britadinha

Membro
  • Total de itens

    148
  • Registro em

  • Última visita

Reputação

0 Neutral

Sobre britadinha

  • Rank
    Membro
  • Data de Nascimento 15-03-1977

Contact Methods

  • ICQ
    0

Profile Information

  • Sexo
    Feminino

Últimos Visitantes

234 visualizações
  1. Boa noite!

    Estou tentando enviar o post, mas estou meio perdida meu Pc esta infectado e queria ajuda de vocês para resolver . 

    Já fiz isso outras vezes mas com a mudança do site ,n sei mais como proceder. você pode me orientar por favor

    obrigada!

    1. Ciro-Mota

      Ciro-Mota

      Boa tarde.

      Como pode ver, o serviço de Remoção de Malwares foi ENCERRADO e novos tópicos ou análises não são/serão mais realizadas.

    2. britadinha

      britadinha

      Que pena, Obrigada!

  2. Ajudinha por favor! Obrigada:)
  3. Problema de junta, dficil eh encontrar a tal da memoria.. obrigada então,, sem mais...
  4. Bom dia ! Segui suas orientações mas a lentidão ainda continua.. as pagina levam uma eternidade para abrir , bem como arquivos...
  5. C:\AdwCleaner\Quarantine\C\Program Files (x86)\YTAHelper\YTAHelper.dll.vir a variant of Win32/ShopperPro.A potentially unwanted application C:\AdwCleaner\Quarantine\C\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe.vir a variant of Win32/ELEX.AM potentially unwanted application C:\AdwCleaner\Quarantine\C\ProgramData\YTAHelper\YTAHelper.dll.vir a variant of Win32/ShopperPro.A potentially unwanted application C:\AdwCleaner\Quarantine\C\Users\Cecilia\AppData\Local\Mobogenie\Version\CacheVersion\Mobogenie2.1.29.zip.vir a variant of Win32/Mobogenie.A potentially unwanted application C:\AdwCleaner\Quarantine\C\Users\Cecilia\AppData\Roaming\UpdaterEX\UpdateProc\UpdateTask.exe.vir a variant of Win32/DealPly.S potentially unwanted application C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-japan.exe a variant of Win32/Hao123.A potentially unwanted application C:\Program Files (x86)\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst.exe a variant of Win32/Hao123.A potentially unwanted application C:\Users\Cecilia\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\cigiagpbkapepgklncnajbakkpkopmam\1.26.318_0\extensionData\plugins\91.js JS/Toolbar.Crossrider.B potentially unwanted application AdwCleanerR4.txt AdwCleanerR5.txt AdwCleanerS3.txt
  6. Nao consegui copira o Adwcleaner , achei q fiz o a verificação conforme orientação, mas nao consegui copiar o relatório do ADWcleaner, achei q ele ficaria salvo no pc , mas ja procurei e não consegui localizá-lo, como procedo? MbrScan.log MbrScan.txt Walare.txt MbrScan.txt MbrScan.log Walare.txt
  7. TAÍ otl.txt
  8. OTL logfile created on: 18/09/2014 09:45:03 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Cecilia\Downloads 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.11.9600.17280) Locale: 00000416 | Country: Brasil | Language: PTB | Date Format: dd/MM/yyyy 1014,24 Mb Total Physical Memory | 220,13 Mb Available Physical Memory | 21,70% Memory free 2,15 Gb Paging File | 0,46 Gb Available in Paging File | 21,58% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 298,09 Gb Total Space | 238,97 Gb Free Space | 80,17% Space Free | Partition Type: NTFS Computer Name: CECILIA-PC | User Name: Cecilia | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2014/09/18 09:41:29 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Cecilia\Downloads\OTL.exe PRC - [2014/09/16 08:40:45 | 000,106,488 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\afwServ.exe PRC - [2014/08/26 21:07:02 | 000,620,872 | ---- | M] () -- C:\Program Files (x86)\PSafe\Total\safemon\QHActiveDefense.exe PRC - [2014/08/16 09:23:35 | 004,085,896 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\avastui.exe PRC - [2014/08/16 09:20:22 | 000,808,448 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe PRC - [2014/08/16 09:20:22 | 000,050,344 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe PRC - [2014/07/25 02:54:19 | 002,233,696 | ---- | M] () -- C:\Program Files (x86)\PSafe\Total\safemon\QHSafeTray.exe PRC - [2014/07/03 09:03:01 | 000,535,936 | ---- | M] (Fuyu LIMITED) -- C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe PRC - [2014/06/05 10:58:39 | 000,860,488 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe PRC - [2014/04/21 18:05:56 | 002,295,584 | ---- | M] (IObit) -- C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCTray.exe PRC - [2014/01/14 14:50:06 | 000,881,952 | ---- | M] (IObit) -- C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCService.exe ========== Modules (No Company Name) ========== MOD - [2014/08/16 09:20:25 | 019,329,904 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\libcef.dll MOD - [2014/08/16 09:20:23 | 000,301,152 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\aswProperty.dll MOD - [2014/07/25 02:54:19 | 002,233,696 | ---- | M] () -- C:\Program Files (x86)\PSafe\Total\safemon\QHSafeTray.exe MOD - [2013/09/05 00:14:10 | 004,300,456 | ---- | M] () -- C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf MOD - [2013/01/15 18:47:56 | 000,893,248 | ---- | M] () -- C:\Program Files (x86)\IObit\Advanced SystemCare 7\webres.dll ========== Services (SafeList) ========== SRV:64bit: - [2014/09/16 08:40:45 | 000,106,488 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\afwServ.exe -- (avast! Firewall) SRV:64bit: - [2014/08/18 19:03:37 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService) SRV:64bit: - [2014/08/16 09:20:22 | 000,050,344 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus) SRV:64bit: - [2014/06/26 10:12:50 | 002,346,880 | ---- | M] (ShopperPro) [Auto | Running] -- C:\Program Files\Common Files\ShopperPro\spbiu.exe -- (SPBIUpd) SRV:64bit: - [2013/05/27 02:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV:64bit: - [2012/11/08 07:34:30 | 000,126,856 | ---- | M] (HP) [Auto | Running] -- C:\Windows\SysNative\HPSIsvc.exe -- (HPSIService) SRV:64bit: - [2009/07/13 22:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2014/09/10 09:55:16 | 000,267,440 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2014/08/26 21:07:02 | 000,620,872 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\PSafe\Total\safemon\QHActiveDefense.exe -- (QHActiveDefense) SRV - [2014/07/03 09:03:01 | 000,535,936 | ---- | M] (Fuyu LIMITED) [Auto | Running] -- C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe -- (WindowsMangerProtect) SRV - [2014/05/04 16:37:30 | 002,152,736 | ---- | M] (IObit) [On_Demand | Stopped] -- C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe -- (LiveUpdateSvc) SRV - [2014/03/20 19:49:18 | 000,067,224 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2014/01/14 14:50:06 | 000,881,952 | ---- | M] (IObit) [Auto | Running] -- C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCService.exe -- (AdvancedSystemCareService7) SRV - [2013/10/03 10:44:22 | 000,008,192 | ---- | M] () [On_Demand | Stopped] -- C:\Windows\SysWOW64\srvany.exe -- (KMService) SRV - [2012/09/05 22:25:06 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2014/09/16 08:40:58 | 000,028,184 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswKbd.sys -- (aswKbd) DRV:64bit: - [2014/09/16 08:40:46 | 000,448,400 | ---- | M] (AVAST Software) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswNdisFlt.sys -- (aswNdisFlt) DRV:64bit: - [2014/08/16 09:23:29 | 000,427,360 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswsp.sys -- (aswSP) DRV:64bit: - [2014/08/16 09:20:32 | 001,041,168 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx) DRV:64bit: - [2014/08/16 09:20:32 | 000,224,896 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswVmm.sys -- (aswVmm) DRV:64bit: - [2014/08/16 09:20:32 | 000,092,008 | ---- | M] (AVAST Software) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aswStm.sys -- (aswStm) DRV:64bit: - [2014/08/16 09:20:32 | 000,079,184 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt) DRV:64bit: - [2014/08/16 09:20:32 | 000,065,776 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt) DRV:64bit: - [2014/08/16 09:20:32 | 000,029,208 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aswHwid.sys -- (aswHwid) DRV:64bit: - [2014/08/16 09:20:31 | 000,093,568 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr) DRV:64bit: - [2014/07/25 02:54:19 | 000,305,736 | ---- | M] (360.cn) [File_System | System | Running] -- C:\Windows\SysNative\drivers\360Box64.sys -- (360Box64) DRV:64bit: - [2014/07/25 02:54:19 | 000,100,424 | ---- | M] (360.cn) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\360AntiHacker64.sys -- (360AntiHacker) DRV:64bit: - [2014/07/25 02:54:18 | 000,311,888 | ---- | M] (Qihu 360 Software Co., Ltd.) [File_System | System | Running] -- C:\Windows\SysNative\drivers\360fsflt.sys -- (360FsFlt) DRV:64bit: - [2014/07/25 02:54:18 | 000,077,896 | ---- | M] (360.cn) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\360AvFlt.sys -- (360AvFlt) DRV:64bit: - [2014/06/26 10:12:50 | 000,041,856 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\ShopperPro\spbiw.sys -- (SPBIUpdd) DRV:64bit: - [2014/05/20 16:39:56 | 000,460,888 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\46570128.sys -- (46570128) DRV:64bit: - [2014/05/20 16:39:56 | 000,460,888 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\26282273.sys -- (26282273) DRV:64bit: - [2014/04/18 03:42:48 | 000,180,816 | ---- | M] (Qihu 360 Software Co., Ltd.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\BAPIDRV64.SYS -- (BAPIDRV) DRV:64bit: - [2012/11/08 00:00:47 | 000,019,968 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mvusbews.sys -- (mvusbews) DRV:64bit: - [2012/03/01 03:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011/03/11 03:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011/03/11 03:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010/11/20 10:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010/11/20 08:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010/11/20 08:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2010/01/06 02:23:18 | 001,847,296 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\athurx.sys -- (athur) DRV:64bit: - [2009/09/23 19:23:02 | 006,180,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2009/07/13 22:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009/07/13 22:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009/07/13 22:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009/06/10 17:35:42 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2009/06/10 17:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009/06/10 17:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009/06/10 17:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009/06/10 17:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV - [2014/06/16 10:17:03 | 000,110,336 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\Spring64.sys -- (Spring) DRV - [2009/07/13 22:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1404388931&from=smt&uid=SAMSUNGXHD322HJ_S1RLJ50S414700&q={searchTerms} IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.google.com/ IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.msn.com/?pc=AV01 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=AV01 IE - HKLM\..\SearchScopes,DefaultScope = {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{632F07F3-19A1-4d16-A23F-E6CE9486BAB5}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.msn.com/?pc=AV01 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=AV01 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = pt-br IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D0 C6 E5 A5 65 CA CE 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} IE - HKCU\..\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}: "URL" = http://www.trovi.com/Results.aspx?gd=&ctid=CT3330567&octid=EB_ORIGINAL_CTID&ISID=E9CD9AC4-AA3E-48DB-AFB5-D865F2DCC120&SearchSource=58&CUI=&UM=6&UP=SP75F3E98F-462C-41D3-9459-23A05E01D944&q={searchTerms}&SSPV= IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR IE - HKCU\..\SearchScopes\{632F07F3-19A1-4d16-A23F-E6CE9486BAB5}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 IE - HKCU\..\SearchScopes\Web: "URL" = http://br.yhs4.search.yahoo.com/yhs/search?hspart=baixaki&hsimp=yhs-baixaki_br_solimba_01&p={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "omiga-plus" FF - prefs.js..extensions.enabledAddons: {746505DC-0E21-4667-97F8-72EA6BCF5EEF}:1.0.0.4 FF - prefs.js..extensions.enabledAddons: ascsurfingprotection@iobit.com:1.0 FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.5.2: C:\Program Files (x86)\Java\jre8\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.5.2: C:\Program Files (x86)\Java\jre8\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files (x86)\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files (x86)\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\faststartff@gmail.com: C:\Users\Cecilia\AppData\Roaming\Mozilla\Firefox\Profiles\kuyda0o1.default\extensions\faststartff@gmail.com FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2014/09/16 08:41:05 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/10/03 10:48:51 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013/10/04 10:56:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Cecilia\AppData\Roaming\mozilla\Extensions [2014/09/17 08:36:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\kuyda0o1.default\extensions [2014/07/03 09:04:41 | 000,000,000 | ---D | M] (Shopper-Pro) -- C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\kuyda0o1.default\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF} [2014/07/10 09:24:40 | 000,000,000 | ---D | M] (Advanced SystemCare Surfing Protection) -- C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\kuyda0o1.default\extensions\ascsurfingprotection@iobit.com [2014/09/16 09:11:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\kuyda0o1.default\extensions\trash [2014/08/13 08:41:57 | 000,226,542 | ---- | M] () (No name found) -- C:\Users\Cecilia\AppData\Roaming\mozilla\firefox\profiles\kuyda0o1.default\extensions\firefox-hotfix@mozilla.org.xpi [2014/08/08 08:16:10 | 000,226,542 | ---- | M] () (No name found) -- C:\Users\Cecilia\AppData\Roaming\mozilla\firefox\profiles\kuyda0o1.default\extensions\trash\firefox-hotfix@mozilla.org.xpi [2014/06/11 09:07:53 | 000,002,104 | ---- | M] () -- C:\Users\Cecilia\AppData\Roaming\mozilla\firefox\profiles\kuyda0o1.default\searchplugins\search_the_web.xml [2014/07/03 09:47:27 | 000,000,642 | ---- | M] () -- C:\Users\Cecilia\AppData\Roaming\mozilla\firefox\profiles\kuyda0o1.default\searchplugins\trovi-search.xml [2013/10/03 10:48:51 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012/09/05 22:26:03 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012/09/06 00:10:20 | 000,001,027 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\buscape.xml [2012/09/06 00:10:20 | 000,001,212 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\mercadolivre.xml [2014/07/03 09:02:16 | 000,000,566 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\omiga-plus.xml [2012/09/06 00:10:20 | 000,002,253 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml [2012/09/06 00:10:20 | 000,001,168 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-br.xml [2012/09/06 00:10:20 | 000,000,952 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-br.xml ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter}, CHR - homepage: www.google.com CHR - plugin: Error reading preferences file CHR - Extension: Google Drive = C:\Users\Cecilia\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\ CHR - Extension: YouTube = C:\Users\Cecilia\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\ CHR - Extension: Adblock Plus = C:\Users\Cecilia\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.8.5_0\ CHR - Extension: Pesquisa do Google = C:\Users\Cecilia\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\ CHR - Extension: avast! Online Security = C:\Users\Cecilia\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\9.0.2022.121_0\ CHR - Extension: Quick start = C:\Users\Cecilia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma\4.5.8_0\ CHR - Extension: Gmail = C:\Users\Cecilia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\ O1 HOSTS File: ([2014/06/19 12:07:02 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2:64bit: - BHO: (ExplorerWnd Helper) - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit) O2:64bit: - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) O2:64bit: - BHO: (no name) - {FCE3FA8B-BA81-467C-81D8-E43C00D1BC71} - No CLSID value found. O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre8\bin\ssv.dll (Oracle Corporation) O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Advanced SystemCare Browser Protection) - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\PROGRA~2\IObit\SURFIN~1\BROWER~1\ASCPLU~1.DLL (IObit) O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre8\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (no name) - {FCE3FA8B-BA81-467C-81D8-E43C00D1BC71} - No CLSID value found. O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software) O4 - HKLM..\Run: [QHSafeTray] C:\Program Files (x86)\PSafe\Total\safemon\QHSafeTray.exe () O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8:64bit: - Extra context menu item: &Enviar para o OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found O8:64bit: - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found O8 - Extra context menu item: &Enviar para o OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EFC04838-9930-4180-AF8D-0425B69AAD0D}: DhcpNameServer = 192.168.0.1 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2014/07/04 09:29:01 | 000,000,000 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.ac3acm - C:\Windows\SysWow64\ac3acm.acm (fccHandler) Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.lameacm - C:\Windows\SysWow64\lameACM.acm (http://www.mp3dev.org/) Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.) Drivers32: VIDC.DIVX - C:\Windows\SysWow64\divx.dll (DivX, Inc.) Drivers32: VIDC.FFDS - C:\Windows\SysWow64\ff_vfw.dll () Drivers32: VIDC.FMVC - C:\Windows\SysWow64\fmcodec.DLL (Fox Magic Software) Drivers32: VIDC.XVID - C:\Windows\SysWow64\xvidvfw.dll () Drivers32: VIDC.YV12 - C:\Windows\SysWow64\yv12vfw.dll (www.helixcommunity.org) ========== Files/Folders - Created Within 30 Days ========== [2014/09/18 09:16:25 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Wat [2014/09/18 09:16:25 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Wat [2014/09/16 09:04:01 | 000,000,000 | ---D | C] -- C:\zoek_backup [2014/09/16 09:01:21 | 000,000,000 | ---D | C] -- C:\Users\Cecilia\Desktop\Linha defensiva [2014/09/16 08:41:37 | 000,028,184 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswKbd.sys [2014/09/16 08:40:46 | 000,448,400 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswNdisFlt.sys [2014/09/10 12:46:14 | 000,596,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2014/09/10 12:46:14 | 000,440,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2014/09/10 12:46:11 | 000,083,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MshtmlDac.dll [2014/09/10 12:46:11 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MshtmlDac.dll [2014/09/10 12:46:11 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll [2014/09/10 12:46:10 | 000,758,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll [2014/09/10 12:46:10 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\JavaScriptCollectionAgent.dll [2014/09/10 12:46:10 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll [2014/09/10 12:46:09 | 000,446,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtmsft.dll [2014/09/10 12:46:09 | 000,289,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dxtrans.dll [2014/09/10 12:46:09 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2014/09/10 12:46:09 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2014/09/10 12:46:08 | 000,547,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2014/09/10 12:46:08 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll [2014/09/10 12:46:08 | 000,164,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll [2014/09/10 12:46:08 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2014/09/10 12:46:07 | 000,727,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2014/09/10 12:46:07 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2014/09/10 12:46:07 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2014/09/10 12:46:06 | 000,707,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe [2014/09/10 12:46:06 | 000,066,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll [2014/09/10 12:46:06 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2014/09/10 12:46:05 | 000,597,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll [2014/09/10 12:46:05 | 000,060,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll [2014/09/10 12:46:03 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll [2014/09/10 12:46:02 | 001,249,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmlmedia.dll [2014/09/10 12:46:02 | 000,775,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll [2014/09/10 12:46:02 | 000,678,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll [2014/09/10 12:46:02 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll [2014/09/10 12:46:01 | 001,068,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmlmedia.dll [2014/09/10 12:46:01 | 000,940,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe [2014/09/10 12:46:01 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe [2014/09/10 12:45:55 | 005,833,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2014/09/10 12:45:53 | 002,104,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2014/09/10 12:45:53 | 002,014,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2014/09/10 09:19:22 | 001,460,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll [2014/08/28 08:14:09 | 000,404,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\gdi32.dll [2014/08/21 08:20:02 | 000,058,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuauclt.exe [2014/08/21 08:20:02 | 000,044,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups2.dll [2014/08/21 08:20:01 | 002,620,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wucltux.dll [2014/08/21 08:19:20 | 000,097,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wudriver.dll [2014/08/21 08:19:20 | 000,038,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wups.dll [2014/08/21 08:19:19 | 000,700,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapi.dll [2014/08/21 08:19:19 | 000,581,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wuapi.dll [2014/08/21 08:19:19 | 000,092,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wudriver.dll [2014/08/21 08:19:19 | 000,036,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wups.dll [2014/08/21 08:17:37 | 000,179,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wuwebv.dll [2014/08/21 08:17:35 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wuapp.exe [2014/08/21 08:17:34 | 000,198,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuwebv.dll [2014/08/21 08:17:33 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wuapp.exe [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2014/09/18 10:00:49 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2014/09/18 09:22:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2014/09/18 09:22:34 | 797,630,464 | -HS- | M] () -- C:\hiberfil.sys [2014/09/18 09:20:53 | 000,019,360 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2014/09/18 09:20:45 | 000,019,360 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2014/09/18 09:17:07 | 000,014,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\slwga.dll [2014/09/18 09:17:07 | 000,013,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\slwga.dll [2014/09/18 09:17:05 | 000,419,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\systemcpl.dll [2014/09/18 09:13:45 | 001,008,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\user32.dll [2014/09/17 08:36:15 | 000,001,116 | ---- | M] () -- C:\Users\Cecilia\Desktop\Internet Explore.lnk [2014/09/17 08:36:11 | 000,002,169 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2014/09/16 08:46:32 | 000,001,932 | ---- | M] () -- C:\Users\Public\Desktop\avast! Internet Security.lnk [2014/09/16 08:40:58 | 000,028,184 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswKbd.sys [2014/09/16 08:40:46 | 000,448,400 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswNdisFlt.sys [2014/09/13 14:42:59 | 000,002,209 | ---- | M] () -- C:\Users\Public\Desktop\Advanced SystemCare 7.lnk [2014/09/12 08:42:17 | 000,955,952 | ---- | M] () -- C:\Windows\SysNative\prfh0416.dat [2014/09/12 08:42:17 | 000,908,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2014/09/12 08:42:17 | 000,405,132 | ---- | M] () -- C:\Windows\SysNative\prfc0416.dat [2014/09/12 08:42:17 | 000,383,158 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2014/09/12 08:42:17 | 000,005,196 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2014/09/11 14:01:34 | 000,410,520 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2014/09/11 13:59:45 | 000,000,000 | ---- | M] () -- C:\asc_rdflag [2014/09/10 09:55:14 | 000,701,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2014/09/10 09:55:13 | 000,071,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2014/09/05 11:51:35 | 000,014,948 | ---- | M] () -- C:\ProgramData\P1210OS.HTM [2014/08/22 23:07:00 | 000,404,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\gdi32.dll [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2014/09/16 08:46:32 | 000,001,932 | ---- | C] () -- C:\Users\Public\Desktop\avast! Internet Security.lnk [2014/09/11 14:01:17 | 000,410,520 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT [2014/09/11 13:59:45 | 000,000,000 | ---- | C] () -- C:\asc_rdflag [2014/09/05 11:51:35 | 000,024,772 | ---- | C] () -- C:\ProgramData\P1210DEF.css [2014/09/05 11:51:35 | 000,014,948 | ---- | C] () -- C:\ProgramData\P1210OS.HTM [2014/09/05 11:51:35 | 000,002,944 | ---- | C] () -- C:\ProgramData\P1210SIG.GIF [2014/01/27 10:30:07 | 000,000,100 | ---- | C] () -- C:\Users\Cecilia\AppData\Roaming\WB.CFG [2013/10/03 10:48:04 | 000,164,352 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll [2013/10/03 10:48:04 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini [2013/10/03 10:48:02 | 000,795,648 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll [2013/10/03 10:48:02 | 000,130,048 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll [2013/10/03 10:48:01 | 003,596,288 | ---- | C] () -- C:\Windows\SysWow64\qt-dx331.dll [2013/10/03 10:48:00 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll [2013/10/03 10:45:04 | 000,151,552 | ---- | C] () -- C:\Windows\KMService.exe [2013/10/03 10:45:04 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\srvany.exe ========== ZeroAccess Check ========== [2009/07/14 01:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2014/03/24 23:43:12 | 014,175,744 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2014/03/24 23:09:54 | 012,874,240 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 22:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 09:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 22:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2014/08/05 09:01:11 | 000,000,000 | -HSD | M] -- C:\Users\Cecilia\AppData\Roaming\360Quarant [2014/08/13 09:31:50 | 000,000,000 | ---D | M] -- C:\Users\Cecilia\AppData\Roaming\360safe [2014/09/03 16:25:38 | 000,000,000 | ---D | M] -- C:\Users\Cecilia\AppData\Roaming\Audacity [2014/08/16 09:32:14 | 000,000,000 | ---D | M] -- C:\Users\Cecilia\AppData\Roaming\AVAST Software [2014/07/03 09:08:28 | 000,000,000 | ---D | M] -- C:\Users\Cecilia\AppData\Roaming\baidu [2014/06/11 09:11:31 | 000,000,000 | ---D | M] -- C:\Users\Cecilia\AppData\Roaming\Baidu Security [2014/08/16 09:51:41 | 000,000,000 | ---D | M] -- C:\Users\Cecilia\AppData\Roaming\Dropbox [2014/08/16 09:51:39 | 000,000,000 | ---D | M] -- C:\Users\Cecilia\AppData\Roaming\DropboxMaster [2014/07/10 09:24:43 | 000,000,000 | ---D | M] -- C:\Users\Cecilia\AppData\Roaming\IObit [2013/11/14 11:04:17 | 000,000,000 | ---D | M] -- C:\Users\Cecilia\AppData\Roaming\PhotoScape [2014/07/22 09:08:31 | 000,000,000 | ---D | M] -- C:\Users\Cecilia\AppData\Roaming\ProductData [2014/06/18 08:58:18 | 000,000,000 | ---D | M] -- C:\Users\Cecilia\AppData\Roaming\Uniblue ========== Purity Check ========== ========== Custom Scans ========== < %systemroot%\system32\drivers\*.* /90 > < %userprofile%\*.* > [2014/09/18 10:11:22 | 006,045,696 | ---- | M] () -- C:\Users\Cecilia\ntuser.dat [2014/09/11 11:18:05 | 006,045,696 | ---- | M] () -- C:\Users\Cecilia\ntuser.dat.iobit [2014/09/11 13:59:49 | 006,045,696 | ---- | M] () -- C:\Users\Cecilia\NTUSER.DAT.iodefrag.bak [2014/09/18 10:11:22 | 000,262,144 | -HS- | M] () -- C:\Users\Cecilia\ntuser.dat.LOG1 [2013/10/03 10:23:05 | 000,000,000 | -HS- | M] () -- C:\Users\Cecilia\ntuser.dat.LOG2 [2013/10/03 10:23:05 | 000,065,536 | -HS- | M] () -- C:\Users\Cecilia\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf [2013/10/03 10:23:05 | 000,524,288 | -HS- | M] () -- C:\Users\Cecilia\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms [2013/10/03 10:23:05 | 000,524,288 | -HS- | M] () -- C:\Users\Cecilia\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms [2013/10/03 10:23:05 | 000,000,020 | -HS- | M] () -- C:\Users\Cecilia\ntuser.ini < %SYSTEMDRIVE%\*.* > [2014/09/11 13:59:45 | 000,000,000 | ---- | M] () -- C:\asc_rdflag [2014/07/04 09:29:01 | 000,000,000 | ---- | M] () -- C:\autoexec.bat [2010/11/20 09:40:07 | 000,383,786 | RHS- | M] () -- C:\bootmgr [2013/10/03 09:31:28 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK [2014/09/18 09:22:34 | 797,630,464 | -HS- | M] () -- C:\hiberfil.sys [2013/10/07 08:45:54 | 000,209,500 | ---- | M] () -- C:\M1120.log [2013/10/05 11:18:24 | 000,537,930 | ---- | M] () -- C:\M11201.log [2006/12/01 23:37:14 | 000,904,704 | ---- | M] (Microsoft Corporation) -- C:\msdia80.dll [2014/09/18 09:35:13 | 1248,854,016 | -HS- | M] () -- C:\pagefile.sys [2014/09/16 09:15:51 | 000,009,347 | ---- | M] () -- C:\ZA-Scan.txt < %PROGRAMFILES%\*.* > [2014/07/10 09:47:43 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini < %ALLUSERSPROFILE%\*.* > [2012/08/31 09:49:58 | 000,024,772 | ---- | M] () -- C:\ProgramData\P1210DEF.css [2014/09/05 11:51:35 | 000,014,948 | ---- | M] () -- C:\ProgramData\P1210OS.HTM [2012/08/31 09:49:58 | 000,002,944 | ---- | M] () -- C:\ProgramData\P1210SIG.GIF < %APPDATA%\Microsoft\*.* > < %PROGRAMFILES%\*.* > [2014/07/10 09:47:43 | 000,000,174 | -HS- | M] () -- C:\Program Files (x86)\desktop.ini < %PROGRAMFILES%\Internet Explorer\*.* > [2013/11/18 12:23:43 | 003,451,392 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\D3DCompiler_47.dll [2014/08/18 18:26:26 | 000,161,280 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\DiagnosticsTap.dll [2013/11/18 12:23:43 | 000,025,600 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\ExtExport.exe [2014/08/18 18:25:34 | 000,241,664 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\F12Tools.dll [2013/11/12 16:55:54 | 000,002,843 | ---- | M] () -- C:\Program Files (x86)\Internet Explorer\ie9props.propdesc [2014/08/18 19:27:58 | 000,696,832 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\iedvtool.dll [2014/08/18 18:17:41 | 000,470,016 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\ieinstal.exe [2014/08/18 18:38:45 | 000,222,720 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\ielowutil.exe [2014/08/18 17:33:46 | 000,272,384 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\ieproxy.dll [2014/08/18 17:41:49 | 000,259,584 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\IEShims.dll [2014/08/19 14:39:25 | 000,812,216 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe [2013/11/18 12:23:43 | 000,438,272 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\jsdbgui.dll [2013/11/18 12:23:43 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\jsdebuggeride.dll [2013/11/18 12:23:44 | 000,053,760 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\JSProfilerCore.dll [2013/11/18 12:23:43 | 000,503,808 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\jsprofilerui.dll [2013/11/18 12:23:44 | 000,312,392 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\msdbg2.dll [2014/08/18 18:15:42 | 001,064,960 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\networkinspection.dll [2013/11/18 12:23:43 | 000,410,680 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\pdm.dll [2013/11/18 12:23:43 | 000,097,880 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\pdmproxy100.dll [2014/08/19 14:39:25 | 000,235,192 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Internet Explorer\sqmapi.dll < HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections > "DefaultConnectionSettings" = 46 00 00 00 3A 14 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 00 67 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [binary data over 200 bytes] "SavedLegacySettings" = 46 00 00 00 8F 06 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 00 67 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [binary data over 200 bytes] ========== Alternate Data Streams ========== @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:56E2E879 < End of report >
  9. Bom dia! Abuso tanto vcs q ja estou com vergonha.. meu pc esta novamente infectado, procuro tomar as precauções orientadas por vcs, mas infelizmente outras pessoas q usam o computador não fazem a mesma coisa.. colocaram pen drive contaminado e o pc esta numa lentidao so.. agradeço muito se puderem me dar essa força.. abraços FSS.txt MbrScan.log ZA-Scan.txt
  10. Bom dia ! o combofix não pode ser executado sem no modo normal sem no segurança, conforme anexo
  11. Continuo com problemas para usar internet , as paginas não estão abrindo como deveriam.. estou usando o modo segurança ..pois não consegui no normal... abrços hijackthis.log kaspe.txt
  12. meu querido , boa noite! precisei viajar assim q retornar te respondo.. abraços
  13. Logfile of HijackThis v1.99.1 Scan saved at 11:35:22, on 19/06/2014 Platform: Unknown Windows (WinNT 6.01.3504) MSIE: Internet Explorer v8.00 (8.00.7600.16385) Running processes: C:\Windows\System32\smss.exe C:\Windows\system32\csrss.exe C:\Windows\system32\wininit.exe C:\Windows\system32\csrss.exe C:\Windows\system32\winlogon.exe C:\Windows\system32\services.exe C:\Windows\system32\lsass.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\system32\svchost.exe C:\Windows\Explorer.EXE C:\Windows\system32\ctfmon.exe C:\Windows\System32\svchost.exe C:\Users\Cecilia\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Cecilia\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Cecilia\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Cecilia\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Cecilia\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Cecilia\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Cecilia\Desktop\Linha Defensiva\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <-loopback> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\PROGRAM FILES\GBPLUGIN\gbieh.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll O3 - Toolbar: avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll O4 - HKLM\..\Run: [HPUsageTracking] "C:\Program Files\HP\HP UT\bin\hppusg.exe" "C:\Program Files\HP\HP UT\" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui O4 - HKLM\..\Run: [jswtrayutil] "C:\Program Files\INTELBRAS\WBN 240\WPS\jswtrayutil.exe" O4 - HKCU\..\Run: [Google Update] "C:\Users\Cecilia\AppData\Local\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [uTorrent] "C:\Users\Cecilia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uTorrent.exe" /MINIMIZED O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [mugen] wscript.exe //B "C:\Users\Cecilia\AppData\Local\Temp\mugen.vbs" O4 - HKCU\..\Run: [bxlgsogjjd] wscript.exe //B "C:\Users\Cecilia\AppData\Roaming\bxlgsogjjd..vbs" O4 - Startup: bxlgsogjjd..vbs O4 - Startup: mugen.vbs O4 - Startup: _uninst_.lnk = C:\Users\Cecilia\AppData\Local\Temp\_uninst_.bat O4 - Startup: _uninst_46642954.lnk = Cecilia\AppData\Local\Temp\_uninst_46642954.bat O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll O11 - Options group: [iNTERNATIONAL] International O13 - Gopher Prefix: O15 - Trusted Zone: www.bancobrasil.com.br O15 - Trusted Zone: www14.bancobrasil.com.br O15 - Trusted Zone: www2.bancobrasil.com.br O15 - Trusted Zone: www.bb.com.br O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: GbPluginBb - C:\Program Files\GbPlugin\gbieh.dll O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe O23 - Service: Gbp Service (GbpSv) - GAS Tecnologia - C:\PROGRA~1\GbPlugin\GbpSv.exe O23 - Service: Serviço do Google Update (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe" /svc (file missing) O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe" /medsvc (file missing) O23 - Service: JumpStart Push-Button Service (jswpbapi) - Wireless - C:\Program Files\INTELBRAS\WBN 240\WPS\jswpbapi.exe O23 - Service: JumpStart Wi-Fi Protected Setup (jswpsapi) - Wireless - C:\Program Files\INTELBRAS\WBN 240\WPS\jswpsapi.exe O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing) O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: Samsung UPD Service - Samsung Electronics CO., LTD. - C:\Windows\System32\SUPDSvc.exe O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing) O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files\Skype\Updater\Updater.exe O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %PROGRAMFILES%\Windows Media Player\wmpnetwk.exe (file missing) K.txt
  14. All processes killed ========== OTL ========== Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{searchTerms}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{searchTerms}\ not found. Prefs.js: "webssearches" removed from browser.search.defaultenginename Prefs.js: "webssearches" removed from browser.search.selectedEngine Prefs.js: "http://istart.websse...S2BWJ50ZA16118" removed from browser.startup.homepage Prefs.js: e46480cf-7cf6-495e-af69-573053f52c72%40b33ab36d-5952-49aa-adb2-a41b3dbe51a5.com:0.94.99 removed from extensions.enabledAddons Prefs.js: a9719e64-232b-4695-ae9c-a89cd7f2aa84%40ca1279df-bc0d-44a8-97ef-19301c922b68.com:0.94.36 removed from extensions.enabledAddons Prefs.js: "http://br.yhs4.searc...com/yhs/search" removed from keyword.URL C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\skin folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\locale\en-US folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\locale folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\userCode folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\defaults\preferences folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\defaults folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\core folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content\api folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome\content folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\chrome folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\e46480cf-7cf6-495e-af69-573053f52c72@b33ab36d-5952-49aa-adb2-a41b3dbe51a5.com\skin folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\e46480cf-7cf6-495e-af69-573053f52c72@b33ab36d-5952-49aa-adb2-a41b3dbe51a5.com\locale\en-US folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\e46480cf-7cf6-495e-af69-573053f52c72@b33ab36d-5952-49aa-adb2-a41b3dbe51a5.com\locale folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\e46480cf-7cf6-495e-af69-573053f52c72@b33ab36d-5952-49aa-adb2-a41b3dbe51a5.com\extensionData\userCode folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\e46480cf-7cf6-495e-af69-573053f52c72@b33ab36d-5952-49aa-adb2-a41b3dbe51a5.com\extensionData\plugins folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\e46480cf-7cf6-495e-af69-573053f52c72@b33ab36d-5952-49aa-adb2-a41b3dbe51a5.com\extensionData folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\e46480cf-7cf6-495e-af69-573053f52c72@b33ab36d-5952-49aa-adb2-a41b3dbe51a5.com\defaults\preferences folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\e46480cf-7cf6-495e-af69-573053f52c72@b33ab36d-5952-49aa-adb2-a41b3dbe51a5.com\defaults folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\e46480cf-7cf6-495e-af69-573053f52c72@b33ab36d-5952-49aa-adb2-a41b3dbe51a5.com\chrome\content\core folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\e46480cf-7cf6-495e-af69-573053f52c72@b33ab36d-5952-49aa-adb2-a41b3dbe51a5.com\chrome\content\api folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\e46480cf-7cf6-495e-af69-573053f52c72@b33ab36d-5952-49aa-adb2-a41b3dbe51a5.com\chrome\content folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\e46480cf-7cf6-495e-af69-573053f52c72@b33ab36d-5952-49aa-adb2-a41b3dbe51a5.com\chrome folder moved successfully. C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\e46480cf-7cf6-495e-af69-573053f52c72@b33ab36d-5952-49aa-adb2-a41b3dbe51a5.com folder moved successfully. Folder C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\ not found. Folder C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\plugins\ not found. Folder C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com\extensionData\userCode\ not found. Folder C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\e46480cf-7cf6-495e-af69-573053f52c72@b33ab36d-5952-49aa-adb2-a41b3dbe51a5.com\extensionData\ not found. Folder C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\e46480cf-7cf6-495e-af69-573053f52c72@b33ab36d-5952-49aa-adb2-a41b3dbe51a5.com\extensionData\plugins\ not found. Folder C:\Users\Cecilia\AppData\Roaming\mozilla\Firefox\Profiles\52k8ggxf.default\extensions\e46480cf-7cf6-495e-af69-573053f52c72@b33ab36d-5952-49aa-adb2-a41b3dbe51a5.com\extensionData\userCode\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\bxlgsogjjd deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\mugen deleted successfully. C:\Users\Cecilia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bxlgsogjjd..vbs moved successfully. C:\Users\Cecilia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mugen.vbs moved successfully. File C:\Users\Cecilia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mugen.vbs not found. File C:\Users\Cecilia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bxlgsogjjd..vbs not found. File move failed. C:\Users\Cecilia\AppData\Roaming\bxlgsogjjd..vbs scheduled to be moved on reboot. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Cecilia ->Temp folder emptied: 90954195 bytes ->Temporary Internet Files folder emptied: 12475626 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 17604721 bytes ->Google Chrome cache emptied: 23972788 bytes ->Flash cache emptied: 602 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public User: Todos os Usuários User: Usuário Padrão ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 3456390 bytes RecycleBin emptied: 5304986 bytes Total Files Cleaned = 147,00 mb [EMPTYJAVA] User: All Users User: Cecilia ->Java cache emptied: 0 bytes User: Default User: Default User User: Public User: Todos os Usuários User: Usuário Padrão Total Java Files Cleaned = 0,00 mb OTL by OldTimer - Version 3.2.69.0 log created on 06162014_100304 Files\Folders moved on Reboot... C:\Users\Cecilia\AppData\Roaming\bxlgsogjjd..vbs moved successfully. C:\Users\Cecilia\AppData\Local\Temp\mugen.vbs moved successfully. File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot. C:\Windows\temp\_avast_\ws153.dat moved successfully. PendingFileRenameOperations files... Registry entries deleted on Reboot...