Ionara 2 Denunciar post Postado Fevereiro 20, 2014 Logfile of Trend Micro HijackThis v2.0.4Scan saved at 13:50:03, on 20/2/2014Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\ARQUIV~1\GbPlugin\GbpSv.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Arquivos de programas\AVAST Software\Avast\AvastSvc.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\svchost.exeC:\Arquivos de programas\Java\jre7\bin\jqs.exeC:\WINDOWS\system32\svchost.exeC:\Arquivos de programas\TeamViewer\Version8\TeamViewer_Service.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\alg.exeC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\system32\svchost.exeC:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exeC:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exeC:\Arquivos de programas\AVAST Software\Avast\AvastUI.exeC:\WINDOWS\system32\ctfmon.exeC:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\WINDOWS\system32\wbem\wmiapsrv.exeC:\Arquivos de programas\Nokia\Nokia Suite\NokiaSuite.exeC:\Arquivos de programas\PC Connectivity Solution\ServiceLayer.exeC:\Arquivos de programas\PC Connectivity Solution\Transports\NclUSBSrv.exeC:\Arquivos de programas\PC Connectivity Solution\Transports\NclMSBTSrv.exeC:\Arquivos de programas\Mozilla Firefox\firefox.exeC:\Arquivos de programas\internet explorer\iexplore.exeC:\Arquivos de programas\internet explorer\iexplore.exeC:\Arquivos de programas\internet explorer\iexplore.exeC:\WINDOWS\system32\msiexec.exeC:\Arquivos de programas\Trend Micro\HiJackThis\HiJackThis.exeC:\WINDOWS\system32\wbem\wmiprvse.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.7.5:3128R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.7.5O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dllO2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre7\bin\ssv.dllO2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Arquivos de programas\AVAST Software\Avast\aswWebRepIE.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dllO2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\ARQUIVOS DE PROGRAMAS\GBPLUGIN\gbieh.dllO2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\ARQUIVOS DE PROGRAMAS\GBPLUGIN\gbiehcef.dllO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre7\bin\jp2ssv.dllO3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dllO3 - Toolbar: avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Arquivos de programas\AVAST Software\Avast\aswWebRepIE.dllO4 - HKLM\..\Run: [PPort11reminder] "C:\Arquivos de programas\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Dados de aplicativos\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe"O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe"O4 - HKLM\..\Run: [AvastUI.exe] "C:\Arquivos de programas\AVAST Software\Avast\AvastUI.exe" /noguiO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [swg] "C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"O4 - HKCU\..\Run: [NokiaSuite.exe] C:\Arquivos de programas\Nokia\Nokia Suite\NokiaSuite.exe -trayO4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLLO9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Documents and Settings\estacao10\Meus documentos\LEANDRO\ARTIGOS\PartyPoker\RunApp.exe (file missing)O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Documents and Settings\estacao10\Meus documentos\LEANDRO\ARTIGOS\PartyPoker\RunApp.exe (file missing)O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exeO14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.aspO15 - Trusted Zone: http://azt.aids.gov.brO15 - Trusted Zone: http://siclom2.aids.gov.brO15 - Trusted Zone: www.bancobrasil.com.brO15 - Trusted Zone: www14.bancobrasil.com.brO15 - Trusted Zone: www2.bancobrasil.com.brO15 - Trusted Zone: www.bb.com.brO15 - Trusted Zone: http://www.clicrbs.com.brO16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabO16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabO18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dllO20 - Winlogon Notify: GbPluginBb - C:\Arquivos de programas\GbPlugin\gbieh.dllO20 - Winlogon Notify: GbPluginCef - C:\ARQUIVOS DE PROGRAMAS\GBPLUGIN\gbiehcef.dllO22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dllO22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dllO23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exeO23 - Service: avast! Antivirus - AVAST Software - C:\Arquivos de programas\AVAST Software\Avast\AvastSvc.exeO23 - Service: Gbp Service (GbpSv) - GAS Tecnologia - C:\ARQUIV~1\GbPlugin\GbpSv.exeO23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exeO23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exeO23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: Installer Service - Unknown owner - C:\Documents and Settings\All Users\Dados de aplicativos\NokiaInstallerCache\ProductCache\{D5878294-C113-43c5-A24F-FC333C52015A}\{EDB188F5-D8E8-42EE-89E0-F212DA48CB81}\Installer\InstallerService.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Arquivos de programas\Java\jre7\bin\jqs.exeO23 - Service: ServiceLayer - Nokia - C:\Arquivos de programas\PC Connectivity Solution\ServiceLayer.exeO23 - Service: TeamViewer 8 (TeamViewer8) - TeamViewer GmbH - C:\Arquivos de programas\TeamViewer\Version8\TeamViewer_Service.exe --End of file - 9503 bytes Os navegadores estão lentos, travando, segue log do hijackthis Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Fevereiro 20, 2014 Boa Noite! Ionara |- Baixe: < > ( ... par Xplode ) |- Ao acessar,clique na imagem: < > |- Ps: Se utilizar o navegador IE9,desabilite o filtro "SmartScreen". |- Salve-o no desktop! |- Para Windows 7,clique direito em adwcleaner.exe,e escolha sua execução como administrador. |- Ps: Dê início ao scan,clicando em "Examinar". |- Ao concluir,clique "Limpar" >> Ok >> Ok >> Ok. |- Copie o log ou clique "Relatório". |- Poste: < C:\AdwCleaner\AdwCleaner[s0].txt > -/- |- Baixe: < ZHPDiag2.exe > < > ( ... de Nicolas Coolman ) |- Salve-o no disco local! ( C ou D ) |- Desabilite seu antivírus e execute "ZHPDiag2.exe",para instalar a ferramenta. |- Execute o ícone do pergaminho. ( ZHPDiag ) |- Clique "SEARCH" ou "PESQUISAR" e aguarde a conclusão! |- Clique OK e,ao concluir,poste o relatório! ( ZHPDiag.txt ) |- Ps: Se o log for extenso,envie-o à Pjjoint.malekal. |- Ou acesse: < > |- Maiores informações: < |Link| > A+ Compartilhar este post Link para o post Compartilhar em outros sites
Ionara 2 Denunciar post Postado Fevereiro 24, 2014 Bom dia, seguem logs solicitados: # AdwCleaner v3.019 - Relatório criado 24/02/2014 às 07:50:41# AdwCleaner v3.019 - Relatório criado 24/02/2014 às 08:32:35# Atualizado 17/02/2014 por Xplode# Sistema Operacional : Microsoft Windows XP Service Pack 3 (32 bits)# Usuário : estacao10 - MICRO-LEANDRO# Executando de : C:\Documents and Settings\estacao10\Meus documentos\Downloads\adwcleaner.exe# Opção : Examinar***** [ Serviços ] ********** [ Arquivos / Pastas ] *****Arquivo Encontrado : C:\Documents and Settings\estacao10\Dados de aplicativos\Mozilla\Firefox\Profiles\do755vlg.default\.autoregPasta Encontrado : C:\Documents and Settings\estacao10\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\Extensions\ejnmnhkgiphcaeefbaooconkceehicfiPasta Encontrado C:\DOCUME~1\ESTACA~1\CONFIG~1\Temp\AskSearchPasta Encontrado C:\DOCUME~1\ESTACA~1\CONFIG~1\Temp\AskSearchPasta Encontrado C:\DOCUME~1\ESTACA~1\CONFIG~1\Temp\AskSearchPasta Encontrado C:\DOCUME~1\ESTACA~1\CONFIG~1\Temp\AskSearchPasta Encontrado C:\Documents and Settings\estacao10\Dados de aplicativos\thinstall***** [ Atalhos ] ********** [ Registro ] *****Chave Encontrada : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}Chave Encontrada : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}Chave Encontrada : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}Chave Encontrada : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}Chave Encontrada : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}Chave Encontrada : HKLM\SOFTWARE\Classes\protector_dll.protectorbhoChave Encontrada : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1Valor Encontrada : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]***** [ Navegadores ] *****-\\ Internet Explorer v8.0.6001.18702-\\ Mozilla Firefox v27.0.1 (pt-BR)[ Arquivo : C:\Documents and Settings\estacao10\Dados de aplicativos\Mozilla\Firefox\Profiles\do755vlg.default\prefs.js ]-\\ Google Chrome v33.0.1750.117[ Arquivo : C:\Documents and Settings\estacao10\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\preferences ]*************************AdwCleaner[R0].txt - [2398 octets] - [24/02/2014 07:50:41]AdwCleaner[R].txt - [63 octets] - [21/02/2014 16:59:50]AdwCleaner[s0].txt - [63 octets] - [24/02/2014 07:56:06]AdwCleaner.txt - [63 octets] - [21/02/2014 17:00:42]########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [2630 octets] ########## ########################################################################### ~ Relatório do ZHPDiag v2014.2.23.20 - Nicolas Coolman (23/2/2014)~ Iniciado por estacao10 (24/2/2014 08:39:36)~ Endereço do Website : http://nicolascoolman.webs.com~ Fóruns de suporte gratuito para desinfecção : http://nicolascoolman.webs.com/apps/links/~ Tradução pelo utilizador~ Estatuto da versão :~ Lista Branca : Ativado pelo programa~ Elevação dos Privilégios : OK~ Controle de Conta de Utilizador : Not Found---\\ Navegadores InternetMSIE: Internet Explorer v8.0.6001.18702 (Defaut)MFIE: Mozilla Firefox 27.0.1GCIE: Google Chrome v33.0.1750.117---\\ Informações sobre os produtos Windows~ Langage: PortugaisMicrosoft Windows XP, 32-bit Service Pack 3 (Build 2600)Windows Automatic Updates : OKWindows Genuine Advantage : OK---\\ Softwares de proteçao do sistemaavast! Free Antivirus v9.0.2011Malwarebytes Anti-Malware versão 1.75.0.1300---\\ Softwares d'optimização do sistema---\\ Softwares de partilha do PeerToPeer (P2P)---\\ Monitoramento dos softwaresAdobe Flash Player 12 PluginAdobe Reader 9.5.3 - PortuguêsJava 7 Update 25---\\ Informações sobre o sistema~ Processor: x86 Family 6 Model 15 Stepping 13, GenuineIntel~ Operating System: 32 BitsBoot mode: Normal (Normal boot)Total RAM: 1015 MB (36% free)System Restore: Activé (Enable)System drive C: has 54 GB (73%) free of 75 GB---\\ Modo de conexão ao sistema~ Computer Name: MICRO-LEANDRO~ User Name: estacao10~ All Users Names: SUPPORT_388945a0, HelpAssistant, estacao10, Convidado, Administrador,~ Unselected Option: 045,061,O62,065,066,080,O82,089Logged in as Administrator---\\ As variáveis de ambiente~ System Unit : C:\~ %AppZHP% : C:\Documents and Settings\estacao10\Dados de aplicativos\ZHP\~ %AppData% : C:\Documents and Settings\estacao10\Dados de aplicativos\~ %Desktop% : C:\Documents and Settings\estacao10\Desktop\~ %Favorites% : C:\Documents and Settings\estacao10\Favoritos\~ %LocalAppData% : C:\Documents and Settings\estacao10\Configurações locais\Dados de aplicativos\~ %StartMenu% : C:\Documents and Settings\estacao10\Menu Iniciar\~ %Windir% : C:\WINDOWS\~ %System% : C:\WINDOWS\system32\---\\ Enumeração das unidades dos discosC: Hard drive, Flash drive, Thumb drive (Free 54 Go of 75 Go)D: CD-ROM drive (Not Inserted)---\\ Estado do Centro de Segurança do Windows[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date~ Security Center: 44 Legitimates Filtered in 00mn 00s---\\ Pesquisa particular de ficheiros genéricos[MD5.064EC7FF5F58B928C3E119402977FA6D] - (.Microsoft Corporation - Windows Explorer.) (.13/4/2008 - 23:20:58.) -- C:\WINDOWS\Explorer.exe [1035776][MD5.E3CA7B02DE162AE351160FB552E9EC3C] - (.Microsoft Corporation - Internet Extensions for Win32.) (.29/10/2013 - 04:44:53.) -- C:\WINDOWS\system32\wininet.dll [920064][MD5.71D440F79B711627B12B567FB2EADB42] - (.Microsoft Corporation - Aplicativo de logon do Windows NT.) (.13/4/2008 - 23:21:23.) -- C:\WINDOWS\system32\Winlogon.exe [509952][MD5.1E44BC1E83D8FD2305F8D452DB109CF9] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.17/8/2011 - 10:49:54.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496][MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.13/4/2008 - 15:40:30.) -- C:\WINDOWS\system32\Drivers\atapi.sys [96512][MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/4/2008 - 16:14:21.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744][MD5.1F4260CC5B42272D71F79E570A27A4FE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.13/4/2008 - 15:40:46.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [62976][MD5.A8D31E836CCF2F51009CE7DFFECF6D51] - (.Microsoft Corporation - FIPS Crypto Driver.) (.13/4/2008 - 22:52:42.) -- C:\WINDOWS\system32\Drivers\Fips.sys [44672][MD5.573C7D0A32852B48F3058CFD8026F511] - (.Windows ® Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.13/4/2008 - 13:36:05.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [144384][MD5.485BC6BEB778B5E9702E6AA3D384C0CB] - (.Microsoft Corporation - Driver de porta i8042.) (.13/4/2008 - 22:55:19.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [53504][MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.13/4/2008 - 15:40:58.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [42112][MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.13/4/2008 - 15:57:15.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [152832][MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.13/4/2008 - 16:19:42.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [75264][MD5.7D304A5EB4344EBEEAB53A2FE3FFB9F0] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.15/7/2011 - 10:29:31.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [456320][MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.13/4/2008 - 16:21:00.) -- C:\WINDOWS\system32\Drivers\netBT.sys [162816][MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.13/4/2008 - 16:15:53.) -- C:\WINDOWS\system32\Drivers\ntfs.sys [574976][MD5.9BADEE6B698BF1AF36E25A1A64A89EAB] - (.Microsoft Corporation - Driver de porta paralela.) (.13/4/2008 - 23:02:24.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80384][MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13/4/2008 - 16:19:43.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328][MD5.15CABD0F7C00C47C70124907916AF3F1] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.13/4/2008 - 15:32:51.) -- C:\WINDOWS\system32\Drivers\rdpdr.sys [196224][MD5.68D749B04BFBBD4D4D15CC5185AFA4DD] - (.Microsoft Corporation - Redbook Audio Filter Driver.) (.13/4/2008 - 22:53:17.) -- C:\WINDOWS\system32\Drivers\redbook.sys [58240][MD5.EB6B1E2C984D84470FF4FE7EF98CD44A] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.13/4/2008 - 22:53:00.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [53248]~ Generic Processes: Scanned in 00mn 00s---\\ Estatuto dos ficheiros ocultos (Oculto/Total)~ Mes images (My Pictures) : 2/75~ Mes musiques (My Musics) : 2/3~ Mes Favoris (My Favorites) : 0/78~ Mes Documents (My Documents) : 2/1193~ Mon Bureau (My Desktop) : 1/40~ Menu demarrer (Programs) : 1/31~ Hidden Files: Scanned in 00mn 05s---\\ Processos lançados[MD5.DAAA237C34A506EF56D44A56EA039CC0] - (.GAS Tecnologia - G-Buster Browser Defense - Service.) -- C:\Arquivos de programas\GbPlugin\gbpsv.exe [452968] [PID.1188][MD5.D74884939D53612FD84AC82C59CCFE27] - (.AVAST Software - avast! Service.) -- C:\Arquivos de programas\AVAST Software\Avast\AvastSvc.exe [50344] [PID.1944][MD5.9ECF00E19736054E019C532AED8228FC] - (.Oracle Corporation - Java Quick Starter Service.) -- C:\Arquivos de programas\Java\jre7\bin\jqs.exe [182184] [PID.740][MD5.F67C21CC4195F6AFC447418FE163E156] - (.TeamViewer GmbH - TeamViewer 8.) -- C:\Arquivos de programas\TeamViewer\Version8\TeamViewer_Service.exe [5087584] [PID.1420][MD5.2E0B0A051FFAA86E358465BB0880D453] - (.Microsoft Corporation - Windows Update.) -- C:\WINDOWS\system32\wuauclt.exe [53784] [PID.1824][MD5.6D2018AEE93285F2A8BEF55D722187A3] - (.Microsoft Corporation - Application Layer Gateway Service.) -- C:\WINDOWS\System32\alg.exe [44544] [PID.2840][MD5.48BE298F7FD1BEF4D8FBACB04D8D95C4] - (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe [958576] [PID.572][MD5.D63797E8E7781EE1500A810CB6194FA6] - (.Oracle Corporation - Java Update Scheduler.) -- C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe [253816] [PID.728][MD5.AFEBF9E0B223FF04709F747C172D3540] - (.AVAST Software - avast! Antivirus.) -- C:\Arquivos de programas\AVAST Software\Avast\AvastUI.exe [3764024] [PID.1000][MD5.5D61BE7DB55B026A5D61A3EED09D0EAD] - (.Google Inc. - GoogleToolbarNotifier.) -- C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408] [PID.2540] =>Toolbar.Google[MD5.646A34526CC33BE4CA933C5680D80B48] - (.Nokia - Nokia Suite.) -- C:\Arquivos de programas\Nokia\Nokia Suite\NokiaSuite.exe [1090912] [PID.2792][MD5.78F7BB9F4924BE164294C59B8C3FC096] - (.Nokia - ServiceLayer Module.) -- C:\Arquivos de programas\PC Connectivity Solution\ServiceLayer.exe [737616] [PID.4040][MD5.5EBE396DB0ED20910A4C51E235539F9F] - (.Nokia - USB Media Server.) -- C:\Arquivos de programas\PC Connectivity Solution\Transports\NclUSBSrv.exe [179024] [PID.328][MD5.192FBDF64A983CAC149D47D01970CE04] - (.Nokia - Microsoft Bluetooth Media Server.) -- C:\Arquivos de programas\PC Connectivity Solution\Transports\NclMSBTSrv.exe [150864] [PID.3772][MD5.42FEDBCB3ED926F6F529E0FDDF750BE0] - (.Nicolas Coolman - ZHPDiag.) -- C:\Arquivos de programas\ZHPDiag\ZHPDiag.exe [8339968] [PID.2168]~ Processes Running: Scanned in 00mn 00s---\\ Mozilla Firefox, Plugins,Arranque,Pesquisa,Extensões (P2,M0,M1,M2,M3)P2 - FPN: [HKLM] [@nokia.com/EnablerPlugin] - (.No owner - Nokia Suite Enabler Plugin.) -- C:\Arquivos de programas\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll~ Firefox Browser: 13 Legitimates Filtered in 00mn 00s---\\ Internet Explorer, Gestão do Proxy (R5)R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.7.5R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.7.5:3128R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll~ Proxy management: Scanned in 00mn 00s---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programasF2 - REG:system.ini: USERINIT=C:\WINDOWS\system32\userinit.exe,F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exeF2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"~ Keys: Scanned in 00mn 00s---\\ Redireção do ficheiro Hosts (01)~ Le fichier hosts est sain (The hosts file is clean).~ Hosts File: Scanned in 00mn 00s~ Nombre de lignes (Lines number): 2---\\ Browser Helper Objects do navegador (02)O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} . (.Banco do Brasil - Gbieh Module.) -- C:\ARQUIVOS DE PROGRAMAS\GBPLUGIN\gbieh.dllO2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} . (.Caixa Economica Federal - Gbieh Module.) -- C:\ARQUIVOS DE PROGRAMAS\GBPLUGIN\gbiehcef.dll~ BHO: 18 Legitimates Filtered in 00mn 00s---\\ Barras do Internet Explorer (03))O3 - Toolbar: Google Toolbar - [HKLM]{2318C2B1-4965-11d4-9B18-009027A5CD4F} . (.Google Inc. - Google Toolbar.) -- C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dll =>Toolbar.GoogleO3 - Toolbar: avast! Online Security - [HKLM]{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} . (.AVAST Software - IE Webrep plugin.) -- C:\Arquivos de programas\AVAST Software\Avast\aswWebRepIE.dllO3 - Toolbar\WebBrowser: (no name) - [HKCU]{01E04581-4EEE-11D0-BFE9-00AA005B4383} Chave orfãO3 - Toolbar\WebBrowser: (no name) - [HKCU]{0E5CBF21-D15F-11D0-8301-00AA005B4383} Chave orfãO3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Chave orfã~ Toolbar: Scanned in 00mn 00s---\\ Outras conexões do utilizador (04)O4 - GS\Desktop [AllUsers]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Arquivos de programas\Google\Chrome\Application\chrome.exeO4 - GS\Desktop [AllUsers]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Arquivos de programas\Mozilla Firefox\firefox.exeO4 - GS\Desktop [AllUsers]: Sharpdesk.lnk . (.SHARP CORPORATION - Sharpdesk Desktop.) -- C:\Arquivos de programas\SHARP\Sharpdesk\SharpDesk.exeO4 - GS\Desktop [estacao10]: Calculadora.lnk . (.Microsoft Corporation - Arquivo do aplicativo 'Calculadora' do Wind.) -- C:\WINDOWS\system32\calc.exeO4 - GS\Desktop [estacao10]: Foxit PDF Editor.lnk . (.Foxit Corporation - Foxit PDF Editor, the first REAL editor for.) -- C:\Arquivos de programas\Foxit Software\PDF Editor\PDFEdit.exeO4 - GS\Desktop [estacao10]: Paciência Spider.lnk . (.Microsoft Corporation - Spider.) -- C:\WINDOWS\system32\spider.exeO4 - GS\Desktop [estacao10]: Pidgin.lnk . (.The Pidgin developer community - Pidgin.) -- C:\Arquivos de programas\Pidgin\pidgin.exeO4 - GS\Desktop [estacao10]: Servidor de Arquivos (Server06).lnk - Chave orfã~ Global Startup: 16 Legitimates Filtered in 00mn 00s---\\ Aplicações iniciadas por registo & pastas (04)O4 - HKLM\..\Run: [PPort11reminder] . (.Nuance Communications, Inc. - Ereg.) -- C:\Arquivos de programas\ScanSoft\PaperPort\Ereg\Ereg.exeO4 - HKLM\..\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exeO4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems IncorporatedO4 - HKLM\..\Run: [sunJavaUpdateSched] . (.Oracle Corporation - Java Update Scheduler.) -- C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe =>.Oracle CorporationO4 - HKLM\..\Run: [AvastUI.exe] . (.AVAST Software - avast! Antivirus.) -- C:\Arquivos de programas\AVAST Software\Avast\AvastUI.exeO4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe =>Toolbar.GoogleO4 - HKCU\..\Run: [NokiaSuite.exe] . (.Nokia - Nokia Suite.) -- C:\Arquivos de programas\Nokia\Nokia Suite\NokiaSuite.exeO4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exeO4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exeO4 - HKUS\S-1-5-21-1645522239-1078081533-682003330-1003\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exeO4 - HKUS\S-1-5-21-1645522239-1078081533-682003330-1003\..\Run: [swg] . (.Google Inc. - GoogleToolbarNotifier.) -- C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe =>Toolbar.GoogleO4 - HKUS\S-1-5-21-1645522239-1078081533-682003330-1003\..\Run: [NokiaSuite.exe] . (.Nokia - Nokia Suite.) -- C:\Arquivos de programas\Nokia\Nokia Suite\NokiaSuite.exe~ Application: Scanned in 00mn 00s---\\ Boutões da barra de ferramentas principal do Internet Explorer (09)O9 - Extra button: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft Office OneNote Internet Explorer Add-in.) -- C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Arquivos de programas\Microsoft Office\Office12\REFBARH.ICOO9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} -- C:\Documents and Settings\estacao10\Meus documentos\LEANDRO\ARTIGOS\PartyPoker\images\ppicon.ico (.not file.)O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -- Chave orfãO9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- C:\Arquivos de programas\Messenger\msmsgs.exe~ IE Extra Buttons: Scanned in 00mn 00s---\\ Piratagem da Opção " Redefinir Configurações da Web " (014)O14 - IERESET.INF: SEARCH_PAGE_URL=SEARCH_PAGE_URL="&http://home.microsoft.com/intl/br/access/allinone.asp"O14 - IERESET.INF: SAFESITE_VALUE=SAFESITE_VALUE="search.msn.com.br"~ IE Paramètres WEB: Scanned in 00mn 00s---\\ Site na zona confiavél do Internet Explorer (05)O15 - Trusted Zone: [HKCU\...\Domains\www] *.bancobrasil.com.brO15 - Trusted Zone: [HKCU\...\Domains\www] *.bb.com.brO15 - Trusted Zone: [HKCU\...\Domains\www] http.clicrbs.com.br~ IE Zone Confiance: Scanned in 00mn 00s---\\ Objets ActiveX (Downloaded Program Files)(O16)O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} ((no name)) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} ((no name)) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabO16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} ((no name)) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab~ Objets ActiveX: Scanned in 00mn 00s---\\ Alteração Dominio/Clientes DNS (017)O17 - HKLM\System\CCS\Services\Tcpip\..\{36CD59E6-D872-463C-A51A-329EEEA58D99}: DhcpNameServer = 192.168.2.1 192.168.2.1O17 - HKLM\System\CS1\Services\Tcpip\..\{36CD59E6-D872-463C-A51A-329EEEA58D99}: DhcpNameServer = 192.168.2.1 192.168.2.1O17 - HKLM\System\CS3\Services\Tcpip\..\{36CD59E6-D872-463C-A51A-329EEEA58D99}: DhcpNameServer = 192.168.2.1 192.168.2.1O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1~ Domain: Scanned in 00mn 00s---\\ Protocolo adicional (018)O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} . (.Microsoft Corporation - WIA Scripting Layer.) -- C:\WINDOWS\system32\wiascr.dllO18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\OFFICE12\MSOXMLMF.dll =>.Microsoft Corporation~ Protocole Additionnel: Scanned in 00mn 00s---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)O20 - Winlogon Notify: GbPluginBb . (.Banco do Brasil - Gbieh Module.) -- C:\Arquivos de programas\GbPlugin\gbieh.dllO20 - Winlogon Notify: GbPluginCef . (.Caixa Economica Federal - Gbieh Module.) -- C:\ARQUIVOS DE PROGRAMAS\GBPLUGIN\gbiehcef.dllO20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dllO20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dllO20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agente de rede off-line.) -- C:\WINDOWS\system32\cscdll.dllO20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- C:\WINDOWS\system32\dimsntfy.dllO20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\WINDOWS\system32\igfxdev.dllO20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\wlnotify.dllO20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\wlnotify.dllO20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL de notificação do serviço de logon secu.) -- C:\WINDOWS\system32\sclgntfy.dllO20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\WlNotify.dllO20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\wlnotify.dllO20 - Winlogon Notify: WgaLogon . (.Microsoft Corporation - Notificações do Programa de Vantagens do Wi.) -- C:\WINDOWS\system32\WgaLogon.dllO20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\wlnotify.dll~ Winlogon: Scanned in 00mn 00s---\\ Chave do Registo autorun SharedTaskScheduler (STS) (O22)O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} . (.Microsoft Corporation - Biblioteca da interface de usuário do naveg.) -- C:\WINDOWS\system32\browseui.dllO22 - SharedTaskScheduler: Pré-carregador Browseui - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Biblioteca da interface de usuário do naveg.) -- C:\WINDOWS\system32\browseui.dll~ STS/SSO: Scanned in 00mn 00s---\\ Lista dos serviços NT não Microsoft e não desativados (023)O23 - Service: Gbp Service (GbpSv) . (.GAS Tecnologia - G-Buster Browser Defense - Service.) - C:\Arquivos de programas\GbPlugin\gbpsv.exeO23 - Service: TeamViewer 8 (TeamViewer8) . (.TeamViewer GmbH - TeamViewer 8.) - C:\Arquivos de programas\TeamViewer\Version8\TeamViewer_Service.exe~ Services: 5 Legitimates Filtered in 00mn 03s---\\ Enumeração Ativa do Ambiente de trabalho & Editor MHTML (024)O24 - Desktop Component 0: Minha página inicial atual - file:About:HomeO24 - Default MHTML Editor: Last - .(...) - C:\Arquivos de programas\Microsoft Office\OFFICE11\WINWORD.exe (.not file.)O24 - Desktop General: BackupWallPaper - .(...) - C:\Documents and Settings\estacao10\Configurações locais\Dados de aplicativos\Microsoft\Wallpaper1.bmpO24 - Desktop General: WallPaper - .(...) - C:\Documents and Settings\estacao10\Configurações locais\Dados de aplicativos\Microsoft\Wallpaper1.bmp~ Desktop Component: 4 Legitimates Filtered in 00mn 00s---\\ HKCU & HKLM Software Keys[HKCU\Software\AutoHelpDesk][HKCU\Software\PartyGaming][HKLM\Software\Programas RFB]~ Key Software: 514 Legitimates Filtered in 00mn 00s---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43)O43 - CFD: 22/4/2010 - 18:20:43 - [0] ----D C:\Arquivos de programas\IRPF2010O43 - CFD: 31/1/2004 - 15:50:23 - [2,116] ----D C:\Arquivos de programas\OnlineHelpConsoleO43 - CFD: 25/2/2007 - 15:21:07 - [0] ----D C:\Arquivos de programas\PokerStarsO43 - CFD: 16/12/2010 - 16:21:15 - [0,004] ----D C:\Arquivos de programas\PokerStars.NETO43 - CFD: 22/4/2010 - 18:12:42 - [13,670] ----D C:\Arquivos de programas\Programas RFBO43 - CFD: 31/1/2004 - 15:40:01 - [0,001] ----D C:\Arquivos de programas\Serviços on-lineO43 - CFD: 31/1/2004 - 15:39:11 - [0,008] ----D C:\Arquivos de programas\Arquivos comuns\ServiçosO43 - CFD: 26/8/2009 - 15:37:07 - [0,015] R---D C:\Documents and Settings\estacao10\Menu Iniciar\Programas\AcessóriosO43 - CFD: 25/4/2013 - 08:33:08 - [0] R---D C:\Documents and Settings\estacao10\Menu Iniciar\Programas\Inicializar~ Program Folder: 141 Legitimates Filtered in 00mn 19s---\\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044)O44 - LFC:[MD5.E94107E8516DD4A6468D353A1F5BACA5] - 19/2/2014 - 15:32:27 ---A- . (...) -- C:\WINDOWS\ntbtlog.txt [2181842]O44 - LFC:[MD5.CFE71311B0C754B7A48FE7929B29A1CC] - 24/2/2014 - 08:37:10 ---A- . (...) -- C:\WINDOWS\wiaservc.log [49]O44 - LFC:[MD5.4E9864608C6575A5B964D656D9C40DB2] - 24/2/2014 - 08:37:13 ---A- . (...) -- C:\WINDOWS\wiadebug.log [159]O44 - LFC:[MD5.B7CC2AF3D5604EFDC5F82AF7A5B21FB1] - 24/2/2014 - 08:37:30 ---A- . (.GbPlugin NDIS Device Driver - GbPlugin NDIS Device Driver.) -- C:\WINDOWS\system32\Drivers\GbpNdisrd.sys [31088]~ Files: 19 Legitimates Filtered in 00mn 07s---\\ Operações e funções ao arranque do Windows Explorer (046)O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dllO46 - SEH:ShellExecuteHooks - GbPlugin ShlObj - {E37CB5F0-51F5-4395-A808-5FA49E399003} - C:\ARQUIVOS DE PROGRAMAS\GBPLUGIN\gbiehcef.dllO46 - SEH:ShellExecuteHooks - GbPlugin ShlObj - {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\ARQUIVOS DE PROGRAMAS\GBPLUGIN\gbieh.dllO46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dll~ ShellExecuteHooks: Scanned in 00mn 00s---\\ Exportar a chave da aplicação autorizada (047)O47 - AAKE:Key Export SP - "C:\WINDOWS\system32\LMabcoms.exe" [Enabled] .(..) -- C:\WINDOWS\system32\LMabcoms.exe~ Keys Export: 10 Legitimates Filtered in 00mn 00s---\\ Image File Execution Options (IFEO) (O50)O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d~ IFEO: Scanned in 00mn 00s---\\ Lista dos drivers do sistema (SDL) (O58)O58 - SDL:[MD5.F385467DF95D0A73775CB3B076B8B969] - 14/1/2014 - 10:38:06 ---A- . (...) -- C:\WINDOWS\system32\Drivers\aswRvrt.sys [49944]O58 - SDL:[MD5.1B0662514A68C3A42E60D240C5ABEF28] - 14/1/2014 - 10:38:06 ---A- . (...) -- C:\WINDOWS\system32\Drivers\aswVmm.sys [180248]O58 - SDL:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 10/1/2014 - 09:28:39 ---A- . (...) -- C:\WINDOWS\system32\Drivers\ati0qaxx.sys [0]O58 - SDL:[MD5.DA6675E1400D58412C93180F8651A9FB] - 29/10/2007 - 09:00:00 ---A- . (.RAVISENT Technologies Inc. - CineMaster C 1.2 WDM Main Driver.) -- C:\WINDOWS\system32\Drivers\cinemst2.sys [262528]O58 - SDL:[MD5.DCF228C60E1036597FD5C4A647790527] - 1/7/2013 - 15:40:10 ---A- . (.GAS Tecnologia - GbPlugin Device Driver.) -- C:\WINDOWS\system32\Drivers\GbpKm.sys [47688]O58 - SDL:[MD5.B7CC2AF3D5604EFDC5F82AF7A5B21FB1] - 24/2/2014 - 08:37:30 ---A- . (.GbPlugin NDIS Device Driver - GbPlugin NDIS Device Driver.) -- C:\WINDOWS\system32\Drivers\GbpNdisrd.sys [31088]O58 - SDL:[MD5.573C7D0A32852B48F3058CFD8026F511] - 13/4/2008 - 13:36:05 ----- . (.Windows ® Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) -- C:\WINDOWS\system32\Drivers\hdaudbus.sys [144384]O58 - SDL:[MD5.2A013E7530BEAB6E569FAA83F517E836] - 7/1/2005 - 16:07:16 ----- . (.Windows ® Server 2003 DDK provider - High Definition Audio Function Driver v1.0a.) -- C:\WINDOWS\system32\Drivers\Hdaudio.sys [145920]O58 - SDL:[MD5.C53775780148884AC87C455489A0C070] - 3/8/2004 - 22:41:40 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\mtlmnt5.sys [126686]O58 - SDL:[MD5.54886A652BF5685192141DF304E923FD] - 3/8/2004 - 22:41:38 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\mtlstrm.sys [1309184]O58 - SDL:[MD5.6DDA78A0BE692B61B668FAB860F276CF] - 3/8/2004 - 22:29:38 ----- . (.Matrox Graphics Inc. - Matrox Parhelia Miniport Driver.) -- C:\WINDOWS\system32\Drivers\mtxparhm.sys [452736]O58 - SDL:[MD5.576B34CEAE5B7E5D9FD2775E93B3DB53] - 3/8/2004 - 22:41:40 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\ntmtlfax.sys [180360]O58 - SDL:[MD5.C5BD32A70808DB0F8BC01CE80EEA2C3A] - 26/12/2006 - 09:31:06 R--A- . (.Windows ® Codename Longhorn DDK provider - Generic Port I/O.) -- C:\WINDOWS\system32\Drivers\PortIo.sys [4864]O58 - SDL:[MD5.36C46561FDC566FD4943216ABA090343] - 10/1/2014 - 09:32:24 ---A- . (.Sysinternals - www.sysinternals.com - Process Explorer.) -- C:\WINDOWS\system32\Drivers\PROCEXP113.SYS [12568]O58 - SDL:[MD5.80D317BD1C3DBC5D4FE7B1678C60CADD] - 29/10/2007 - 09:00:00 ---A- . (.Parallel Technologies, Inc. - Parallel Technologies DirectParallel IO Library.) -- C:\WINDOWS\system32\Drivers\ptilink.sys [17792]O58 - SDL:[MD5.E9AAA0092D74A9D371659C4C38882E12] - 3/8/2004 - 22:41:40 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\recagent.sys [13776]O58 - SDL:[MD5.D9673011648A71ED1E1F77B831BC85E6] - 3/8/2004 - 22:41:42 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\slnt7554.sys [129535]O58 - SDL:[MD5.2C1779C0FEB1F4A6033600305EBA623A] - 3/8/2004 - 22:41:44 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\slntamr.sys [404990]O58 - SDL:[MD5.F9B8E30E82EE95CF3E1D3E495599B99C] - 3/8/2004 - 22:41:46 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\slnthal.sys [95424]O58 - SDL:[MD5.DB56BB2C55723815CF549D7FC50CFCEB] - 3/8/2004 - 22:41:46 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\slwdmsup.sys [13240]O58 - SDL:[MD5.5D66F1E74B63FDC2AE558950F3C1BF36] - 9/11/2007 - 19:25:48 ---A- . (.IDT, Inc. - NDRC.) -- C:\WINDOWS\system32\Drivers\sthda.sys [1260744]O58 - SDL:[MD5.55E01061C74A8CEFFF58DC36114A8D3F] - 29/10/2007 - 09:00:00 ---A- . (.RAVISENT Technologies Inc. - CineMaster C WDM DVD Minidriver.) -- C:\WINDOWS\system32\Drivers\vdmindvd.sys [58112]O58 - SDL:[MD5.C1E76718BAB6BCA0D18E5670F074F821] - 29/10/2007 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ansi.sys [9032]O58 - SDL:[MD5.0FE9F16075C9ACB941C957B7C649176E] - 29/10/2007 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\country.sys [27097]O58 - SDL:[MD5.912150FE88E79AFEE0BB72216FAB2617] - 29/10/2007 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\himem.sys [4896]O58 - SDL:[MD5.582BCDD47CF4B68B5CB528F18E3CB808] - 29/10/2007 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\key01.sys [42809]O58 - SDL:[MD5.FBBCFEC1379C5C02D88A361993EDF1B8] - 29/10/2007 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\keyboard.sys [42537]O58 - SDL:[MD5.19D4F0DAD3F393C13DE7F849ADE72EFE] - 29/10/2007 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos.sys [27900]O58 - SDL:[MD5.CF9ED169FF86D935E47999E82359E898] - 29/10/2007 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos404.sys [29146]O58 - SDL:[MD5.03B945AC0481CD8BB161C3569D8ED1C3] - 29/10/2007 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos411.sys [29370]O58 - SDL:[MD5.BBC957DC18C17CC027EB80B7C77F2AEA] - 29/10/2007 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos412.sys [29274]O58 - SDL:[MD5.3CFFAEFFF23B0D208214A6D3061A5B1B] - 29/10/2007 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos804.sys [29146]O58 - SDL:[MD5.86BB7AF2533B342B8E274590AD2190FA] - 29/10/2007 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio.sys [33984]O58 - SDL:[MD5.6F73F50162DEF60C84B725C18CD9140F] - 29/10/2007 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio404.sys [34560]O58 - SDL:[MD5.0FDD5E69C1FF3B58043D44F2CC743D45] - 29/10/2007 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio411.sys [35648]O58 - SDL:[MD5.8842837C4D8311BF8E72BEE8CCC42217] - 29/10/2007 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio412.sys [35424]O58 - SDL:[MD5.6B56CEB3C6F9D5CD7293DBD9FE23B311] - 29/10/2007 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio804.sys [34560]~ Drivers: 6 Legitimates Filtered in 00mn 04s---\\ Lista das ferramentas de remoção de vírus (LAT) (063)O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas CoolmanO63 - Logiciel: HiJackThis - (.Trend Micro.) [HKLM] -- {45A66726-69BC-466B-A7A4-12FCBA4883D7}~ ADS: Scanned in 00mn 00s---\\ Lista dos serviços Legacy du registo (064)O64 - Services: CurCS - 1/7/2013 - C:\WINDOWS\system32\drivers\gbpkm.sys (GbpKm) .(.GAS Tecnologia - GbPlugin Device Driver.) - LEGACY_GBPKMO64 - Services: CurCS - 16/10/2013 - C:\Arquivos de programas\GbPlugin\gbpsv.exe (GbpSv) .(.GAS Tecnologia - G-Buster Browser Defense - Service.) - LEGACY_GBPSV~ Legacy: 140 Legitimates Filtered in 00mn 00s---\\ Associações Shell Spawning (O67)O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)~ FASS Keys: 10 Legitimates Filtered in 00mn 00s---\\ Menu de inicialização Internet (068)O68 - StartMenuInternet: <chrome.exe> <>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Arquivos de programas\Google\Chrome\Application\chrome.exeO68 - StartMenuInternet: <FIREFOX.EXE> <Mozilla Firefox>[HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Arquivos de programas\Mozilla Firefox\firefox.exeO68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Arquivos de programas\Google\Chrome\Application\chrome.exeO68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Arquivos de programas\Internet Explorer\iexplore.exe~ Keys: Scanned in 00mn 00s---\\ Pesquisa de infeção nos navegadores da Internet (SBI) (069)O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (@ieframe.dll,-12512) - http://www.bing.comO69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (@ieframe.dll,-12512) - http://www.bing.comO69 - SBI: SearchScopes [HKCU] {8DF8C9C3-D72B-47FD-BB58-D8FA3993DD81} [DefaultScope] - (Google) - http://www.google.com~ Keys: Scanned in 00mn 00s---\\ Pesquisa adicional à raiz do sistema (radicular) (SPRF) (O84)[MD5.0E93D5D6007571947B8AAA1131EA035E] [sPRF][24/4/2013] (...) -- C:\Documents and Settings\estacao10\Desktop\setup_11.0.0.1245.x01_2013_04_25_00_16.exe [163138192]~ Files: 7 Legitimates Filtered in 00mn 07s---\\ Listagem dos códigos dos software (PUC) (090)O90 - PUC: "07C849B4C4096E24C9376550F40529BA" . (.On-line Help Console.) -- C:\WINDOWS\Installer\{4B948C70-904C-42E6-9C73-56054F5092AB}\ARPPRODUCTICON.exe~ Update Products: 44 Legitimates Filtered in 00mn 00s---\\ Estado general dos serviços não Microsoft (EGS) (SR=Executados, SS=Parados)SS - | Demand 21/2/2014 257928 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exeSS - | Demand 13/4/2008 225280 | (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\system32\dmadmin.exeSS - | Demand 13/4/2008 14336 | C:\Arquivos de programas\NOS\bin\getPlus_Helper.dll (getPlusHelper) . (.NOS Microsystems Ltd..) - C:\WINDOWS\system32\svchost.exeSS - | Auto 9/8/2011 136176 | (gupdate) . (.Google Inc..) - C:\Arquivos de programas\Google\Update\GoogleUpdate.exeSS - | Demand 9/8/2011 136176 | (gupdatem) . (.Google Inc..) - C:\Arquivos de programas\Google\Update\GoogleUpdate.exeSS - | Demand 19/9/2012 194032 | (gusvc) . (.Google.) - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exeSS - | Disabled 14/11/2005 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Arquivos de programas\Arquivos comuns\InstallShield\Driver\1150\Intel 32\IDriverT.exeSS - | Disabled 15/5/2007 1550896 | (InCDsrv) . (.Nero AG.) - C:\Arquivos de programas\Nero\Nero 7\InCD\InCDsrv.exeSS - | Demand 22/10/2013 125288 | (Installer Service) . (...) - C:\Documents and Settings\All Users\Dados de aplicativos\NokiaInstallerCache\ProductCache\{D5878294-C113-43c5-A24F-FC333C52015A}\{EDB188F5-D8E8-42EE-89E0-F212DA48CB81}\Installer\InstallerService.exeSS - | Disabled 14/6/2005 491520 | (lmab_device) . (...) - C:\WINDOWS\system32\LMabcoms.exeSS - | Disabled 17/2/2014 118896 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Arquivos de programas\Mozilla Maintenance Service\maintenanceservice.exeSS - | Disabled 13/4/2007 792112 | (NBService) . (.Nero AG.) - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exeSS - | Disabled 8/5/2007 271920 | (NMIndexingService) . (.Nero AG.) - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exeSS - | Disabled 8/8/2005 167936 | (RichVideo) . (...) - C:\Arquivos de programas\CyberLink\Shared Files\RichVideo.exeSS - | Disabled 9/11/2007 212992 | (STacSV) . (.IDT, Inc..) - C:\Arquivos de programas\IDT\1312004165702\STacSV.exeSR - | Auto 14/1/2014 50344 | (avast! Antivirus) . (.AVAST Software.) - C:\Arquivos de programas\AVAST Software\Avast\AvastSvc.exeSR - | Auto 16/10/2013 452968 | (GbpSv) . (.GAS Tecnologia.) - C:\Arquivos de programas\GbPlugin\gbpsv.exeSR - | Auto 9/7/2013 182184 | (JavaQuickStarterService) . (.Oracle Corporation.) - C:\Arquivos de programas\Java\jre7\bin\jqs.exeSR - | Demand 18/4/2013 737616 | (ServiceLayer) . (.Nokia.) - C:\Arquivos de programas\PC Connectivity Solution\ServiceLayer.exeSR - | Auto 1/10/2013 5087584 | (TeamViewer8) . (.TeamViewer GmbH.) - C:\Arquivos de programas\TeamViewer\Version8\TeamViewer_Service.exe~ Services: Scanned in 00mn 07s---\\ Scâner Aditional (088)Database Version : 13031 - (23/2/2014)Clés trouvées (Keys found) : 4Valeurs trouvées (Values found) : 2Dossiers trouvés (Folders found) : 0Fichiers trouvés (Files found) : 1[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{b7fe5d70-9aa2-40f1-9c6b-12a255f085e1}] =>Casino.OnlineGames[HKLM\Software\Microsoft\Internet Explorer\extensions\{b7fe5d70-9aa2-40f1-9c6b-12a255f085e1}] =>Casino.OnlineGames[HKCU\Software\PartyGaming] =>Casino.OnlineGames[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\DealPly] =>PUP.DealPly[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{2318C2B1-4965-11d4-9B18-009027A5CD4F} =>Toolbar.Google^[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:swg =>Toolbar.Google^C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe =>Toolbar.Google^~ Additionnel Scan: 215780 Items scanned in 00mn 22s---\\ Sumário das deteções encontradas na sua estação~ http://nicolascoolman.webs.com/apps/blog/show/28060597-pup-dealply =>PUP.DealPly~ MSI: 1 link(s) detected in 00mn 22s~ 895 Legitimates filtered by white listEnd of the scan (497 lines in 01mn 32s)(0) Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Fevereiro 24, 2014 Bom Dia! Ionara # Opção : Examinar |- Execute,novamente,a ferramenta AdwCleaner e escolha a opção "Limpar",após seu primeiro scan que é "Examinar". -/- |- Execute este script na ferramenta ZHPFix.|- Copie estas informações que estão em vermelho,para o Bloco de Notas.|- Com o Bloco de Notas aberto,faça: ctrl+a >> ctrl+c|- À seguir,minimize o Bloco de Notas.script zhpfixO3 - Toolbar\WebBrowser: (no name) - [HKCU]{01E04581-4EEE-11D0-BFE9-00AA005B4383} Chave orfãO3 - Toolbar\WebBrowser: (no name) - [HKCU]{0E5CBF21-D15F-11D0-8301-00AA005B4383} Chave orfãO3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Chave orfãO4 - GS\Desktop [estacao10]: Servidor de Arquivos (Server06).lnk - Chave orfãO9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} -- C:\Documents and Settings\estacao10\Meus documentos\LEANDRO\ARTIGOS\PartyPoker\images\ppicon.ico (.not file.)O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -- Chave orfãO15 - Trusted Zone: [HKCU\...\Domains\www] http.clicrbs.com.br[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{b7fe5d70-9aa2-40f1-9c6b-12a255f085e1}] =>Casino.OnlineGames[HKLM\Software\Microsoft\Internet Explorer\extensions\{b7fe5d70-9aa2-40f1-9c6b-12a255f085e1}] =>Casino.OnlineGames[HKCU\Software\PartyGaming] =>Casino.OnlineGames[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\DealPly] =>PUP.DealPly[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{2318C2B1-4965-11d4-9B18-009027A5CD4F} =>Toolbar.Google^[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:swg =>Toolbar.Google^C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe =>Toolbar.Google^proxyfixemptytempemptyclsidsysrestorefirewallraz|- Abra a ferramenta ZHPFix. < >|- Clique IMPORTAÇÃO >> OK.|- Clique "GO".|- Poste o relatório!A+ Compartilhar este post Link para o post Compartilhar em outros sites
Ionara 2 Denunciar post Postado Fevereiro 26, 2014 ok, executado limpeza com adw e se gue log solicitado..... script zhpfixO3 - Toolbar\WebBrowser: (no name) - [HKCU]{01E04581-4EEE-11D0-BFE9-00AA005B4383} Chave orfãO3 - Toolbar\WebBrowser: (no name) - [HKCU]{0E5CBF21-D15F-11D0-8301-00AA005B4383} Chave orfãO3 - Toolbar\WebBrowser: (no name) - [HKCU]{2318C2B1-4965-11D4-9B18-009027A5CD4F} Chave orfãO4 - GS\Desktop [estacao10]: Servidor de Arquivos (Server06).lnk - Chave orfãO9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} -- C:\Documents and Settings\estacao10\Meus documentos\LEANDRO\ARTIGOS\PartyPoker\images\ppicon.ico (.not file.)O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -- Chave orfãO15 - Trusted Zone: [HKCU\...\Domains\www] http.clicrbs.com.br[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{b7fe5d70-9aa2-40f1-9c6b-12a255f085e1}] =>Casino.OnlineGames[HKLM\Software\Microsoft\Internet Explorer\extensions\{b7fe5d70-9aa2-40f1-9c6b-12a255f085e1}] =>Casino.OnlineGames[HKCU\Software\PartyGaming] =>Casino.OnlineGames[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\DealPly] =>PUP.DealPly[HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{2318C2B1-4965-11d4-9B18-009027A5CD4F} =>Toolbar.Google^[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:swg =>Toolbar.Google^C:\Arquivos de programas\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe =>Toolbar.Google^proxyfixemptytempemptyclsidsysrestorefirewallraz Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Fevereiro 27, 2014 Boa Noite! Ionara |- O relatório ZHPFix veio incorreto. Refaça o procedimento. -/- |- Baixe: < zoek > ( ... by Smeenk )|- Ou aqui! < zoek.exe >|- Salve-o e descompacte-o para o desktop!|- Estarão disponíveis: zoek.com, zoek.scr, zoek.pif e zoek.exe|- Desabilite seu antivírus!|- Para Windows 7,execute zoek.exe como administrador.hijackthis;iedefaults;chromelook;autoclean;emptyalltemp;|- Copie e cole estas informações,em vermelho,no campo da ferramenta.|- Clique "Run Script". Zoek.exe is running now.Do not start any browser windows, they will be closed automatically.Please wait! This window will close when finished.A logfile will open afterwards and can also be found on your systemdrive as zoek-results.log |- Surgirão estas informações,pedindo-lhe que aguarde o surgimento do relatório.|- Ps: Essas informações,podem permanecer estáticas na tela por 20 minutos ou mais.|- Aceite e/ou confirme o reboot! zoek.hta failed by unknown error.Restart computer, and try again. |- Ps: Ao obter algum erro,reinicie o PC e execute,novamente,a ferramenta.|- Poste o relatório,que estará em C:\zoek-results.txt <<Abs! Compartilhar este post Link para o post Compartilhar em outros sites
Ionara 2 Denunciar post Postado Fevereiro 28, 2014 Boa tarde, segue log correto ZHPFix, em seguida log zoek... Rapport de ZHPFix 2014.2.16.5 par Nicolas Coolman, Update du 16/02/2014Fichier d'export Registre :Run by estacao10 at 28/2/2014 13:37:28High Elevated Privileges : OKWindows XP Professional Service Pack 3 (Build 2600) Reciclagem vazia (00mn 02s) ========== Valores do Registo ==========ProxyFix : Configuração proxy removida com sucessoELIMINÉ ProxyServer ValueELIMINÉ ProxyEnable ValueELIMINÉ EnableHttp1_1 ValueELIMINÉ ProxyHttp1.1 ValueELIMINÉ ProxyOverride ValueNenhum valor presente na chave de exceções do registo (FirewallRaz) ========== Elementos dos dados do Registo ==========ELIMINÉ Trusted Zone: clicrbs.com.br ========== Pastas ==========Nenhuma pasta CLSID local utilizador vazia ========== Ficheiros ==========ELIMINÉ Temporários windows (38) (2.218.517 octets) ========== Restauração Sistema ==========Ponto de restauro do sistema criado com sucesso ========== Recapitulativo ==========7 : Valores do Registo1 : Elementos dos dados do Registo1 : Pastas1 : Ficheiros1 : Restauração Sistema End of clean in 00mn 10s ========== Caminho do ficheiro do relatório ==========C:\Documents and Settings\estacao10\Dados de aplicativos\ZHP\ZHPFix[R1].txt - 28/2/2014 13:37:31 [1157] Zoek.exe v5.0.0.0 Updated 19-February-2014Tool run by estacao10 on sex 28/02/2014 at 13:42:17,93.Microsoft Windows XP Professional 5.1.2600 Service Pack 3 x86Running in: Normal Mode Internet Access DetectedLaunched: C:\Documents and Settings\estacao10\Desktop\zoek.exe [scan all users] [script inserted] ==== System Restore Info ====================== 28/2/2014 13:43:56 Zoek.exe System Restore Point Created Succesfully. ==== Deleting CLSID Registry Keys ====================== ==== Deleting CLSID Registry Values ====================== ==== Deleting Services ====================== ==== Firefox Extensions Registry ====================== [HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]"{20a82645-c095-46ed-80e3-08825760534b}"="c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension" [18/10/2013 18:38] ==== Firefox Extensions ====================== ProfilePath: C:\Documents and Settings\ESTACA~1\Dados de aplicativos\Mozilla\Firefox\Profiles\do755vlg.default- Modulo de Seguranca - Banco do Brasil - %ProfilePath%\extensions\{87F8774F-B485-47E2-A755-A40A8A5E886C} ==== Firefox Plugins ====================== Profilepath: C:\Documents and Settings\estacao10\Dados de aplicativos\Mozilla\Firefox\Profiles\do755vlg.defaultD775FA6F1E88B3B99E69E8A0D6C3A819 - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_12_0_0_70.dll - Shockwave FlashA9C86900D2A61728C8326FE7147617C5 - C:\Arquivos de programas\Google\Update\1.3.22.5\npGoogleUpdate3.dll - Google UpdateD6BCD0765A259DB2481C082DDBD86AD7 - C:\Arquivos de programas\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll - Nokia Suite Enabler PluginBE501CBC29B2025A263D80D399F1797A - c:\Arquivos de programas\Microsoft Silverlight\5.1.20913.0\npctrl.dll - Silverlight Plug-InABCB4A6EAB701C629378255ABCB308E5 - C:\Arquivos de programas\Java\jre7\bin\plugin2\npjp2.dll - Java Platform SE 7 U25D7324EB1EDCB8990F8522DE0311359E9 - C:\WINDOWS\system32\npDeployJava1.dll - Java Deployment Toolkit 7.0.250.17667CB7D2CAF917608421E5250462C0AA - C:\Arquivos de programas\Adobe\Reader 9.0\Reader\browser\nppdf32.dll - Adobe Acrobat667CB7D2CAF917608421E5250462C0AA - C:\Arquivos de programas\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll - Adobe AcrobatAB87EEFFD18F2BAAFC274E7075EA6C67 - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll - Windows Presentation Foundation / Windows Presentation FoundationCF4ABE599858E10EEB911E16FBCFD87D - C:\Arquivos de programas\Windows Media Player\npdrmv2.dll - Microsoft® DRM76E34EA1089E92709C5725407B565DA1 - C:\Arquivos de programas\Windows Media Player\npdsplay.dll - Windows Media Player Plug-in Dynamic Link Library02A4A41FAC9BF96155B3E8068D1DF4B6 - C:\Arquivos de programas\Windows Media Player\npwmsdrm.dll - Microsoft® DRMB27CCB1168B1960AEC6E9D3E0E0F0D2A - c:\Arquivos de programas\Microsoft Silverlight\5.1.20913.0\npctrlui.dll - Microsoft® SilverlightF9174E52953C2EDB35E4E634F6228F66 - C:\WINDOWS\system32\npptools.dll - Sistema operacional Microsoft® Windows® ==== Chrome Look ====================== Google Wallet - estacao10\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda ==== Set IE to Default ====================== Old Values:[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]"Start Page"="http://www.google.com.br/" New Values:[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]"Start Page"="http://www.google.com.br/" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes"DefaultScope"="{8DF8C9C3-D72B-47FD-BB58-D8FA3993DD81}"{0633EE93-D776-472f-A0FF-E1416B8B2E3A} @ieframe.dll,-12512 Url="http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC"{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"{8DF8C9C3-D72B-47FD-BB58-D8FA3993DD81} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7VASE_pt-BRBR502" ==== HijackThis Entries ====================== R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localO2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveShellExtensions.dllO2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre7\bin\ssv.dllO2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Arquivos de programas\AVAST Software\Avast\aswWebRepIE.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Arquivos de programas\Google\Google Toolbar\GoogleToolbar_32.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Arquivos de programas\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dllO2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\ARQUIVOS DE PROGRAMAS\GBPLUGIN\gbieh.dllO2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\ARQUIVOS DE PROGRAMAS\GBPLUGIN\gbiehcef.dllO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre7\bin\jp2ssv.dllO3 - Toolbar: avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Arquivos de programas\AVAST Software\Avast\aswWebRepIE.dllO4 - HKLM\..\Run: [PPort11reminder] "C:\Arquivos de programas\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Dados de aplicativos\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini"O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 9.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [Adobe ARM] "C:\Arquivos de programas\Arquivos comuns\Adobe\ARM\1.0\AdobeARM.exe"O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe"O4 - HKLM\..\Run: [AvastUI.exe] "C:\Arquivos de programas\AVAST Software\Avast\AvastUI.exe" /noguiO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [NokiaSuite.exe] C:\Arquivos de programas\Nokia\Nokia Suite\NokiaSuite.exe -trayO4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\Office12\EXCEL.EXE/3000O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLLO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exeO14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.aspO15 - Trusted Zone: http://azt.aids.gov.brO15 - Trusted Zone: http://siclom2.aids.gov.brO15 - Trusted Zone: www.bancobrasil.com.brO15 - Trusted Zone: www14.bancobrasil.com.brO15 - Trusted Zone: www2.bancobrasil.com.brO15 - Trusted Zone: www.bb.com.brO16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabO16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabO18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Arquivos de programas\Microsoft Office\Office12\GrooveSystemServices.dllO20 - Winlogon Notify: GbPluginBb - C:\Arquivos de programas\GbPlugin\gbieh.dllO20 - Winlogon Notify: GbPluginCef - C:\ARQUIVOS DE PROGRAMAS\GBPLUGIN\gbiehcef.dllO22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dllO22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dllO23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exeO23 - Service: avast! Antivirus - AVAST Software - C:\Arquivos de programas\AVAST Software\Avast\AvastSvc.exeO23 - Service: Gbp Service (GbpSv) - GAS Tecnologia - C:\ARQUIV~1\GbPlugin\GbpSv.exeO23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exeO23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exeO23 - Service: Google Software Updater (gusvc) - Google - C:\Arquivos de programas\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: Installer Service - Unknown owner - C:\Documents and Settings\All Users\Dados de aplicativos\NokiaInstallerCache\ProductCache\{D5878294-C113-43c5-A24F-FC333C52015A}\{EDB188F5-D8E8-42EE-89E0-F212DA48CB81}\Installer\InstallerService.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Arquivos de programas\Java\jre7\bin\jqs.exeO23 - Service: ServiceLayer - Nokia - C:\Arquivos de programas\PC Connectivity Solution\ServiceLayer.exeO23 - Service: TeamViewer 8 (TeamViewer8) - TeamViewer GmbH - C:\Arquivos de programas\TeamViewer\Version8\TeamViewer_Service.exe ==== Empty IE Cache ====================== C:\Documents and Settings\Administrador\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfullyC:\Documents and Settings\estacao10\Configurações locais\Temp\Temporary Internet Files\Content.IE5 emptied successfullyC:\WINDOWS\system32\config\systemprofile\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfullyC:\WINDOWS\system32\config\systemprofile\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfullyC:\Documents and Settings\estacao10\Configurações locais\Temporary Internet Files\Content.IE5\index.dat will be deleted at rebootC:\Documents and Settings\LocalService\Configurações locais\Temporary Internet Files\Content.IE5\index.dat will be deleted at rebootC:\Documents and Settings\NetworkService\Configurações locais\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot ==== Empty FireFox Cache ====================== C:\Documents and Settings\estacao10\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\do755vlg.default\Cache emptied successfully ==== Empty Chrome Cache ====================== C:\Documents and Settings\estacao10\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\Cache emptied successfully ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== Java Cache cleared successfully ==== C:\zoek_backup content ====================== C:\zoek_backup (files=0 folders=0 0 bytes) ==== Empty Temp Folders ====================== C:\Documents and Settings\Administrador\Configurações locais\temp emptied successfullyC:\Documents and Settings\Default User\Configurações locais\temp emptied successfullyC:\Documents and Settings\estacao10\Configurações locais\Temp will be emptied at rebootC:\Documents and Settings\LocalService\Configurações locais\temp emptied successfullyC:\Documents and Settings\NetworkService\Configurações locais\temp emptied successfullyC:\WINDOWS\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\WINDOWS\Temp successfully emptiedC:\DOCUME~1\ESTACA~1\CONFIG~1\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\RECYCLER successfully emptied ==== Deleting Files / Folders ====================== "C:\Documents and Settings\estacao10\Configurações locais\Temporary Internet Files\Content.IE5\index.dat" not found"C:\Documents and Settings\LocalService\Configurações locais\Temporary Internet Files\Content.IE5\index.dat" not found"C:\Documents and Settings\NetworkService\Configurações locais\Temporary Internet Files\Content.IE5\index.dat" not found ==== EOF on sex 28/02/2014 at 14:05:48,82 ====================== Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Março 5, 2014 Bom Dia! Ionara|- Seus logs estão limpos!|- Remova pontos infectados e ferramentas empregadas,utilizando DelFix.-/-|- Baixe: |DelFix| ( ... de Xplode )|- Estando na página,clique na seta verde para o download.|- Salve-a em um local conveniente! ( desktop! )|- Feche aplicativos que estejam abertos.|- Execute-a!|- Com as duas checkbox marcadas!|- Clique "Run".|- Tudo Ok?Abs! Compartilhar este post Link para o post Compartilhar em outros sites
Ionara 2 Denunciar post Postado Março 13, 2014 Tudo Ok, obrigada. Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Março 14, 2014 PROBLEMA RESOLVIDO Caso o autor necessite que o tópico seja reaberto basta enviar uma Mensagem Privada para um Moderador com um link para o tópico. Compartilhar este post Link para o post Compartilhar em outros sites
