[Arquivado] wi-fi inicia com o sistema e depois é desligado

[Junior Travassos 0]

o wi-fi funciona com o sistema inicialmente depois de alguns segundos ele se desliga e não funciona mais o sinal do wi-fi fica com um "x" vermelho dali em diante não vai mais nada.

 

quando entro no modo de segurança com rede ele funciona normalmente.

 

já usei o spy hunter tinha alguns malwares ele removeu tudo, mais continuo esse problema.

 

desde já agradeço a colaboração e atenção.

[DigRam 144]

Boa Tarde! Junior Travassos

< REGRA Nº 02 - Utilizando O Hijackthis >

|- Poste o relatório do HijackThis,conforme pede a regra Nº 02.

Abs!

[Junior Travassos 0]

Bom dia Sr. Dig ram

 

Segue o log.

 

 

 

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 10:30:47, on 01/12/2013

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v11.0 (11.00.9600.16428)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe

C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

C:\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com.br/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll

O4 - HKLM\..\Run: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe"

O4 - HKLM\..\Run: [uSB3MON] "C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"

O4 - HKLM\..\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [iMSS] "C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe"

O4 - HKLM\..\Run: [bCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices

O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU\..\Run: [HydraVisionDesktopManager] "C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe"

O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe" -automount

O8 - Extra context menu item: Adicionar ao Antibanner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: &Teclado Virtual - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll

O9 - Extra button: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra button: Veri&ficação de URLs - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)

O23 - Service: AppleChargerSrv - Unknown owner - C:\Windows\system32\AppleChargerSrv.exe (file missing)

O23 - Service: Serviço do Kaspersky Anti-Virus (AVP) - Kaspersky Lab ZAO - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe

O23 - Service: Alcohol Virtual Drive Auto-mount Service (AxAutoMntSrv) - Alcohol Soft Development Team - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: Serviço do Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)

O23 - Service: Intel® Capability Licensing Service Interface - Intel® Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe

O23 - Service: Intel® Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

O23 - Service: Protexis Licensing V2 x64 (PSI_SVC_2_x64) - arvato digital services llc - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: SpyHunter 4 Service - Enigma Software Group USA, LLC. - C:\PROGRA~2\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe

O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: Intel® Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 9996 bytes

[DigRam 144]

Boa Tarde! Junior Travassos

 

|- Não vejo malwares em seu PC.

 

-/-

 

|- Baixe: < ZHPDiag2.exe > < > ( ... de Nicolas Coolman )

|- Salve-o no disco local! ( C ou D )

|- Desabilite seu antivírus e execute "ZHPDiag2.exe",para instalar a ferramenta.

|- Execute o ícone do pergaminho. ( ZHPDiag )

|- Clique "SEARCH" ou "PESQUISAR" e aguarde a conclusão!

|- Clique OK e,ao concluir,poste o relatório! ( ZHPDiag.txt )

|- Ps: Se o log for extenso,envie-o à Pjjoint.malekal.

|- Ou acesse: < >

|- Maiores informações: < |Link| >

A+

 

 

[Junior Travassos 0]

Bom dia Sr. Dig ram

 

Segue o log.

~ Relatório do ZHPDiag v2013.12.1.4 - Nicolas Coolman (01/12/2013)

~ Iniciado por Junior (02/12/2013 09:40:59)

~ Endereço do Website : http://nicolascoolman.webs.com

~ Fóruns de suporte gratuito para desinfecção : http://nicolascoolman.webs.com/apps/links/

~ Tradução pelo utilizador

~ Estatuto da versão :

~ Lista Branca : Ativado pelo programa

~ Elevação dos Privilégios : OK

~ Controle de Conta de Utilizador : Activate by user

---\\ Navegadores Internet

MSIE: Internet Explorer v11.0.9600.16428 (Defaut)

GCIE: Google Chrome v31.0.1650.57

---\\ Informações sobre os produtos Windows

~ Langage: Portugais

Windows 7 Ultimate Edition, 64-bit Service Pack 1 (Build 7601)

Windows Server License Manager Script : OK

Software Protection Service (Protection logicielle) : OK

Windows Automatic Updates : OK

Windows Activation Technologies : OK

---\\ Softwares de proteçao do sistema

Kaspersky Internet Security 2012 v12.0.0.374

Windows Defender W7

---\\ Softwares d'optimização do sistema

---\\ Softwares de partilha do PeerToPeer (P2P)

---\\ Monitoramento dos softwares

Adobe Flash Player 11 ActiveX

Adobe Reader 9.5.5 - Português

---\\ Informações sobre o sistema

~ Processor: Intel64 Family 6 Model 58 Stepping 9, GenuineIntel

~ Operating System: 64 Bits

Boot mode: Normal (Normal boot)

Total RAM: 8137 MB (79% free)

System Restore: Activé (Enable)

System drive C: has 541 GB (58%) free of 931 GB

---\\ Modo de conexão ao sistema

~ Computer Name: JUNIOR-PC

~ User Name: Junior

~ All Users Names: Junior, Convidado, Administrador,

~ Unselected Option: 045,061,O62,065,066,080,O82,089

Logged in as Administrator

---\\ As variáveis de ambiente

~ System Unit : C:\

~ %AppZHP% : C:\Users\Junior\AppData\Roaming\ZHP\

~ %AppData% : C:\Users\Junior\AppData\Roaming\

~ %Desktop% : C:\Users\Junior\Desktop\

~ %Favorites% : C:\Users\Junior\Favorites\

~ %LocalAppData% : C:\Users\Junior\AppData\Local\

~ %StartMenu% : C:\Users\Junior\AppData\Roaming\Microsoft\Windows\Start Menu\

~ %Windir% : C:\Windows\

~ %System% : C:\Windows\System32\

---\\ Enumeração das unidades dos discos

C: Hard drive, Flash drive, Thumb drive (Free 541 Go of 931 Go)

D: CD-ROM drive (Free 0 Go of 4 Go)

E: CD-ROM drive (Not Inserted)

---\\ Estado do Centro de Segurança do Windows

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: Modified =>Hijacker.Application

~ Security Center: 49 Legitimates Filtered in 00mn 00s

---\\ Pesquisa particular de ficheiros genéricos

[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Windows Explorer.) (.25/02/2011 - 03:19:30.) -- C:\Windows\Explorer.exe [2871808]

[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Aplicativo de Inicialização do Windows.) (.13/07/2009 - 22:39:52.) -- C:\Windows\System32\Wininit.exe [129024]

[MD5.E6CB36B85BE59095337427E853A5B65A] - (.Microsoft Corporation - Internet Extensions para Win32.) (.26/11/2013 - 07:19:34.) -- C:\Windows\System32\wininet.dll [2332160]

[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Aplicativo de Logon do Windows.) (.21/11/2010 - 00:24:29.) -- C:\Windows\System32\Winlogon.exe [390656]

[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Biblioteca de Licenciamento de Software.) (.21/11/2010 - 00:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]

[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.27/09/2013 - 22:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]

[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.13/07/2009 - 22:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]

[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 20:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]

[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]

[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 00:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]

[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]

[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Driver de porta i8042.) (.13/07/2009 - 20:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]

[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.13/07/2009 - 21:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]

[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.26/04/2011 - 23:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]

[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 00:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]

[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Driver do Sistema de Arquivos NT.) (.12/04/2013 - 11:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]

[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Driver de porta paralela.) (.13/07/2009 - 21:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]

[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 00:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]

[MD5.1B6163C503398B23FF8B939C67747683] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.21/11/2010 - 00:25:07.) -- C:\Windows\system32\Drivers\rdpdr.sys [165888]

[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.13/07/2009 - 21:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]

[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 00:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]

[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]

~ Generic Processes: Scanned in 00mn 00s

---\\ Estatuto dos ficheiros ocultos (Oculto/Total)

~ Mes images (My Pictures) : 1/6335

~ Mes musiques (My Musics) : 1/3547

~ Mes Videos (My Videos) : 1/746

~ Mes Favoris (My Favorites) : 1/26

~ Mes Documents (My Documents) : 1/17518

~ Mon Bureau (My Desktop) : 1/32

~ Menu demarrer (Programs) : 1/34

~ Hidden Files: Scanned in 00mn 16s

---\\ Processos lançados

[MD5.641423D0101E1F8742B2F8D08833C614] - (.AMD - HydraDM.) -- C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [385024] [PID.2612]

[MD5.A005676B30AEB3C7703C317D992B193A] - (.Intel Corporation - Intel® USB 3.0 Monitor.) -- C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648] [PID.3532]

[MD5.636D97B3BAF854511FF3F4093E895FED] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [863184] [PID.4536]

[MD5.3E02FD57FDAF184A15CCAD9D9BD9C626] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8263680] [PID.1136]

[MD5.82699E5EDE403F59FC4384D39EB77B52] - (.Enigma Software Group USA, LLC. - Service scanner interface.) -- C:\Program Files (x86)\Enigma Software Group\SpyHunter\SH4Service.exe [327064] [PID.0] =>Crapware.SpyHunter

[MD5.4F0F3FDE7F571531B356B8BAB55DDF05] - (.Intel Corporation - Intel® Dynamic Application Loader Host In.) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [166720] [PID.2032]

[MD5.3A2E85F7D90D15460C337CE80C2E3B29] - (...) -- C:\Windows\SysWOW64\PnkBstrA.exe [76888] [PID.1952]

[MD5.543A4EF0923BF70D126625B034EF25AF] - (.Protexis Inc. - PsiService PsiService.) -- C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe [189728] [PID.2144]

[MD5.32BB92C41C73D0213B417AAEF83E3D30] - (.Intel Corporation - Local Manageability Service.) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe [277824] [PID.3584]

[MD5.B89514A95A9D435EB974EA22153BB9FF] - (.Intel Corporation - User Notification Service.) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [365376] [PID.2672]

~ Processes Running: Scanned in 00mn 00s

---\\ Google Chrome, Arranque,Pesquisa,Extensões (G0,G1,G2)

C:\Users\Junior\AppData\Local\Google\Chrome\User Data\Default\Preferences

G2 - GCE: Preference [user Data\Default] [ahfgeienlihckogmohjhadlkjgocpleb] Loja v.0.2 (Activé)

G2 - GCE: Preference [user Data\Default] [dchlnpcodkpfdpacogkljefecpegganj] Conselheiro de URLs da Kaspersky v.12.0.0.477 (Désactivé)

G2 - GCE: Preference [user Data\Default] [jagncdcchgajhfhijbbhecadmaiegcmh] Teclado virtual v.12.0.0.477 (Activé)

G2 - GCE: Preference [user Data\Default] [kigfdicgjnpjkhbnngdfgjfffmdaonfg] Hatsune Miku v.2 (Activé)

G2 - GCE: Preference [user Data\Default] [mdebcffgnijbblbinknkbefciofebcda] uTorrentBar_PT v.10.22.3.18, (Désactivé) =>P2P.µTorrent

G2 - GCE: Preference [user Data\Default] [pjldcfjmnllhmgjclecdnfampinooman] Anti-Banner v.12.0.0.374 (Activé)

~ Google Browser: 19 Legitimates Filtered in 00mn 06s

---\\ Internet Explorer, Arranque, Pesquisa, URLSearchHook( gancho de URL), Phishing (R0,R1,R3,R4)

R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = preserve

~ IE Browser: 16 Legitimates Filtered in 00mn 00s

---\\ Internet Explorer, Gestão do Proxy (R5)

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local>

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 1

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll

~ Proxy management: Scanned in 00mn 00s

---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas

F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,

F2 - REG:system.ini: Shell=C:\Windows\explorer.exe

F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe

~ Keys: Scanned in 00mn 00s

---\\ Redireção do ficheiro Hosts (01)

~ Le fichier hosts est sain (The hosts file is clean).

~ Hosts File: Scanned in 00mn 00s

~ Nombre de lignes (Lines number): 26

---\\ Barras do Internet Explorer (03))

O3 - Toolbar\WebBrowser: (no name) [64Bits] - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Chave orfã

~ Toolbar: Scanned in 00mn 00s

---\\ Outras conexões do utilizador (04)

O4 - GS\QuickLaunch [Junior]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

O4 - GS\QuickLaunch [Junior]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe

O4 - GS\TaskBar [Junior]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

O4 - GS\Program [Junior]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe

O4 - GS\SystemTools [Junior]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe

~ Global Startup: 46 Legitimates Filtered in 00mn 00s

---\\ Aplicações iniciadas por registo & pastas (04)

O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gerenciador de áudio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

O4 - HKCU\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe

O4 - HKCU\..\Run: [HydraVisionDesktopManager] . (.AMD - HydraDM.) -- C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

O4 - HKCU\..\Run: [AlcoholAutomount] . (.Alcohol Soft Development Team - Alcohol Virtual Drive Auto-mount Service.) -- C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe

O4 - HKLM\..\Wow6432Node\Run: [AVP] . (.Kaspersky Lab ZAO - Kaspersky Anti-Virus.) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe

O4 - HKLM\..\Wow6432Node\Run: [uSB3MON] . (.Intel Corporation - Intel® USB 3.0 Monitor.) -- C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

O4 - HKLM\..\Wow6432Node\Run: [startCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe =>.Advanced Micro Devices, Inc

O4 - HKLM\..\Wow6432Node\Run: [iMSS] . (.Intel Corporation - PIcon startup utility.) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe

O4 - HKLM\..\Wow6432Node\Run: [bCSSync] . (.Microsoft Corporation - Microsoft Office 2010 component.) -- C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe =>.Microsoft Corporation

O4 - HKUS\S-1-5-21-402139107-1250626131-2620177682-1000\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe

O4 - HKUS\S-1-5-21-402139107-1250626131-2620177682-1000\..\Run: [HydraVisionDesktopManager] . (.AMD - HydraDM.) -- C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

O4 - HKUS\S-1-5-21-402139107-1250626131-2620177682-1000\..\Run: [AlcoholAutomount] . (.Alcohol Soft Development Team - Alcohol Virtual Drive Auto-mount Service.) -- C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe

~ Application: Scanned in 00mn 00s

---\\ Boutões da barra de ferramentas principal do Internet Explorer (09)

O9 - Extra button: &Enviar para o OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} -- C:\Program Files (x86)\MICROS~2\Office14\ONBttnIE.dll (.not file.)

O9 - Extra button: &Teclado Virtual [64Bits] - {4248FE82-7FCB-46AC-B270-339F08212110} . (...) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\kbrd.ico

O9 - Extra button: &Anotações Vinculadas do OneNote [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} -- C:\Program Files (x86)\MICROS~2\Office14\ONBTTN~1.dll (.not file.)

O9 - Extra button: Veri&ficação de URLs [64Bits] - {CCF151D8-D089-449F-A5A4-D9909053F20F} . (...) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\logo.ico

~ IE Extra Buttons: Scanned in 00mn 00s

---\\ Alteração Dominio/Clientes DNS (017)

O17 - HKLM\System\CCS\Services\Tcpip\..\{4B13D054-D593-47EB-84AE-E0851D76DD73}: DhcpNameServer = 192.168.1.1 192.168.1.1

O17 - HKLM\System\CS1\Services\Tcpip\..\{4B13D054-D593-47EB-84AE-E0851D76DD73}: DhcpNameServer = 192.168.1.1 192.168.1.1

O17 - HKLM\System\CS2\Services\Tcpip\..\{4B13D054-D593-47EB-84AE-E0851D76DD73}: DhcpNameServer = 192.168.1.1 192.168.1.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1

~ Domain: Scanned in 00mn 00s

---\\ Protocolo adicional (018)

O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visualizador de HTML da Microsoft ®.) -- C:\Windows\System32\mshtml.dll

O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation

~ Protocole Additionnel: Scanned in 00mn 00s

---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)

O20 - Winlogon Notify: klogon . (.Kaspersky Lab ZAO - Logon Visualizer.) -- C:\Windows\System32\klogon.dll

~ Winlogon: Scanned in 00mn 00s

---\\ Tarefas planificadas automaticamente (039)

[MD5.00000000000000000000000000000000] [APT] [{1E32D69B-B633-45BF-AF6D-FF6E12CAAB46}] (...) -- C:\Program Files (x86)\Activision\Arquivos Extras OPS II-Sandro Schulzer\Atualizador do directx-9e10.exe (.not file.) [0]

[MD5.00000000000000000000000000000000] [APT] [{1FC6B0A4-C8DA-46EC-A9B0-7F75501FB588}] (...) -- D:\Setup.exe (.not file.) [0]

~ Scheduled Task: 19 Legitimates Filtered in 00mn 01s

---\\ Software instalados (042)

O42 - Logiciel: CDB Ops II-Singleplayer, Multiplayer e Zombies - (.Sandro-software.) [HKLM][64Bits] -- CDB Ops II-Singleplayer, Multiplayer e Zombies

O42 - Logiciel: Licensing Service (03000201) - (.Protexis Inc..) [HKLM][64Bits] -- {9F9C5C18-9665-41EC-A660-5A3BA213CA1D}

~ Logic: 5 Legitimates Filtered in 00mn 00s

---\\ HKCU & HKLM Software Keys

[HKCU\Software\ARAR]

[HKCU\Software\Conduit] =>Toolbar.Conduit

[HKLM\Software\Wow6432Node\Conduit] =>Toolbar.Conduit

~ Key Software: 199 Legitimates Filtered in 00mn 00s

---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43)

O43 - CFD: 27/11/2013 - 09:56:33 - [23,633] ----D C:\Program Files (x86)\BIBLÍA II

O43 - CFD: 25/11/2013 - 15:58:09 - [0] -SH-D C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}

O43 - CFD: 25/11/2013 - 18:50:16 - [0,185] ----D C:\Users\Junior\AppData\Local\WhiteListing

O43 - CFD: 29/11/2013 - 15:54:32 - [0,003] ----D C:\Users\Junior\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter =>Crapware.SpyHunter

~ Program Folder: 144 Legitimates Filtered in 00mn 15s

---\\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044)

O44 - LFC:[MD5.B14E11C246D49EC9D5AB8B46576386FB] - 02/12/2013 - 09:39:23 ---A- . (...) -- C:\Windows\SysNative\prfc0416.dat [147638]

O44 - LFC:[MD5.DE3C48F397C361F338EDF7278E1AE4F6] - 02/12/2013 - 09:39:23 ---A- . (...) -- C:\Windows\SysNative\prfh0416.dat [705798]

O44 - LFC:[MD5.B14E11C246D49EC9D5AB8B46576386FB] - 02/12/2013 - 09:39:23 ---A- . (...) -- C:\Windows\System32\prfc0416.dat [147638]

O44 - LFC:[MD5.DE3C48F397C361F338EDF7278E1AE4F6] - 02/12/2013 - 09:39:23 ---A- . (...) -- C:\Windows\System32\prfh0416.dat [705798]

O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 25/11/2013 - 13:17:43 ---A- . (...) -- C:\Windows\Gcli.txt [0]

O44 - LFC:[MD5.29F72A301532E1E248FA6B78C30CE6D9] - 25/11/2013 - 13:17:43 ---A- . (...) -- C:\Windows\cli.bat [27]

O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 25/11/2013 - 14:19:52 ---A- . (...) -- C:\Windows\ativpsrm.bin [0]

O44 - LFC:[MD5.66047A9C4A04C74B5803FA3DBC00E973] - 25/11/2013 - 14:35:09 ---A- . (...) -- C:\Windows\System32\Drivers\klick.dat [107384]

O44 - LFC:[MD5.D9444B09B7469AF32430ED0C1E578131] - 25/11/2013 - 14:35:09 ---A- . (...) -- C:\Windows\System32\Drivers\klin.dat [153053]

O44 - LFC:[MD5.8B138ED363128BFF2C2E1E7FEA9793B4] - 25/11/2013 - 17:01:56 ---A- . (...) -- C:\Windows\avisplitter.ini [38]

O44 - LFC:[MD5.2465EBC8CD6E412CDC1AB9FEF40BCAE6] - 26/11/2013 - 03:02:34 ---A- . (...) -- C:\Windows\win.ini [478]

O44 - LFC:[MD5.F862CD08F1AD4EE39BD506853F3C6103] - 26/11/2013 - 07:19:34 ---A- . (...) -- C:\Windows\SysNative\ieuinit.inf [16284]

O44 - LFC:[MD5.F862CD08F1AD4EE39BD506853F3C6103] - 26/11/2013 - 07:19:34 ---A- . (...) -- C:\Windows\System32\ieuinit.inf [16284]

O44 - LFC:[MD5.621B0EAB0C2E96B618C7536C641F539B] - 27/11/2013 - 11:07:01 ---A- . (...) -- C:\Windows\SysNative\ASOROSet.bin [1660]

O44 - LFC:[MD5.621B0EAB0C2E96B618C7536C641F539B] - 27/11/2013 - 11:07:01 ---A- . (...) -- C:\Windows\System32\ASOROSet.bin [1660]

O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 28/11/2013 - 09:24:11 ---A- . (...) -- C:\autoexec.bat [0]

O44 - LFC:[MD5.0277C027A26428DB64EF4F64F52BB4FD] - 29/11/2013 - 12:04:30 ---A- . (...) -- C:\Windows\MBR.exe [208896]

O44 - LFC:[MD5.F042EE4C8D66248D9B86DCF52ABAE416] - 29/11/2013 - 12:04:30 ---A- . (...) -- C:\Windows\PEV.exe [256000]

O44 - LFC:[MD5.9E05A9C264C8A908A8E79450FCBFF047] - 29/11/2013 - 12:04:30 ---A- . (...) -- C:\Windows\grep.exe [80412]

O44 - LFC:[MD5.2B657A67AEBB84AEA5632C53E61E23BF] - 29/11/2013 - 12:04:30 ---A- . (...) -- C:\Windows\sed.exe [98816]

O44 - LFC:[MD5.5E832F4FAF5F481F2EAF3B3A48F603B8] - 29/11/2013 - 12:04:30 ---A- . (...) -- C:\Windows\zip.exe [68096]

O44 - LFC:[MD5.3CF3D4A45CC2AF973DBC30EC8D33252B] - 29/11/2013 - 12:08:49 ---A- . (...) -- C:\Windows\system.ini [215]

O44 - LFC:[MD5.D1E75542EC8D1B4851765A57AC63618E] - 29/11/2013 - 14:01:53 ---A- . (...) -- C:\Windows\diagerr.xml [1908]

O44 - LFC:[MD5.57F29D882C9CE3EB36C315001B4F50F7] - 29/11/2013 - 14:01:53 ---A- . (...) -- C:\Windows\diagwrn.xml [3543]

~ Files: 850 Legitimates Filtered in 00mn 17s

---\\ Operações e funções ao arranque do Windows Explorer (046)

O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook [64Bits] - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL

~ ShellExecuteHooks: Scanned in 00mn 00s

---\\ Enumeração das chaves do registo PoliciesSystem (MWPS) (O55)

O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0

O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0

~ MWPS: 17 Legitimates Filtered in 00mn 00s

---\\ Lista dos drivers do sistema (SDL) (O58)

O58 - SDL:[MD5.CC19A6452BA688EA32D14D8DBEC190F4] - 25/10/2012 - 09:01:20 ---A- . (...) -- C:\Windows\System32\Drivers\AppleCharger.sys [22680]

O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 13/07/2009 - 22:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]

O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 17:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]

O58 - SDL:[MD5.74D30C2EF66C2EB19F17ED5423AA8038] - 27/11/2013 - 11:00:59 ---A- . (.Duplex Secure Ltd. - SCSI Pass Through Direct Host.) -- C:\Windows\System32\Drivers\sptd.sys [386680]

O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 13/07/2009 - 22:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]

~ Drivers: 17 Legitimates Filtered in 00mn 02s

---\\ Lista das ferramentas de remoção de vírus (LAT) (063)

O63 - Logiciel: ZHPDiag 2013 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman

~ ADS: Scanned in 00mn 00s

---\\ Lista dos serviços Legacy du registo (064)

O64 - Services: CurCS - 25/10/2012 - C:\Windows\System32\DRIVERS\AppleCharger.sys (AppleCharger) .(...) - LEGACY_APPLECHARGER

O64 - Services: CurCS - 10/06/2009 - C:\Windows\System32\Drivers\secdrv.sys (secdrv) .(.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) - LEGACY_SECDRV

~ Legacy: 120 Legitimates Filtered in 00mn 00s

---\\ Associações Shell Spawning (O67)

O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)

~ FASS Keys: 11 Legitimates Filtered in 00mn 00s

---\\ Menu de inicialização Internet (068)

O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe

~ Keys: Scanned in 00mn 00s

---\\ Pesquisa de infeção nos navegadores da Internet (SBI) (069)

O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} [DefaultScope] - (Bing) - http://www.bing.com

~ Keys: Scanned in 00mn 00s

---\\ Pesquisa adicional à raiz do sistema (radicular) (SPRF) (O84)

[MD5.4463237EDF6844EDA2EA819DB23EDFA1] [sPRF][26/11/2013] (...) -- C:\Users\Junior\AppData\Local\Temp\Uninstall.exe [323397]

[MD5.C82AB54C276A1734876D911EC622A7C2] [sPRF][25/11/2013] (...) -- C:\Users\Junior\AppData\Local\Temp\utt9A5C.tmp.bat [53]

~ Files: 5 Legitimates Filtered in 00mn 00s

---\\ Listagem dos códigos dos software (PUC) (090)

O90 - PUC: "8A7CD1B695B04C548963CA2C5461A11E" . (.EZSetup B12.1121.1.) -- C:\Windows\Installer\{6B1DC7A8-0B59-45C4-9836-ACC245161AE1}\ARPPRODUCTICON.exe

~ Update Products: 103 Legitimates Filtered in 00mn 00s

---\\ Listagem dos dados da chave NameSpace (MNS) (O92)

O92 - MNS: Pasta compartilhada da Execução Segura - {047DDC7E-F9C2-11DD-A093-79D855D89593}

~ MNS: 1 Legitimates Filtered in 00mn 00s

---\\ Pesquisa dos pacotes WindowsInstaller (WIS) (O93) (NTFS)

[MD5.F15D6650FD72D1C0987288B3A03BDB49] [WIS][10/03/2010] (.Protexis Inc. - Licensing Service (03000201).) -- C:\Windows\Installer\c69bc9.msi [849408]

~ WIS: 104 Legitimates Filtered in 00mn 07s

---\\ Estado general dos serviços não Microsoft (EGS) (SR=Executados, SS=Parados)

SS - | Demand 29/11/2013 257416 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

SS - | Demand 06/04/2010 31272 | (AppleChargerSrv) . (...) - C:\Windows\System32\AppleChargerSrv.exe

SS - | Auto 25/11/2013 206448 | (AVP) . (.Kaspersky Lab ZAO.) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe

SS - | Auto 05/01/2012 75624 | (AxAutoMntSrv) . (.Alcohol Soft Development Team.) - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe

SS - | Auto 31/01/2012 136176 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

SS - | Demand 31/01/2012 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

SS - | Disabled 30/08/2011 160256 | (ICCS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe

SS - | Demand 04/04/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

SS - | Disabled 10/07/1658 0 | (StarWindServiceAE) . (...) - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

SS - | Demand 30/10/2013 566696 | (Steam Client Service) . (.Valve Corporation.) - C:\Program Files (x86)\Common Files\Steam\SteamService.exe

SS - | Demand 13/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

SS - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation

SR - | Auto 08/10/2013 239616 | (AMD External Events Utility) . (.AMD.) - C:\Windows\System32\atiesrxx.exe

SR - | Auto 19/06/2012 634632 | (Intel® Capability Licensing Service Interface) . (.Intel® Corporation.) - C:\Program Files\Intel\iCLS Client\HeciServer.exe

SR - | Auto 05/07/2012 166720 | (jhi_service) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

SR - | Auto 19/07/2012 277824 | (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

SR - | Auto 10/07/1658 0 | (PnkBstrA) . (...) - C:\Windows\system32\PnkBstrA.exe

SR - | Auto 10/03/2010 189728 | (PSI_SVC_2) . (.Protexis Inc..) - C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

SR - | Auto 30/11/2010 336824 | (PSI_SVC_2_x64) . (.arvato digital services llc.) - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

SR - | Auto 18/05/2010 327064 | (SpyHunter 4 Service) . (.Enigma Software Group USA, LLC..) - C:\Program Files (x86)\Enigma Software Group\SpyHunter\SH4Service.exe =>Crapware.SpyHunter

SR - | Auto 30/08/2013 2100024 | (TuneUp.UtilitiesSvc) . (.TuneUp Software.) - C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe

SR - | Auto 19/07/2012 365376 | (UNS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

SR - | Auto 13/07/2009 27136 | C:\Windows\System32\uxtuneup.dll (UxTuneUp) . (.TuneUp Software.) - C:\Windows\System32\svchost.exe

SR - | Auto 13/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

~ Services: Scanned in 00mn 08s

---\\ Lista dos emuladores de CD/DVD (MBR Hook)

O58 - SDL:[MD5.74D30C2EF66C2EB19F17ED5423AA8038] - 27/11/2013 - 11:00:59 ---A- . (.Duplex Secure Ltd. - SCSI Pass Through Direct Host.) -- C:\Windows\System32\Drivers\sptd.sys [386680]

~ Emulateurs: Scanned in 00mn 08s

---\\ Scâner Aditional (088)

Database Version : 13007 - (01/12/2013)

Clés trouvées (Keys found) : 3

Valeurs trouvées (Values found) : 0

Dossiers trouvés (Folders found) : 2

Fichiers trouvés (Files found) : 4

[HKLM\Software\Google\Chrome\Extensions\mdebcffgnijbblbinknkbefciofebcda] =>P2P.µTorrent^

[HKLM\Software\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}] =>Toolbar.Ask

[HKLM\SYSTEM\CurrentControlSet\Services\SpyHunter 4 Service] =>Crapware.SpyHunter

C:\Users\Junior\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdebcffgnijbblbinknkbefciofebcda =>P2P.µTorrent^

C:\Users\Junior\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter =>Crapware.SpyHunter^

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: Modified =>Hijacker.Application^

C:\Program Files (x86)\Enigma Software Group\SpyHunter\SH4Service.exe =>Crapware.SpyHunter^

[HKCU\Software\Conduit] =>Toolbar.Conduit^

[HKLM\Software\Wow6432Node\Conduit] =>Toolbar.Conduit^

~ Additionnel Scan: 241212 Items scanned in 00mn 11s

---\\ Sumário das deteções encontradas na sua estação

~ http://nicolascoolman.webs.com/apps/blog/show/26609241-crapware-spyhunter =>Crapware.SpyHunter

~ http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit =>Toolbar.Conduit

~ http://nicolascoolman.webs.com/apps/blog/show/28927746-toolbar-ask =>Toolbar.Ask

~ MSI: 3 link(s) detected in 00mn 11s

~ 1856 Legitimates filtered by white list

End of the scan (443 lines in 01mn 40s)(0)

[DigRam 144]

Boa Noite! Junior Travassos

 

|- Copie estas informações,logo abaixo,para o Bloco de Notas.
|- Estando com o Bloco de Notas aberto,execute: ctrl+a >> ctrl+c

 

script zhpfix
O3 - Toolbar\WebBrowser: (no name) [64Bits] - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Chave orfã
[MD5.00000000000000000000000000000000] [APT] [{1E32D69B-B633-45BF-AF6D-FF6E12CAAB46}] (...) -- C:\Program Files (x86)\Activision\Arquivos Extras OPS II-Sandro Schulzer\Atualizador do directx-9e10.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{1FC6B0A4-C8DA-46EC-A9B0-7F75501FB588}] (...) -- D:\Setup.exe (.not file.) [0]
[HKLM\Software\Google\Chrome\Extensions\mdebcffgnijbblbinknkbefciofebcda] =>P2P.µTorrent^
[HKLM\Software\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}] =>Toolbar.Ask
[HKLM\SYSTEM\CurrentControlSet\Services\SpyHunter 4 Service] =>Crapware.SpyHunter
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: Modified =>Hijacker.Application^
[HKCU\Software\Conduit] =>Toolbar.Conduit^
[HKLM\Software\Wow6432Node\Conduit] =>Toolbar.Conduit^

C:\Users\Junior\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdebcffgnijbblbinknkbefciofebcda =>P2P.µTorrent^
C:\Users\Junior\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter =>Crapware.SpyHunter^
C:\Program Files (x86)\Enigma Software Group\SpyHunter\SH4Service.exe =>Crapware.SpyHunter^

emptytemp
emptyflash
emptyclsid
firewallraz
sysrestore

 

|- Execute ZHPFix >> Clique: IMPORTAÇÃO >> OK.
|- Clique "GO".
|- Poste o relatório!

 

A+

[Junior Travassos 0]

Boa noite Sr. Dig ram

 

Segue o relatorio do ZHPFix

 

 

 

Rapport de ZHPFix 2013.12.1.2 par Nicolas Coolman, Update du 01/12/2013

Fichier d'export Registre :

Run by Junior at 02/12/2013 18:12:41

High Elevated Privileges : OK

Windows 7 Ultimate Edition, 64-bit Service Pack 1 (Build 7601)

Reciclagem vazia (00mn 05s)

========== Processo memória ==========

ELIMINA REINICIAR: Memory Process: C:\Program Files (x86)\Enigma Software Group\SpyHunter\SH4Service.exe

========== Chaves do Registo ==========

ELIMINÉ: HKLM\Software\Wow6432Node\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

ELIMINÉ: HKLM\SYSTEM\CurrentControlSet\Services\SpyHunter 4 Service

ELIMINÉ: HKCU\Software\Conduit

ELIMINÉ: HKLM\Software\Wow6432Node\Conduit

========== Valores do Registo ==========

ELIMINÉ: Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F}

Ausente Valor Perfil Padrão: FirewallRaz :

Ausente Valor Perfil Domínio FirewallRaz :

========== Elementos dos dados do Registo ==========

ELIMINÉ Explorer Association Data Application: http://www.filefacts.net/redirect.php?ext=%s

========== Pastas ==========

Nenhuma pasta CLSID local utilizador vazia

========== Ficheiros ==========

ELIMINÉ Temporários windows (20) (3.021.836 octets)

ELIMINÉ Flash Cookies (0) (0 octets)

========== Tarefa planificada ==========

ELIMINÉ: {1E32D69B-B633-45BF-AF6D-FF6E12CAAB46}

ELIMINÉ: {1FC6B0A4-C8DA-46EC-A9B0-7F75501FB588}

========== Restauração Sistema ==========

Ponto de restauro do sistema criado com sucesso

========== Recapitulativo ==========

1 : Processo memória

4 : Chaves do Registo

3 : Valores do Registo

1 : Elementos dos dados do Registo

1 : Pastas

2 : Ficheiros

2 : Tarefa planificada

1 : Restauração Sistema

End of clean in 01mn 17s

========== Caminho do ficheiro do relatório ==========

C:\Users\Junior\AppData\Roaming\ZHP\ZHPFix[R1].txt - 02/12/2013 18:12:46 [1786]

[DigRam 144]

Boa Noite! Junior Travassos

 

|- Baixe: < > ( ... par Xplode )

|- Ao acessar,clique na imagem: < >

 

|- Ps: Se utilizar o navegador IE9,desabilite o filtro "SmartScreen".
|- Salve-o no desktop!
|- Clique direito em adwcleaner.exe,e escolha sua execução como

 

 

|- Ps: Dê início ao scan,clicando em "Examinar".
|- Ao concluir,clique "Limpar" >> Ok >> Ok >> Ok.
|- Copie o log ou clique "Relatório".
|- Poste: < C:\AdwCleaner\AdwCleaner[s0].txt >

 

Abs!

[Junior Travassos 0]

Boa tarde

 

Sr. Dig ram

 

 

Mais uma vez agradeço a atenção que o senhor esta dispensando nesse meu caso,

fiz todos os procedimentos que o senhor me informou.

 

Segue o log do adware

 

 

 

# AdwCleaner v3.014 - Relatório criado 04/12/2013 às 11:57:36
# Atualizado 01/12/2013 por Xplode
# Sistema Operacional : Windows 7 Ultimate Service Pack 1 (64 bits)
# Usuário : Junior - JUNIOR-PC
# Executando de : C:\Users\Junior\Desktop\adwcleaner.exe
# Opção : Limpar

***** [ Serviços ] *****

***** [ Arquivos / Pastas ] *****

Pasta Deletada : C:\Users\Junior\AppData\Local\NativeMessaging
Pasta Deletada : C:\Users\Junior\AppData\Local\WhiteListing
Arquivo Deletada : C:\Windows\System32\roboot64.exe

***** [ Atalhos ] *****

***** [ Registro ] *****

Chave Deletedo : HKCU\Software\AppDataLow\Software\Conduit
Chave Deletedo : HKCU\Software\AppDataLow\Software\SmartBar
Chave Deletedo : HKLM\Software\systweak

***** [ Navegadores ] *****

-\\ Internet Explorer v11.0.9600.16428

*************************

AdwCleaner[R0].txt - [998 octets] - [04/12/2013 11:56:48]
AdwCleaner[s0].txt - [909 octets] - [04/12/2013 11:57:36]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [968 octets] ##########

[DigRam 144]

Boa Noite! Junior Travassos

|- Baixe: < zoek > ( ... by Smeenk )

|- Ou aqui! < zoek.exe >

|- Salve-o e descompacte-o para o desktop!

|- Estarão disponíveis: zoek.com, zoek.scr, zoek.pif e zoek.exe

|- Desabilite seu antivírus!

|- Para Windows 7,execute zoek.exe como administrador.

emptyalltemp;

hijackthis;

iedefaults;

chromelook;

autoclean;

|- Copie e cole estas informações,em vermelho,no campo da ferramenta.

|- Clique "Run Script".

 

Zoek.exe is running now.

Do not start any browser windows, they will be closed automatically.

Please wait! This window will close when finished.

A logfile will open afterwards and can also be found on your systemdrive as zoek-results.log

|- Surgirão estas informações,pedindo-lhe que aguarde o surgimento do relatório.

|- Ps: Essas informações,podem permanecer estáticas na tela por 20 minutos ou mais.

|- Aceite e/ou confirme o reboot!

zoek.hta failed by unknown error.

Restart computer, and try again.

 

|- Ps: Ao obter algum erro,reinicie o PC e execute,novamente,a ferramenta.

|- Poste o relatório,que estará em C:\zoek-results.txt <<

Abs!

[DigRam 144]

Tópico Arquivado

 

Como o autor não respondeu por mais de 10 dias, o tópico foi arquivado.

 

Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura.