[Arquivado] Internet caindo toda hora.

[bobliks 0]

Minha internet fica caindo do nada e depois de uns 5~10 segundos ela volta a funcionar, fica impossível jogar algo com a internet assim. (o problema já ocorre a quase 1 mês).

Se alguém puder me ajudar, ficarei muito grato.

 

Segue log do HijackThis:

 

Logfile of Trend Micro HijackThis v2.0.5

Scan saved at 18:19:33, on 19/08/2014

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v9.00 (9.00.8112.16533)

FIREFOX: 31.0 (x86 pt-BR)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

C:\Program Files (x86)\RaidCall\raidcall.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Steam\Steam.exe

C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Users\Ricardo\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.qone8.com/web/?type=ds&ts=1396990231&from=smt&uid=WDCXWD10EARS-00Y5B1_WD-WMAV5262597925979&q={searchTerms}

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.qone8.com/web/?type=ds&ts=1396990231&from=smt&uid=WDCXWD10EARS-00Y5B1_WD-WMAV5262597925979&q={searchTerms}

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=userinit.exe,

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL

O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

O4 - HKLM\..\Run: [uSB3MON] "C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"

O4 - HKLM\..\Run: [baidu Antivirus] "C:\Program Files (x86)\Baidu-Security-2014-4.4.4.73687\Baidu Antivirus\BavTray.exe" -auto

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIÇO LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO DE REDE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIÇO DE REDE')

O8 - Extra context menu item: &Enviar para o OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Baidu Antivirus Service (BAVSvc) - Unknown owner - C:\Program Files (x86)\Baidu-Security-2014-4.4.4.73687\Baidu Antivirus\BAVSvc.exe (file missing)

O23 - Service: Baidu Hips Service (BHipsSvc) - Unknown owner - C:\Program Files (x86)\Baidu-Security-2014-4.4.4.73687\Baidu Antivirus\BHipsSvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: Serviço do Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

O23 - Service: Intel® Integrated Clock Controller Service - Intel® ICCS (ICCS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Integrated Clock Controller Service\ICCProxy.exe

O23 - Service: Intel® Capability Licensing Service Interface - Intel® Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe

O23 - Service: Intel® Capability Licensing Service TCP IP Interface - Intel® Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe

O23 - Service: Intel® ME Service - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe

O23 - Service: Intel® PROSet Monitoring Service - Unknown owner - C:\Windows\system32\IProsetMonitor.exe (file missing)

O23 - Service: Intel® Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: KMService - Unknown owner - C:\Windows\system32\srvany.exe

O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe

O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 11221 bytes

[DigRam 144]

Boa Noite! bobliks

 

|- Baixe: < > ( ... par Xplode )

|- Ao acessar,clique em "Download Now".

|- Ps: Se utilizar o navegador IE9,desabilite o filtro "SmartScreen".

|- Salve-o no desktop!

< >

|- Clique direito em adwcleaner.exe,e escolha sua execução como administrador.

|- Ps: Dê início ao scan,clicando em "Examinar".

< >

|- Ao concluir,clique "Limpar" >> Ok >> Ok >> Ok.

|- Copie o log ou clique "Relatório".

|- Poste: < C:\AdwCleaner\AdwCleaner[s0].txt >

A+

[bobliks 0]

Boa noite DigRam. ^^

 

Segue o Log:

 

# AdwCleaner v3.307 - Relatório criado 19/08/2014 às 18:54:38

# Atualizado 17/08/2014 por Xplode

# Sistema Operacional : Windows 7 Ultimate (64 bits)

# Usuário : Ricardo - RICARDO-PC

# Executando de : C:\Users\Ricardo\Desktop\adwcleaner_3.307.exe

# Opção : Limpar

***** [ Serviços ] *****

***** [ Arquivos / Pastas ] *****

Pasta Deletada : C:\ProgramData\baidu

Pasta Deletada : C:\ProgramData\WPM

Pasta Deletada : C:\Program Files (x86)\Common Files\Spigot

Pasta Deletada : C:\Users\Ricardo\AppData\Local\Mail.Ru

Pasta Deletada : C:\Users\Ricardo\AppData\Local\Rocket

Pasta Deletada : C:\Users\Ricardo\AppData\Local\Slick Savings

Pasta Deletada : C:\Users\Ricardo\AppData\Local\Temp\iSafeRightKeyScan

Pasta Deletada : C:\Users\Ricardo\AppData\Local\Temp\NetCrawl

Pasta Deletada : C:\Users\Ricardo\AppData\Roaming\AppCloudUpdater

Pasta Deletada : C:\Users\Ricardo\AppData\Roaming\eCyber

Pasta Deletada : C:\Users\Ricardo\AppData\Roaming\RocketUpdater

Pasta Deletada : C:\Users\Ricardo\AppData\Roaming\Slick Savings

Pasta Deletada : C:\Users\Ricardo\Documents\Save

Pasta Deletada : C:\Users\Ricardo\Documents\Updater

Arquivo Deletada : C:\Windows\System32\drivers\iSafeKrnlBoot.sys

Arquivo Deletada : C:\Windows\System32\log\iSafeKrnlCall.log

Arquivo Deletada : C:\Users\Ricardo\AppData\Roaming\Mozilla\Firefox\Profiles\6obnl09d.default\user.js

***** [ Tarefas ] *****

Tarefa Deletedo : Driver Booster Scan

Tarefa Deletedo : Driver Booster Update

Tarefa Deletedo : Rocket Updater

***** [ Atalhos ] *****

***** [ Registro ] *****

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASAPI32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASMANCS

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\SupTab_RASAPI32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\SupTab_RASMANCS

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\wpm_RASAPI32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\wpm_RASMANCS

Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\CLSID\{03EB0E9C-7A91-4381-A220-9B52B641CDB1}

Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}

Chave Deletedo : HKCU\Software\AppCloudUpdater

Chave Deletedo : HKCU\Software\Rocket Browser

Chave Deletedo : HKCU\Software\RocketUpdater

Chave Deletedo : HKCU\Software\Softonic

Chave Deletedo : HKLM\SOFTWARE\IePlugin

Chave Deletedo : HKLM\SOFTWARE\iSafe

Chave Deletedo : HKLM\SOFTWARE\Wpm

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3A787631-66A2-4634-B928-A37E73B58FB6}

***** [ Navegadores ] *****

-\\ Internet Explorer v9.0.8112.16533

Configurações Restauradas : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]

Configurações Restauradas : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [search Page]

Configurações Restauradas : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]

Configurações Restauradas : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [search Page]

-\\ Mozilla Firefox v31.0 (x86 pt-BR)

[ Arquivo : C:\Users\Ricardo\AppData\Roaming\Mozilla\Firefox\Profiles\6obnl09d.default\prefs.js ]

-\\ Google Chrome v36.0.1985.143

[ Arquivo : C:\Users\Ricardo\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deletedo [search Provider] : hxxp://br.ask.com/web?q={searchTerms}

Deletedo [search Provider] : hxxp://www.softonic.com.br/s/{searchTerms}

Deletedo [Extension] : hbcennhacfaagdopikcegfcobcadeocj

Deletedo [Extension] : icdlfehblmklkikfigmjhbmmpmkmpooj

Deletedo [Extension] : mhkaekfpcppmmioggniknbnbdbcigpkk

Deletedo [Extension] : pelmeidfhdlhlbjimpabfcbnnojbboma

Deletedo [Extension] : pfndaklgolladniicklehhancnlgocpp

*************************

AdwCleaner[R0].txt - [5123 octets] - [19/08/2014 18:53:50]

AdwCleaner[s0].txt - [4380 octets] - [19/08/2014 18:54:38]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [4440 octets] ##########

[DigRam 144]

Boa Noite! bobliks

 

|- Baixe: < ZHPDiag2.exe > < > ( ... de Nicolas Coolman )

|- Salve-o no disco local! ( C ou D )

|- Desabilite seu antivírus e execute "ZHPDiag2.exe",para instalar a ferramenta.

|- Execute o ícone do pergaminho. ( ZHPDiag )

|- Clique "COMPLETA" e aguarde a conclusão!

|- Clique OK e,ao concluir,poste o relatório! ( ZHPDiag.txt )

|- Ps: Como o log será extenso,envie-o à Pjjoint.malekal.

|- Ou acesse: < >

|- Maiores informações: < |Link| >

A+

[bobliks 0]

Segue link:

http://cjoint.com/14au/DHualvw4k4r.htm

[DigRam 144]

Boa Noite! bobliks

|- Execute este script na ferramenta ZHPFix.

|- Selecione e copie estas informações que estão em vermelho,para o Bloco de Notas.

|- Com o Bloco de Notas aberto,faça: ctrl+a >> ctrl+c

|- À seguir,minimize o Bloco de Notas.

script zhpfix

firewallraz

[MD5.00000000000000000000000000000000] [APT] [AutoKMS] (...) -- C:\Windows\AutoKMS.exe (.not file.) [0] =>Trojan.AutoKMS

[MD5.00000000000000000000000000000000] [APT] [baidu Antivirus Update] (...) -- C:\Program Files (x86)\Baidu-Security-2014-4.4.4.73687\Baidu Antivirus\BavUpdater.exe (.not file.) [0]

[MD5.00000000000000000000000000000000] [APT] [{FD7E624A-5746-48C4-B9A7-D5632EECE0C8}] (...) -- G:\RAGNAROK\RagnaRave2.exe (.not file.) [0]

[MD5.00000000000000000000000000000000] [APT] [{1273F905-5AA5-4720-8092-93003DFF6091}] (...) -- F:\Setup.exe (.not file.) [0]

R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

O4 - HKLM\..\Wow6432Node\Run: [baidu Antivirus] C:\Program Files (x86)\Baidu-Security-2014-4.4.4.73687\Baidu Antivirus\BavTray.exe (.not file.)

O23 - Service: Baidu Antivirus Service (BAVSvc) . (...) - C:\Program Files (x86)\Baidu-Security-2014-4.4.4.73687\Baidu Antivirus\BAVSvc.exe (.not file.)

O23 - Service: Baidu Hips Service (BHipsSvc) . (...) - C:\Program Files (x86)\Baidu-Security-2014-4.4.4.73687\Baidu Antivirus\BHipsSvc.exe (.not file.)

O39 - APT: AutoKMS - (...) -- C:\Windows\Tasks\AutoKMS.job [204] =>Trojan.AutoKMS

O39 - APT: AutoKMS - (...) -- C:\Windows\System32\Tasks\AutoKMS [204] =>Trojan.AutoKMS

O44 - LFC:[MD5.99044F9C5AB0072E9AA923E38A579B2F] - 13/08/2014 - 20:44:20 ---A- . (...) -- C:\Windows\DirectX.log [27674]

O43 - CFD: 21/07/2014 - 18:17:18 - [] ----D C:\ProgramData\Baidu Security

O44 - LFC:[MD5.D3894F7B7C4A07C25EE9C8117E27DF64] - 18/08/2014 - 13:07:09 ---A- . (...) -- C:\Windows\AutoKMS.log [42598] =>Trojan.AutoKMS

O45 - LFCP:[MD5.C2BBC9A8A1E32F24A97396BE2D0CFB5B] - 19/08/2014 - 01:40:00 ---A- - C:\Windows\Prefetch\SAVESENSELIVE.EXE-A927BDEE.pf =>PUP.SaveSense

O45 - LFCP:[MD5.C363381291E37B8FAAE74840B23B36BC] - 18/08/2014 - 20:40:00 ---A- - C:\Windows\Prefetch\SAVESENSELIVEHANDLER.EXE-887EC19F.pf =>PUP.SaveSense

O45 - LFCP:[MD5.D6941A327594E668A781C5BC51F02113] - 15/08/2014 - 12:49:51 ---A- - C:\Windows\Prefetch\SEARCHSETTINGS.EXE-EA872291.pf =>Adware.SearchSettings

O45 - LFCP:[MD5.81E30CBA35788BC9779C0CD29A1EEA0F] - 15/08/2014 - 12:49:51 ---A- - C:\Windows\Prefetch\SEARCHSETTINGS64.EXE-5CC15363.pf =>Adware.SearchSettings

O53 - SMSR:HKLM\...\startupreg\SearchSettings [Key] . (...) -- C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (.not file.) =>PUP.Dealio

O53 - SMSR:HKLM\...\startupreg\Slick Savings [Key] . (...) -- C:\Users\Ricardo\AppData\Roaming\Slick Savings\CouponsHelper.exe (.not file.) =>PUP.Dealio

O69 - SBI: SearchScopes [HKCU] {68A2EB80-1416-4D39-8B4F-F2F78AAD2D69} - (WSE Rocket) - http://rocket-find.com =>PUP.RockTurner

O51 - MPSK:{1ddeccbd-cc63-11e3-8639-e840f23cad38}\AutoRun\command. (...) -- G:\LG_PC_Programs.exe (.not file.)

O53 - SMSR:HKLM\...\startupreg\GameCenterMailRu [Key] . (...) -- C:\Users\Ricardo\AppData\Local\Mail.Ru\GameCenter\GameCenter@Mail.Ru.exe (.not file.)

O53 - SMSR:HKLM\...\startupreg\MiningSoftware [Key] . (...) -- C:\MiningSoftware\MinerSoftware.exe (.not file.)

O58 - SDL:21/01/2014 - 11:14:40 ---A- . (.Baidu, Inc. - Baidu Antivirus Minifilter Driver.) -- C:\Windows\System32\Drivers\Bfilter.sys [52032]

O58 - SDL:21/01/2014 - 11:14:50 ---A- . (.Baidu, Inc. - Baidu FS Monitor Driver.) -- C:\Windows\System32\Drivers\Bfmon.sys [34624]

O58 - SDL:21/01/2014 - 07:01:36 ---A- . (.Baidu, Inc. - Baidu Antivirus Selfprotect Driver.) -- C:\Windows\System32\Drivers\Bprotect.sys [128992]

O61 - LFC: 17/08/2014 - 19:05:39 ---A- . (...) -- C:\Users\Ricardo\AppData\Local\Temp\Quarantine.exe [377107]

O64 - Services: CurCS - 21/01/2014 - C:\Windows\system32\drivers\Bfilter.sys (Bfilter) .(.Baidu, Inc. - Baidu Antivirus Minifilter Driver.) - LEGACY_BFILTER

O64 - Services: CurCS - 21/01/2014 - C:\Windows\system32\drivers\Bfmon.sys (Bfmon) .(.Baidu, Inc. - Baidu FS Monitor Driver.) - LEGACY_BFMON

O64 - Services: CurCS - 21/01/2014 - C:\Windows\system32\drivers\Bprotect.sys (Bprotect) .(.Baidu, Inc. - Baidu Antivirus Selfprotect Driver.) - LEGACY_BPROTECT

C:\Windows\Tasks\AutoKMS.job =>Trojan.AutoKMS^

C:\Windows\System32\Tasks\AutoKMS =>Trojan.AutoKMS^

C:\Users\Ricardo\AppData\Local\Temp\SearchSettings.exe.42021068 =>

[HKCU\Software\AppDataLow\Software\Slick Savings] =>PUP.Dealio^

[HKCU\Software\AppDataLow\Software\Slick Savings] =>PUP.Dealio

[HKCU\Software\Baidu Security]

[HKLM\Software\Baidu Security]

[HKLM\Software\Wow6432Node\Baidu Security]

[HKLM\Software\Wow6432Node\baidu]

HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\iSafeSvc2_RASAPI32 =>Trojan.Staser

HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\iSafeSvc2_RASMANCS =>Trojan.Staser

HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\iSafe_RASAPI32 =>Trojan.Staser

HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\iSafe_RASMANCS =>Trojan.Staser

HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\NetCrawlSetup_RASAPI32 =>PUP.NetCrawl

HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\NetCrawlSetup_RASMANCS =>PUP.NetCrawl

HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\NetCrawl_RASAPI32 =>PUP.NetCrawl

HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\NetCrawl_RASMANCS =>PUP.NetCrawl

HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\NetCrawl_Setup_RASAPI32 =>PUP.NetCrawl

HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\NetCrawl_Setup_RASMANCS =>PUP.NetCrawl

HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\updateNetCrawl_RASAPI32 =>PUP.NetCrawl

HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\updateNetCrawl_RASMANCS =>PUP.NetCrawl

[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\SearchSettings] =>PUP.Dealio^

[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\Slick Savings] =>PUP.Dealio^

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified

emptytemp

emptyclsid

|- Abra a ferramenta ZHPFix. < >

|- Clique IMPORTAÇÃO >> OK.

|- Clique "GO".

|- Poste o relatório!

A+

[bobliks 0]

Segue Log

 

Rapport de ZHPFix 2014.8.3.6 par Nicolas Coolman, Update du 03/08/2014

Fichier d'export Registre :

Run by Ricardo at 19/08/2014 19:43:29

High Elevated Privileges : OK

Windows 7 Ultimate Edition, 64-bit (Build 7600)

Reciclagem vazia (00mn 01s)

========== Processo memória ==========

ELIMINÉ: Memory Process: C:\Users\Ricardo\AppData\Local\Temp\SearchSettings.exe.42021068

========== Estado dos serviços ==========

BFILTER Parado

BFMON Parado

BPROTECT Parado

========== Chaves do Registo ==========

ELIMINÉ: Service: BAVSvc

ELIMINÉ: Service: BHipsSvc

ELIMINÉ:* StartupReg: SearchSettings

ELIMINÉ:* StartupReg: Slick Savings

ELIMINÉ: SearchScopes :{68A2EB80-1416-4D39-8B4F-F2F78AAD2D69}

ELIMINÉ CLSID MPSK: {1ddeccbd-cc63-11e3-8639-e840f23cad38}

ELIMINÉ:* StartupReg: GameCenterMailRu

ELIMINÉ:* StartupReg: MiningSoftware

ELIMINÉ: HKCU\Software\AppDataLow\Software\Slick Savings

ELIMINÉ: HKCU\Software\Baidu Security

ELIMINÉ:* HKLM\Software\Baidu Security

ELIMINÉ: HKLM\Software\Wow6432Node\baidu

ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\iSafeSvc2_RASAPI32

ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\iSafeSvc2_RASMANCS

ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\iSafe_RASAPI32

ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\iSafe_RASMANCS

ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\NetCrawlSetup_RASAPI32

ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\NetCrawlSetup_RASMANCS

ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\NetCrawl_RASAPI32

ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\NetCrawl_RASMANCS

ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\NetCrawl_Setup_RASAPI32

ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\NetCrawl_Setup_RASMANCS

ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\updateNetCrawl_RASAPI32

ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\updateNetCrawl_RASMANCS

========== Valores do Registo ==========

Ausente Valor Perfil Padrão: FirewallRaz :

Ausente Valor Perfil Domínio FirewallRaz :

ELIMINÉ: FirewallRaz (Public) : {3801D5C1-BED5-4053-94E7-DC504AF5A735}

ELIMINÉ: FirewallRaz (Public) : {28CBE98D-09B7-4A85-90F0-CDC34D690B41}

ELIMINÉ RunValue: Baidu Antivirus

========== Elementos dos dados do Registo ==========

ELIMINÉ: R0 - Main,Start Page = KLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page

ELIMINÉ: R1 Search Page = about:blank

SUBSTITUI Value NoActiveDesktopChanges : Good (0) - Bad (1)

SUBSTITUI Value EnableLUA : Good (1) - Bad (0)

========== Pastas ==========

Nenhuma pasta CLSID local utilizador vazia

========== Ficheiros ==========

ELIMINÉ: c:\windows\directx.log

ELIMINÉ: c:\windows\autokms.log

ELIMINA REINICIAR: c:\windows\system32\drivers\bfilter.sys

ELIMINA REINICIAR: c:\windows\system32\drivers\bfmon.sys

ELIMINA REINICIAR: c:\windows\system32\drivers\bprotect.sys

ELIMINÉ: c:\users\ricardo\appdata\local\temp\quarantine.exe

ELIMINÉ Temporários windows (1460) (653.515.759 octets)

========== Tarefa planificada ==========

ELIMINÉ: AutoKMS

ELIMINÉ: Baidu Antivirus Update

ELIMINÉ: {FD7E624A-5746-48C4-B9A7-D5632EECE0C8}

ELIMINÉ: {1273F905-5AA5-4720-8092-93003DFF6091}

========== Recapitulativo ==========

1 : Processo memória

24 : Chaves do Registo

5 : Valores do Registo

4 : Elementos dos dados do Registo

1 : Pastas

7 : Ficheiros

3 : Estado dos serviços

4 : Tarefa planificada

End of clean in 00mn 07s

========== Caminho do ficheiro do relatório ==========

C:\Users\Ricardo\AppData\Roaming\ZHP\ZHPFix[R1].txt - 19/08/2014 19:43:31 [3517]

[DigRam 144]

Boa Noite! bobliks

 

|- Estamos,agora,em um divisor de àguas,na análise. Ou seja,saímos do básico para vislumbrar novos horizontes.

|- Poste um novo relatório da ferramenta ZHPDiag.

 

-/-

 

|- Baixe: < > ( ... by Oleg N. Scherbakov )

|- Salve-o no desktop!

|- Desabilite seu antivírus!

|- Para Windows 7,clique direito em JRT.exe e execute-o ...

|- Aguarde a conclusão e poste o relatório. ( JRT.txt )

Abs!

[bobliks 0]

Log ZHPDiag: http://cjoint.com/14au/DHua5M7pdxU.htm

 

Log JRT:

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.4 (04.06.2014:1)

OS: Windows 7 Ultimate x64

Ran by Ricardo on 19/08/2014 at 19:58:46,16

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\adtrustmedia"

Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"

~~~ FireFox

Emptied folder: C:\Users\Ricardo\AppData\Roaming\mozilla\firefox\profiles\6obnl09d.default\minidumps [13 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 19/08/2014 at 20:02:25,76

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[DigRam 144]

Boa Noite! bobliks

|- Execute este script na ferramenta ZHPFix.

|- Selecione e copie estas informações que estão em vermelho,para o Bloco de Notas.

|- Com o Bloco de Notas aberto,faça: ctrl+a >> ctrl+c

|- À seguir,minimize o Bloco de Notas.

script zhpfix

emptytemp

O41 - Driver: (Bfilter) . (.Baidu, Inc. - Baidu Antivirus Minifilter Driver.) - C:\Windows\system32\drivers\Bfilter.sys

O41 - Driver: (Bfmon) . (.Baidu, Inc. - Baidu FS Monitor Driver.) - C:\Windows\system32\drivers\Bfmon.sys

O41 - Driver: (Bprotect) . (.Baidu, Inc. - Baidu Antivirus Selfprotect Driver.) - C:\Windows\system32\drivers\Bprotect.sys

emptyflash

sysrestore

|- Abra a ferramenta ZHPFix. < >

|- Clique IMPORTAÇÃO >> OK.

|- Clique "GO".

|- Poste o relatório!

-/-

|- Acione a ferramenta de reparo de sua conexão,integrada ao Windows.

|- Tecle Windows + R e digite ou cole:

C:\Windows\system32\msdt.exe -id NetworkDiagnosticsNetworkAdapter

|- Aperte Enter.

|- Siga as indicações,para o reparo!

A+

[bobliks 0]

Rapport de ZHPFix 2014.8.3.6 par Nicolas Coolman, Update du 03/08/2014

Fichier d'export Registre :

Run by Ricardo at 19/08/2014 20:19:37

High Elevated Privileges : OK

Windows 7 Ultimate Edition, 64-bit (Build 7600)

Reciclagem vazia (00mn 01s)

========== Chaves do Registo ==========

ELIMINÉ Driver Key: Bfilter

ELIMINÉ Driver Key: Bfmon

ELIMINÉ Driver Key: Bprotect

========== Pastas ==========

ELIMINÉ Temporários windows (4)

ELIMINÉ Flash Cookies (0)

========== Ficheiros ==========

ELIMINÉ Temporários windows (114) (1.821.483 octets)

ELIMINÉ Flash Cookies (0) (0 octets)

========== Restauração Sistema ==========

Ponto de restauro do sistema criado com sucesso

========== Recapitulativo ==========

3 : Chaves do Registo

2 : Pastas

2 : Ficheiros

1 : Restauração Sistema

End of clean in 00mn 11s

========== Caminho do ficheiro do relatório ==========

C:\Users\Ricardo\AppData\Roaming\ZHP\ZHPFix[R1].txt - 19/08/2014 19:43:31 [3599]

C:\Users\Ricardo\AppData\Roaming\ZHP\ZHPFix[R2].txt - 19/08/2014 20:19:39 [982]

 

 

 

-------------------------------------------------------------------------------------

 

 

 

Sobre o reparo da conexão:

 

"A solução de problemas não pode identificar o problema"

 

Adaptador de Rede

Detalhes do editor

Não foram detectados problemas

Detalhes de detecção

Informações sobre o Diagnóstico (Adaptador De Rede)

Detalhes sobre o diagnóstico de adaptador de rede: Informações do driver Conexão local do adaptador de rede:   Descrição . . . . . . . . . . : Intel(R) 82579V Gigabit Network Connection   Fabricante  . . . . . . . . . : Intel   Provedor  . . . . . . . . . . . : Intel   Versão   . . . . . . . . . . . : 12.10.28.0   Nome do Arquivo Inf . . . . . . . . . : C:\Windows\INF\oem7.inf   Data do Arquivo Inf . . . . . . . . . : quarta-feira, 21 de agosto de 2013  12:53:41   Nome da Seção  . . . . . . . . . : E1503.6.1.1   ID de Hardware . . . . . . . . . . : pci\ven_8086&dev_1503   Sinalizadores de Status da Instância . . . . . : 0x180200a   Código de Status do Gerenciador de Dispositivos  . . : 0   IfType  . . . . . . . . . . . . : 6   Tipo de Mídia Física. . . . . . : 14

Log de Diagnóstico de Rede

Nome do Arquivo: 6C569625-09A4-49B8-97F1-7A2DFD5EE3F6.Diagnose.Admin.0.etl

Outras configurações de rede e logs

Nome do Arquivo: NetworkConfiguration.cab Informações sobre coleção Nome do computador: RICARDO-PC Versão do Windows:

6.1

Arquitetura:

amd64

Hora:

terça-feira, 19 de agosto de 2014 20:21:37

Detalhes do editor

Diagnósticos de Rede do Windows Detecta problemas na conectividade de rede. Versão do Pacote:

1.0

Fornecedor:

Microsoft Windows

Adaptador de Rede Solucione problemas de Ethernet, sem fio ou outros tipos de adaptadores de rede. Versão do Pacote:

1.0

Fornecedor:

Microsoft Corporation

[DigRam 144]

Boa Noite! bobliks

 

|- Conseguiu o acesso ao NetworkDiagnostics?

|- Ok! Já vi àcima.

 

-/-

 

###

Adaptador de Rede

Detalhes do editor

Não foram detectados problemas

Detalhes de detecção

###

|- Essa informação que destaquei,diz que não há mais problemas. você confirma este fato?

Abs!

[bobliks 0]

Não sei se isso foi uma pergunta ou uma resposta hehe

Mas apareceu o seguinte:

 

"A solução de problemas não pode identificar o problema"

 

Adaptador de Rede

Detalhes do editor

Não foram detectados problemas

Detalhes de detecção

Informações sobre o Diagnóstico (Adaptador De Rede)

Detalhes sobre o diagnóstico de adaptador de rede:

Informações do driver Conexão local do adaptador de rede:

Descrição . . . . . . . . . . : Intel® 82579V Gigabit Network Connection
Fabricante . . . . . . . . . : Intel
Provedor . . . . . . . . . . . : Intel
Versão . . . . . . . . . . . : 12.10.28.0
Nome do Arquivo Inf . . . . . . . . . : C:\Windows\INF\oem7.inf
Data do Arquivo Inf . . . . . . . . . : quarta-feira, 21 de agosto de 2013 12:53:41
Nome da Seção . . . . . . . . . : E1503.6.1.1
ID de Hardware . . . . . . . . . . : pci\ven_8086&dev_1503
Sinalizadores de Status da Instância . . . . . : 0x180200a
Código de Status do Gerenciador de Dispositivos . . : 0
IfType . . . . . . . . . . . . : 6
Tipo de Mídia Física. . . . . . : 14

Log de Diagnóstico de Rede

Nome do Arquivo: 6C569625-09A4-49B8-97F1-7A2DFD5EE3F6.Diagnose.Admin.0.etl

Outras configurações de rede e logs

Nome do Arquivo: NetworkConfiguration.cab Informações sobre coleção Nome do computador: RICARDO-PC Versão do Windows:

6.1

Arquitetura:

amd64

Hora:

terça-feira, 19 de agosto de 2014 20:21:37

Detalhes do editor

Diagnósticos de Rede do Windows Detecta problemas na conectividade de rede. Versão do Pacote:

1.0

Fornecedor:

Microsoft Windows

Adaptador de Rede Solucione problemas de Ethernet, sem fio ou outros tipos de adaptadores de rede. Versão do Pacote:

1.0

Fornecedor:

Microsoft Corporation

[DigRam 144]

Boa Noite! bobliks

 

|- Editei minha mensagem àcima,fazendo-lhe uma pergunta.

 

A+

[bobliks 0]

Sim, no Adaptador de Rede fala que "Não foram detectados problemas".

[DigRam 144]

Sim, no Adaptador de Rede fala que "Não foram detectados problemas".

Olá!

 

|- E a Internet continua caindo?

 

A+

[bobliks 0]

Por enquanto tudo está normal, irei esperar em torno de 1 dia para ver se está tudo OK.

Desde já lhe agradeço pela atenção e dedicação.

 

EDIT: amanhã ou caso aconteça algumas quedas antes disso, eu apareço para passar o feedback.

[DigRam 144]

Ok! bobliks

 

|- Acredito que o problema foi solucionado,mas...vamos aguardar até amanhã.

 

|- Ps: Como você,ainda,está online,execute estes comandos.

 

|- Abra o Prompt de comando e digite estas linhas.

netsh winsock reset catalog -> Confirme!

netsh int ip reset reset.log hit -> Confirme!

|- Digite uma por vez,e aperte Enter ao concluir.

|- Reinicie o computador!

Abs!

[bobliks 0]

Boa "Noite"/Madruga DigRam.

 

Mesmo depois de todos os procedimentos a internet caiu umas 10x em 1 hora, todas as vezes é uma média de 5~10segundos que cai e volta.

 

 

Att,

[DigRam 144]

Boa "Noite"/Madruga DigRam.

 

Mesmo depois de todos os procedimentos a internet caiu umas 10x em 1 hora, todas as vezes é uma média de 5~10segundos que cai e volta.

 

 

Att,

Ok! bobliks

 

|- Baixe: < Complete Internet Repair >

|- Extraia o conteúdo e execute o arquivo "CIntRep.exe".

|- Marque todas as checkbox e clique "Go!".

|- Ao concluir,reinicie o computador!

|- À seguir,acesse a pasta "Complete Internet Repair" >> "Logging".

|- Duplo-clique em "CIntRep.log".

|- Poste o log resultante!

Abs!