [d9c7d] - C:\Users\nayara\AppData\Roaming\cfd1\d9c7d.js

HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe

HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe

HKU\S-1-5-21-2145815782-204095044-2885066785-1005\SOFTWARE | RunOnce : [Application Restart #4] - C:\Users\nayara\AppData\Local\Pokki\Engine\pokki.exe --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable-client-side-phishing-detection --disable-sync --disable-breakpad --disable-bundled-ppapi-flash --disable-sync-tabs --disable-speech-input --disable-custom-jumplist --process-per-tab --debug-devtools-frontend="C:\Users\nayara\AppData\Local\Pokki\Engine\inspector" --no-first-run --lang=en-US --disable-component-update --disable-prompt-on-repost --no-startup-window --disable-translate --disable-logging --disable-desktop-notifications --flag-switches-begin --flag-switches-end --restore-last-session

HKU\S-1-5-18\SOFTWARE | RunOnce : [Del95200608] - cmd.exe /Q /D /c del "C:\Windows\TEMP\0.del"

HKU\S-1-5-18\SOFTWARE | RunOnce : [Del7374245] - cmd.exe /Q /D /c del "C:\Windows\TEMP\0.del"

HKU\S-1-5-18\SOFTWARE | RunOnce : [Del93787598] - cmd.exe /Q /D /c del "C:\Windows\TEMP\0.del"

################## | Processos parados |

Parado! C:\Windows\system32\ctfmon.exe (1124)

Parado! C:\Windows\helppane.exe (1592)

Parado! C:\Windows\system32\DllHost.exe (1640)

Parado! C:\Users\nayara\AppData\Local\Google\Chrome\Application\chrome.exe (1932)

Parado! C:\Users\nayara\AppData\Local\Google\Chrome\Application\chrome.exe (976)

Parado! C:\Users\nayara\AppData\Local\Google\Chrome\Application\chrome.exe (1112)

Parado! C:\Users\nayara\AppData\Local\Google\Chrome\Application\chrome.exe (384)

Parado! C:\Program Files\AVAST Software\Avast\AvastUI.exe (2244)

################## | Ficheiros # pastas infeciosos |

Supprimido ! C:\Users\nayara\AppData\Roaming\cfd1\d9c7d.js

Supprimido ! C:\Users\nayara\AppData\Roaming\cfd1

(!) Ficheiros temporários suprimido.

################## | Registro |

Supprimido ! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|d9c7d

Supprimido ! HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore|DisableConfig

################## | Mountpoints2 |

Eu nao entendi, tinha outra resposta, que foi apagada, mandando eu fazer esses passos

http://www.caixadedicas.com/2009/10/tutorial-do-usbfix.html

agora eu faco o q?

DigRam · Agosto 30, 2013

Boa Tarde! Nayara Batista

Eu nao entendi, tinha outra resposta, que foi apagada, mandando eu fazer esses passos

agora eu faco o q?

|- Aborte esses procedimentos!

Eu fiz como dito na primeira mensagem

|- Houve um pequeno risco,já que não sabemos se o seu pendrive,ainda,apresenta infecção.

O4 - HKCU\..\Run: [d9c7d] C:\Users\nayara\AppData\Roaming\cfd1\d9c7d.js

O4 - Startup: 8e858.js

O4 - Global Startup: 8e858.js

|- Abra o HijackThis >> Clique: "Do a system scan only"

|- Marque as entradas àcima e clique "Fix checked".

|- Ps: É importante que as caixinhas sejam assinaladas!

-/-

|- Baixe: < SEAF > ( ... de C_XX )

|- Clique na seta verde,para o download.

|- Salve-a no desktop!

|- Para Windows Vista ou 7,dê clique direito em SEAF.exe e execute-o como administrador.

|- Siga a sequência numérica,em seus procedimentos:

|- < 1 > Neste campo,cole a(s) ocorrência(s)...no caso: 8e858.js

|- < 2 > Em "Calculer le checksum",escolha "MD5".

|- < 3 > Em "[ Options du registre ]",marque: "Chercher également dans le registre"

|- < 4 > Clique em "Lancer la recherche" << Aguarde!

|- Ps: Na mensagem,clique em "Non".

|- Ao concluir,teremos o relatório: C:\SeafLog.txt << Poste-o!

Abs!

Nayara Batista · Agosto 30, 2013

eh pra marcar todas as caixas? eu nao corro o risco de perder itens importantes do sistema nao?

DigRam · Agosto 30, 2013

eh pra marcar todas as caixas? eu nao corro o risco de perder itens importantes do sistema nao?

Olá!

|- É para marcar somente,as caixinhas que lhe indiquei em vermelho.

|- Marque as que encontrar.

A+

Nayara Batista · Agosto 30, 2013

1. ========================= SEAF 1.0.1.0 - C_XX

2.

3. Commencé à: 14:36:05 le 30/08/2013

4.

5. Valeur(s) recherchée(s):

6. 8e858.js

7.

8. Légende: TC => Date de création, TM => Date de modification, DA => Dernier accès

9.

10. (!) --- Calcul du Hash "MD5"

11. (!) --- Recherche registre

12.

13. ====== Fichier(s) ======

14.

15.

16. "C:\Users\nayara\Downloads\backups\backup-20130830-143158-100-8e858.js" [ ARCHIVE | 48 Ko ]

17. TC: 30/08/2013,12:48:52 | TM: 30/08/2013,12:48:52 | DA: 30/08/2013,12:48:52

18.

19. Hash MD5: 6D505E39169C69931BA1164126FF0A08

20.

21.

22. =========================

23.

24.

25. "C:\Users\nayara\Downloads\backups\backup-20130830-143158-946-8e858.js" [ ARCHIVE | 48 Ko ]

26. TC: 30/08/2013,12:48:52 | TM: 30/08/2013,12:48:52 | DA: 30/08/2013,12:48:52

27.

28. Hash MD5: 6D505E39169C69931BA1164126FF0A08

29.

30.

31. =========================

32.

33.

34.

35. ====== Entrée(s) du registre ======

36.

37. Aucun élément dans le registre trouvé

38.

39. =========================

40.

41. Fin à: 14:37:31 le 30/08/2013

42. 698299 Éléments analysés

43.

44. =========================

45. E.O.F

DigRam · Agosto 30, 2013

Boa Tarde! Nayara Batista

|- Recomendo formatar seu pendrive.

-/-

|- Baixe: < zoek > ( ... by Smeenk )

|- Ou aqui! <

zoek.exe >

|- Salve-o no desktop!

|- Desabilite seu antivírus!

|- Para Windows 7,execute zoek.exe como administrador.

C:\Users\nayara\AppData\Roaming\cfd1\d9c7d.js;f

C:\Users\nayara\Downloads\backups\backup-20130830-143158-100-8e858.js;f

C:\Users\nayara\Downloads\backups\backup-20130830-143158-946-8e858.js;f

C:\Users\nayara\AppData\Roaming\cfd1;fs

[HKU\S-1-5-21-2145815782-204095044-2885066785-1005\SOFTWARE\Run];r

"d9c7d"=-;r

emptyalltemp;

hijackthis;

autoclean;

|- Copie e cole estas informações,em vermelho,no campo da ferramenta.

|- Clique "Run Script".

Zoek.exe is running now.

Do not start any browser windows, they will be closed automatically.

Please wait! This window will close when finished.

A logfile will open afterwards and can also be found on your systemdrive as zoek-results.log

|- Surgirão estas informações,pedindo-lhe que aguarde o relatório.

|- Aceite e/ou confirme o reboot!

zoek.hta failed by unknown error.

Restart computer, and try again.

|- Ps: Ao obter algum erro,reinicie o PC e execute,novamente,a ferramenta.

|- Poste o relatório,que estará em C:\zoek-results.txt <<

Abs!

Nayara Batista · Agosto 30, 2013

baixei o zoek, mas nao to conseguindo abrir, ta dizendo que a pasta eh invalida...

nao sei se eh porque eu to no "modo safe"

mas no modo normal eu nao consigo mexer...

DigRam · Agosto 30, 2013

baixei o zoek, mas nao to conseguindo abrir, ta dizendo que a pasta eh invalida...

nao sei se eh porque eu to no "modo safe"

mas no modo normal eu nao consigo mexer...

Olá!

|- No Modo Normal,tentou executar o arquivo,com o clique direto do mouse e escolher a opção Executar como administrador?

|- Reinicie o computador,e tente novamente.

A+

Nayara Batista · Agosto 30, 2013

Zoek.exe Version 4.0.0.4 Updated 30-08-2013

Tool run by nayara on 30/08/2013 at 15:30:27,01.

Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\nayara\Downloads\zoek (1)\zoek.exe [script inserted]

==== System Restore Info ======================

30/08/2013 15:39:51 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[HKEY_USERS\S-1-5-21-2145815782-204095044-2885066785-1005\SOFTWARE\Run]

"d9c7d"=-

==== Deleting Files \ Folders ======================

"C:\Users\nayara\AppData\Roaming\cfd1\d9c7d.js" not found

"C:\Users\nayara\AppData\Roaming\cfd1" not found

"C:\Users\nayara\Downloads\backups\backup-20130830-143158-100-8e858.js" deleted

"C:\Users\nayara\Downloads\backups\backup-20130830-143158-946-8e858.js" deleted

"C:\Program Files (x86)\Mozilla Firefox\user.js" deleted

"C:\ProgramData\boost_interprocess" deleted

==== Firefox Extensions ======================

ProfilePath: C:\Users\nayara\AppData\Roaming\Mozilla\Firefox\Profiles\os167zm2.default

- avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF

- CoolLinks Addon - %ProfilePath%\extensions\toolbarbutton@coollinks.us

- Power Zoom - %ProfilePath%\extensions\{65030561-c150-4370-836c-7c9d04f7a1b4}

==== Firefox Plugins ======================

Profilepath: C:\Users\nayara\AppData\Roaming\Mozilla\Firefox\Profiles\os167zm2.default

D7324EB1EDCB8990F8522DE0311359E9 - C:\Windows\SysWOW64\npDeployJava1.dll - Java Deployment Toolkit 7.0.250.17

0C8597DBC74AAF5179471BA013E3C6B4 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll - Shockwave Flash

101700E93EB905992B518256CB441829 - C:\Users\nayara\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll - Google Update

63BF4171F8EF7AA2C9D20EFB5B336B63 - C:\Users\nayara\AppData\Local\GAS Tecnologia\GBBD\npsf_abn.dll - Módulo de Proteção - Banco Santander (Brasil) S.A.

F20AB49A381EEC05319A352CBCAB3532 - C:\Users\nayara\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll - Pokki Download Helper

0B31B0F8FA99CFD009C8FBEA9E20C9DE - C:\Users\nayara\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll - Facebook Video Calling Plugin

15E298B5EC5B89C5994A59863969D9FF - C:\Windows\SysWOW64\npmproxy.dll - Microsoft® Windows® Operating System

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions

cbmaapmfbamjbnphljmaokgmodjlpojj - C:\Program Files (x86)\Buscap‚\Buscap‚ na Hora\Chrome\BuscaPeNaHoraPlugin_BR.crx[23/01/2013 09:50]

lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx[14/08/2013 11:12]

nfmehijkjmecpggalfkngbpppbfdpdkg - C:\Users\nayara\AppData\Local\CoolLinks\extension.crx[25/04/2013 00:55]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions

abmojiekfpcmkkfamgfcpgfgipocface - C:\Users\nayara\AppData\Local\GAS Tecnologia\GBBD\abn\sf.crx[01/04/2013 14:43]

GBBD Banco Santander (Brasil) S.A. - nayara - Default\Extensions\abmojiekfpcmkkfamgfcpgfgipocface

Skype for Chromium - nayara - Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl

==== Set IE to Default ======================

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://fr.msn.com/"

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://fr.msn.com/"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

{searchCLSID} Unknown Url="Not_Found"

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"

{1F98D690-8DED-4C7A-93A6-F55EB5DFD50B} Google Url="http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8"

{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== HijackThis Entries ======================

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.microsoft.com/fwlink/?linkid=54896

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.msn.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=C:\Windows\SysWOW64\Userinit.exe,