Douglas7F 0 Denunciar post Postado Janeiro 12, 2015 Hoje dia 13/01/2015 começou a aparecer Anúncios em sites, como no canto direito e em baixo no navegador Google Chrome... Não fiz nenhum download com ameaça nem nada, começou a aparecer de repente... Logs do Hijack> Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 15:58:39, on 13/01/2015 Platform: Windows 7 SP1 (WinNT 6.00.3505) MSIE: Internet Explorer v8.00 (8.00.7601.17514) Boot mode: Normal Running processes: C:\Windows\SOUNDMAN.EXE C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe C:\Program Files (x86)\Skype\Phone\Skype.exe F:\Users\Douglas\AppData\Roaming\uTorrent\uTorrent.exe C:\Program Files (x86)\Steam\Steam.exe C:\Program Files (x86)\AVG\AVG2014\avgui.exe C:\Windows\SysWOW64\ctfmon.exe F:\Users\Douglas\Desktop\GTA SA Multiplayer.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe C:\Windows\SysWOW64\DllHost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=userinit.exe O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [bCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2014\avgui.exe" /TRAYONLY O4 - HKCU\..\Run: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun O4 - HKCU\..\Run: [uTorrent] "F:\Users\Douglas\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun O4 - HKCU\..\Run: [steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [Dxtory Update Checker 2.0] F:\Dxtory2.0\UpdateChecker.exe O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL O23 - Service: Action! service (ACTION_SVC) - Unknown owner - F:\Action\Action!\action_svc.exe (file missing) O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe O23 - Service: Watchdog do AVG (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: NVIDIA GeForce Experience Service (GfExperienceService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe O23 - Service: Serviço do Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: KMService - Unknown owner - C:\Windows\system32\srvany.exe O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: NVIDIA Network Service (NvNetworkService) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe O23 - Service: NVIDIA Streamer Service (NvStreamSvc) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing) O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing) O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe O23 - Service: TeamViewer 9 (TeamViewer9) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 8328 bytes Grato. Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Janeiro 13, 2015 /!\ Boa Noite! Douglas7F /!\ > Baixe: < > ( ... by Smeenk ) < zoek.exe > > Salve-o ao desktop! > Desabilite seu antivírus! > Para Windows 7,execute Zoek.exe como administrador. QuickScan; ipconfig /flushdns;b skipsearchscopes-iedefaults; skipstartpage-iedefaults; emptytemp; autoclean; > Copie e cole estas informações,que estão em vermelho,no campo da ferramenta. > Clique "Run Script". Zoek.exe is running now. Do not start any browser windows, they will be closed automatically. Please wait! This window will close when finished. A logfile will open afterwards and can also be found on your systemdrive as zoek-results.log > Surgirão informações,pedindo-lhe que aguarde o surgimento do relatório. > Ps: Essas informações,podem permanecer estáticas na tela por 20 minutos ou mais. > Confirme o reboot! zoek.hta failed by unknown error. Restart computer, and try again. > Ps: Ao obter algum erro,reinicie o PC e execute,novamente,a ferramenta. > Poste o relatório,que estará em C:\zoek-results.txt << A+ Compartilhar este post Link para o post Compartilhar em outros sites
Douglas7F 0 Denunciar post Postado Janeiro 13, 2015 Boa Noite DigRam! Segue os Logs do Zoek.exe Zoek.exe v5.0.0.0 Updated 09-January-2015 Tool run by Douglas on 14/01/2015 at 0:08:39,56. Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64 Running in: Normal Mode Internet Access Detected Launched: F:\Users\Douglas\Desktop\zoek.exe [scan all users] [script inserted] ==== System Restore Info ====================== 14/01/2015 00:10:08 Zoek.exe System Restore Point Created Succesfully. ==== Empty Folders Check ====================== F:\Users\Douglas\AppData\Local\LogMeInIgnition deleted successfully ==== Deleting CLSID Registry Keys ====================== ==== Deleting CLSID Registry Values ====================== ==== Deleting Services ====================== ==== Batch Command(s) Run By Tool====================== ==== Deleting Files \ Folders ====================== C:\PROGRA~2\youtubeadblocker deleted C:\PROGRA~2\unIsaless deleted C:\PROGRA~2\Social Face deleted C:\PROGRA~3\ggpphdfbfbiopmbjgfbekfpappcjpocn deleted C:\PROGRA~3\18276084149869423539 deleted F:\Users\Douglas\AppData\Local\CrashRpt deleted F:\Users\Douglas\AppData\Roaming\Mozilla\Firefox\Profiles\2nd2ye2s.default\extensions\staged deleted ==== Files Recently Created / Modified ====================== ====== C:\Windows ==== ====== F:\Users\Douglas\AppData\Local\Temp ==== 2015-01-12 17:53:03 308EE9AB7739CC45C6C388A22207F179 5785088 ----a-w- F:\Users\Douglas\AppData\Local\Temp\Rar$EXa0.566\Alci's IMG Editor 1.5 [www.modsgtasa.com.br]\QtGui4.dll 2015-01-12 17:53:03 120EAA7EDB506D86657D8D8EF05568D1 2170368 ----a-w- F:\Users\Douglas\AppData\Local\Temp\Rar$EXa0.566\Alci's IMG Editor 1.5 [www.modsgtasa.com.br]\QtCore4.dll 2015-01-12 17:53:02 520D42AA501FF741E59133BD09BCCC44 244736 ----a-w- F:\Users\Douglas\AppData\Local\Temp\Rar$EXa0.566\Alci's IMG Editor 1.5 [www.modsgtasa.com.br]\Alci's IMG Editor 1.5.exe 2015-01-12 17:53:02 4E6CD621F37589E434F9FA2591B64380 15934 ----a-w- F:\Users\Douglas\AppData\Local\Temp\Rar$EXa0.566\Alci's IMG Editor 1.5 [www.modsgtasa.com.br]\mingwm10.dll 2015-01-12 17:47:34 74E4BC6781AB1439181F5D96FCA84E12 1217024 ----a-w- F:\Users\Douglas\AppData\Local\Temp\07C9a5fc\temp\Happyneyear.rar.exe ====== Java Cache ===== ====== C:\Windows\SysWOW64 ===== 2015-01-12 00:35:55 5D50C52E75BD2F4E7CCB82E163EB929B 8300544 ----a-w- C:\Windows\SysWOW64\DxtoryCodec.dll ====== C:\Windows\SysWOW64\drivers ===== ====== C:\Windows\Sysnative ===== 2015-01-12 00:35:55 E5304A81584836C716D2DA31E253B21E 8043008 ----a-w- C:\Windows\Sysnative\DxtoryCodec.dll ====== C:\Windows\Sysnative\drivers ===== ====== C:\Windows\Tasks ====== ====== C:\Windows\Temp ====== ======= C:\Program Files ===== ======= C:\PROGRA~2 ===== 2015-01-13 17:55:25 -------- d-----w- C:\PROGRA~2\Trend Micro 2015-01-12 17:49:17 -------- d-----w- C:\PROGRA~2\unisalees 2014-12-20 01:02:36 -------- d-----w- C:\PROGRA~2\Wise ======= F: ===== 2015-01-01 21:12:27 F37F688ABEF351D4CBF1B55CAE15BE35 462 ----a-w- F:\Disco Local © - Atalho.lnk ====== F:\Users\Douglas\AppData\Roaming ====== 2015-01-12 00:36:00 -------- d-----w- F:\Users\Douglas\AppData\Local\Dxtory Software 2014-12-29 01:05:25 -------- d-----w- F:\Users\Douglas\AppData\Local\Adobe 2014-12-20 01:02:42 -------- d-----w- F:\Users\Douglas\AppData\Roaming\Wise Game Booster ====== F:\Users\Douglas ====== 2015-01-12 17:47:19 A291AE1B2E930184680D35C02D7FB034 1217024 ----a-w- F:\Users\Douglas\Downloads\Happyneyear.rar (1).exe 2015-01-12 17:47:15 74E4BC6781AB1439181F5D96FCA84E12 1217024 ----a-w- F:\Users\Douglas\Downloads\Happyneyear.rar.exe 2015-01-12 00:35:55 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dxtory2.0 2015-01-01 19:23:45 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fraps 2015-01-01 06:53:49 535B74CCA495031E4331AAF7AF29101F 244624 ----a-w- F:\Users\Douglas\Downloads\InstallIMVU_514.0_st_c.exe 2014-12-20 01:02:37 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Game Booster ====== C: exe-files == 2015-01-12 17:49:18 8AF622327E2C6EF36DD2B147EC7D25B7 165888 ----a-w- C:\Program Files (x86)\unisalees\unisalees.exe 2015-01-11 18:07:05 5467CB7479FE288D897926D6A4B8196E 62992 ----a-w- C:\Program Files (x86)\AVG\AVG2014\avguirux.exe 2015-01-11 18:07:05 425520D5C08434D709B796B2C398A460 16912 ----a-w- C:\Program Files (x86)\AVG\AVG2014\avgrdtesta.exe 2015-01-11 18:07:04 BE0F8385014EF54DFF37FCEFEE254905 6019736 ----a-w- C:\Program Files (x86)\AVG\AVG2014\avgmfapx.exe 2015-01-11 18:07:04 210189A02C57B179A82F77E3B7C411F7 15888 ----a-w- C:\Program Files (x86)\AVG\AVG2014\avgrdtestx.exe === C: other files == ==== Startup Registry Enabled ====================== [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun" [HKEY_USERS\S-1-5-21-239397699-4216746181-2704838755-1002\Software\Microsoft\Windows\CurrentVersion\Run] "Skype"="C:\Program Files (x86)\Skype\Phone\Skype.exe /minimized /regrun" "uTorrent"="F:\Users\Douglas\AppData\Roaming\uTorrent\uTorrent.exe /MINIMIZED" "DAEMON Tools Lite"="C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe -autorun" "Steam"="C:\Program Files (x86)\Steam\Steam.exe -silent" "Dxtory Update Checker 2.0"="F:\Dxtory2.0\UpdateChecker.exe" [HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce] "mctadmin"="C:\Windows\System32\mctadmin.exe" [HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce] "mctadmin"="C:\Windows\System32\mctadmin.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Adobe Reader Speed Launcher"="C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" "Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "BCSSync"="C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe /DelayServices" "AVG_UI"="C:\Program Files (x86)\AVG\AVG2014\avgui.exe /TRAYONLY" [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Skype"="C:\Program Files (x86)\Skype\Phone\Skype.exe /minimized /regrun" "uTorrent"="F:\Users\Douglas\AppData\Roaming\uTorrent\uTorrent.exe /MINIMIZED" "DAEMON Tools Lite"="C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe -autorun" "Steam"="C:\Program Files (x86)\Steam\Steam.exe -silent" "Dxtory Update Checker 2.0"="F:\Dxtory2.0\UpdateChecker.exe" ==== Startup Registry Enabled x64 ====================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" "NvBackend"="C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" "ShadowPlay"="C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart" ==== Task Scheduler Jobs ====================== C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [24/10/2014 13:56] C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [24/10/2014 13:56] ==== Other Scheduled Tasks ====================== "C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe] "C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe] "C:\Windows\SysNative\tasks\User_Feed_Synchronization-{DF540B3E-B2E0-4AB1-AD26-3E5082A06D82}" [C:\Windows\system32\msfeedssync.exe] "C:\Windows\SysNative\tasks\{0043DE76-7AEF-4FB4-BD41-E8F4C116F0E4}" ["c:\program files (x86)\mozilla firefox\firefox.exe"] "C:\Windows\SysNative\tasks\{00D044DE-E8DE-4EAD-A7BB-A90EDACBB21C}" ["c:\program files (x86)\mozilla firefox\firefox.exe"] "C:\Windows\SysNative\tasks\{DC1BF628-6822-459D-823F-68C36D03635B}" ["c:\program files (x86)\mozilla firefox\firefox.exe"] "C:\Windows\SysNative\tasks\{E4A011E2-6480-493C-8C3C-F5FDD6CE1C2A}" ["c:\program files (x86)\mozilla firefox\firefox.exe"] "C:\Windows\SysNative\tasks\{EEBA40E3-8FFA-47BD-AEFB-BCBA71A822BE}" ["C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://www.skype.com/go/downloading?source=lightinstaller&ver=6.3.0.107&LastError=404] "C:\Windows\SysNative\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask" [%systemroot%\system32\sc.exe start osppsvc] ==== Firefox Start and Search pages ====================== ProfilePath: F:\Users\Douglas\AppData\Roaming\Mozilla\Firefox\Profiles\2nd2ye2s.default user_pref("browser.startup.homepage", "http://www.google.com/"); ==== Firefox Extensions ====================== AppDir: C:\Program Files (x86)\Mozilla Firefox - Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} - Skype Click to Call - %AppDir%\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi ==== Firefox Plugins ====================== Profilepath: F:\Users\Douglas\AppData\Roaming\Mozilla\Firefox\Profiles\2nd2ye2s.default 5599683705687DD14E5052423FAFEE00 - F:\Users\Douglas\AppData\Roaming\raidcall\plugins\nprcplugin.dll - Raidcall plugin 0015C790161C5698FDDC22613C19533B - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1214154.dll - Shockwave for Director / Shockwave for Director ==== Chromium Look ====================== Google Chrome Version: 39.0.2171.95 (Up to date, latest Stable version: 39.0.2171.95) Social Face - Douglas\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpphkkgodbfncbcpgopijlfakfgmclao Google Wallet - Douglas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda ==== Chromium Fix ====================== F:\Users\Douglas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.audienceinsights.net_0.localstorage deleted successfully F:\Users\Douglas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.audienceinsights.net_0.localstorage-journal deleted successfully F:\Users\Douglas\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpphkkgodbfncbcpgopijlfakfgmclao deleted successfully F:\Users\Douglas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bpphkkgodbfncbcpgopijlfakfgmclao_0.localstorage deleted successfully F:\Users\Douglas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bpphkkgodbfncbcpgopijlfakfgmclao_0.localstorage-journal deleted successfully ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.google.com" New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://www.google.com" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes "DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}" {012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}" {0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" ==== Deleting Registry Keys ====================== HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4820778D-AB0D-6D18-C316-52A6A0E1D507} deleted successfully HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4CEE92A3-9F0C-51AB-ADC0-34EC24AD7B7E} deleted successfully HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613} deleted successfully ==== Empty IE Cache ====================== C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully F:\Users\Douglas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully F:\Users\Douglas\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully F:\Users\Douglas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\15XV1YHG will be deleted at reboot F:\Users\Douglas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4C5TMTMR will be deleted at reboot F:\Users\Douglas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5J43GS3B will be deleted at reboot F:\Users\Douglas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7FDPV2ZV will be deleted at reboot F:\Users\Douglas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QJLUO073 will be deleted at reboot F:\Users\Douglas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot ==== Empty FireFox Cache ====================== F:\Users\Douglas\AppData\Local\Mozilla\Firefox\Profiles\2nd2ye2s.default\cache2 emptied successfully ==== Empty Chrome Cache ====================== F:\Users\Douglas\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== No Java Cache Found ==== C:\zoek_backup content ====================== C:\zoek_backup (files=86 folders=46 18226102 bytes) ==== Empty Temp Folders ====================== F:\Users\Douglas\AppData\Local\Temp will be emptied at reboot C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully C:\Windows\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\Windows\Temp successfully emptied ==== Empty Recycle Bin ====================== C:\$RECYCLE.BIN successfully emptied ==== Deleting Files / Folders ====================== "F:\Users\Douglas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not found "F:\Users\Douglas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\15XV1YHG" not found "F:\Users\Douglas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4C5TMTMR" not found "F:\Users\Douglas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5J43GS3B" not found "F:\Users\Douglas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7FDPV2ZV" not found "F:\Users\Douglas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QJLUO073" not found "C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp\Low" not deleted ==== EOF on 14/01/2015 at 0:34:23,96 ====================== Não vejo mais nenhum Ads, e o navegador está como de costume! Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Janeiro 14, 2015 /!\ Boa Noite! Douglas7F /!\ > Baixe: < > ( ... par Xplode ) > > Ou daqui: < AdwCleaner > > Ao acessar,clique em "Download Now". > > Salve-o no desktop! < > > Clique direito em adwcleaner.exe,e escolha sua execução como administrador. > Ps: Dê início ao scan,clicando em "Examinar". > Ao concluir,clique "Limpar" >> Ok >> Ok >> Ok. > Copie o log ou clique "Relatório". > Poste: < C:\AdwCleaner\AdwCleaner[s0].txt > A+ Compartilhar este post Link para o post Compartilhar em outros sites
Douglas7F 0 Denunciar post Postado Janeiro 14, 2015 Boa tarde, DigRam! Segue os logs do adwcleaner> # AdwCleaner v4.107 - Relatório criado 15/01/2015 às 18:16:03 # Atualizado 07/01/2015 por Xplode # Database : 2015-01-13.2 [Live] # Sistema Operacional : Windows 7 Ultimate Service Pack 1 (64 bits) # Usuário : Douglas - DOUGLAS-PC # Executando de : F:\Users\Douglas\Desktop\adwcleaner_4.107.exe # Opção : Limpar ***** [ Serviços ] ***** [#] Serviço Deletada : fc67e7a0 ***** [ Arquivos / Pastas ] ***** ***** [ Tarefas ] ***** ***** [ Atalhos ] ***** ***** [ Registro ] ***** Chave Deletedo : HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA} Chave Deletedo : HKLM\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA} ***** [ Navegadores ] ***** -\\ Internet Explorer v8.0.7601.17514 -\\ Mozilla Firefox v33.0 (x86 pt-BR) -\\ Google Chrome v39.0.2171.95 [F:\Users\Douglas\AppData\Local\Google\Chrome\User Data\Default\preferences] - Deletedo [Extension] : bpphkkgodbfncbcpgopijlfakfgmclao ************************* AdwCleaner[R0].txt - [1128 octets] - [15/01/2015 18:10:23] AdwCleaner[s0].txt - [1043 octets] - [15/01/2015 18:16:03] ########## EOF - F:\AdwCleaner\AdwCleaner[s0].txt - [1103 octets] ########## Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Janeiro 14, 2015 /!\ Boa Noite! Douglas7F /!\ > Caso não haja mais problemas,remova as ferramentas que foram utilizadas na desinfecção! > Baixe: < > ( ... de Xplode ) > Estando na página,clique em Download Now. > Salve-a em um local conveniente! ( desktop! ) > Feche aplicativos que estejam abertos. > Remover ferramentas de desinfecção > Criar backup do registro > Limpar pontos da restauração do sistema > Com estas caixinhas marcadas,clique Executar! > Reinicie o computador ao concluir! > Tudo Ok? A+ Compartilhar este post Link para o post Compartilhar em outros sites
Douglas7F 0 Denunciar post Postado Janeiro 15, 2015 Boa Noite, DigRam! Não sei se é necessário, mas segue os logs do DelFix> # DelFix v10.8 - Relatório criado 16/01/2015 às 01:11:16 # Atualizado 29/07/2014 por Xplode # Usuário : Douglas - DOUGLAS-PC # Sistema Operacional : Windows 7 Ultimate Service Pack 1 (64 bits) ~ Removendo ferramentas de desinfecção ... Removido : F:\AdwCleaner Removido : C:\Program Files (x86)\Trend Micro\Hijackthis Removido : F:\zoek-results.log Removido : F:\Users\Douglas\Desktop\adwcleaner_4.107.exe Removido : F:\Users\Douglas\Desktop\HiJackThis.lnk Removido : F:\Users\Douglas\Desktop\zoek.exe Removido : F:\Users\Douglas\Downloads\adwcleaner_4.107.exe Removido : F:\Users\Douglas\Downloads\HijackThis.msi Removido : F:\Users\Douglas\Downloads\zoek.exe Removido : HKLM\SOFTWARE\AdwCleaner ~ Criando backup do registro ... OK ~ Limpando pontos da restauração do sistema ... Novo ponto de restauração criado ! ########## - EOF - ########## Tudo Ok Sim! Não vejo mais nenhum ads, e navegador está como de costume, obrigado! Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Janeiro 15, 2015 PROBLEMA RESOLVIDO Caso o autor necessite que o tópico seja reaberto basta enviar uma Mensagem Privada para um Moderador com um link para o tópico. Compartilhar este post Link para o post Compartilhar em outros sites
