Logo Hardware.com.br
TmfeijoMMonroe
TmfeijoMMonr... Cyber Highlander Registrado
13.7K Mensagens 4.2K Curtidas

Rootkits

#1 Por TmfeijoMMonr... 18/02/2014 - 19:55
Boa noite !

Creio que meu pc/sistema há rootkits; pois não instala nenhum anti rootkit . Aqui em meu sistema; tudo que clico demora para abrir. Tenho que primar umas 4 vezes .


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:54:58, on 18/02/2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.16518)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Users\EDSON\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.bing.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\PROGRAM FILES\GBPLUGIN\gbieh.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MIF5BA~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIF5BA~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIF5BA~1\Office12\ONBttnIE.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: www.bancobrasil.com.br
O15 - Trusted Zone: www14.bancobrasil.com.br
O15 - Trusted Zone: www2.bancobrasil.com.br
O15 - Trusted Zone: www.bb.com.br
O15 - Trusted Zone: imagem.caixa.gov.br
O15 - Trusted Zone: internetbanking.caixa.gov.br
O15 - Trusted Zone: www.caixa.gov.br
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: GbPluginBb - C:\PROGRAM FILES\GBPLUGIN\gbieh.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: COMODO Dragon Update Service (DragonUpdater) - Unknown owner - C:\Program Files\Comodo\Dragon\dragon_updater.exe
O23 - Service: Gbp Service (GbpSv) - GAS Tecnologia - C:\PROGRA~1\GbPlugin\GbpSv.exe
O23 - Service: Serviço do Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

--
End of file - 5260 bytes



Obrigado desde já .
sistema pc boa rootkits noite
Responder
#Leandro#
#Leandro# Super Participante Registrado
235 Mensagens 103 Curtidas
#2 Por #Leandro#
19/02/2014 - 14:25
1.
Faça o download do RunScanner No link Abaixo e salve no desktop.


2.
Executa-o, e clique em Ok.

3.
Em seguida clique no botão [Scan Computer] aguarde o termino aparecerá os arquivos listados.

4.
Ao termino do scam, clique em [save. log file], salve com qualquer nome que você quiser, quando salvar abrirá um log automático copia ele todo e cole aqui.
Que o destino nos livre dos lobos vestidos de ovelha, do ódio por trás de um sorriso, da inveja disfarçada de amor e da falsidade disfarçada de amigo!!!!!! AMÉM
TmfeijoMMonroe
TmfeijoMMonr... Cyber Highlander Registrado
13.7K Mensagens 4.2K Curtidas
#3 Por TmfeijoMMonr...
19/02/2014 - 15:01
Boa tarde !

Aqui em meu sistema; tudo que clico demora para abrir. Tenho que primar umas 4 vezes para abrir arquivos, pastas e programas .cap_chateado.png



Estes drivers :

011 * C:\Windows\System32\DRIVERS\cmderd.sys (COMODO Internet Security Eradication Driver)
011 * C:\Windows\system32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver) ; são do CIS . Podemos dar um fix ? Ou é dividido com o mesmo driver do navegador da comodo ?



Após muitas tentativas consegui rodar o AVG anti rootkit . Nada foi encontrado !

Os que estão em negrito; logo abaixo no log; sairam em vermelho no mesmo .

Runscanner logfile http://www.runscanner.net

* = signed file
- = file not found

General info
------------
Computer name : EDSON-PC
Creation time : 19/02/2014 14:53:05
Hosts <> 127.0.0.1 : 0
Hosts file location : %SystemRoot%\System32\drivers\etc
IE version : 9.11.9600.16518
OS : Windows 7 Home Basic
OS Build : 7601
OS SP : Service Pack 1
RunScanner Version : 2.0.0.60
User Language : Português (Brasil)
User rights : Administrator
Windows folder : C:\Windows

Running processes
-----------------
* C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
* C:\Windows\System32\wininit.exe (Microsoft Corporation)
* C:\Windows\System32\winlogon.exe (Microsoft Corporation)
* C:\Windows\System32\services.exe (Microsoft Corporation)
* C:\Windows\System32\spoolsv.exe (Microsoft Corporation)
* C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
* C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
* C:\Program Files\Comodo\Dragon\dragon_updater.exe
* C:\PROGRA~1\GbPlugin\gbpsv.exe (GAS Tecnologia)
* C:\Windows\System32\dwm.exe (Microsoft Corporation)
* C:\Windows\System32\smss.exe (Microsoft Corporation)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Update\1.3.22.5\GoogleCrashHandler.exe (Google Inc.)
* C:\Windows\System32\SearchIndexer.exe (Microsoft Corporation)
* C:\Windows\system32\audiodg.exe (Microsoft Corporation)
* C:\Windows\System32\lsass.exe (Microsoft Corporation)
* C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\taskhost.exe (Microsoft Corporation)
* C:\Windows\System32\taskhost.exe (Microsoft Corporation)
* C:\Windows\System32\csrss.exe (Microsoft Corporation)
* C:\Windows\System32\csrss.exe (Microsoft Corporation)
* C:\Users\EDSON\Downloads\runscanner.exe (Runscanner.net)
* C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
* C:\Windows\System32\lsm.exe (Microsoft Corporation)
* C:\Windows\explorer.exe (Microsoft Corporation)

Unrated items
-------------
002 * C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
010 * C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (.NET Runtime Optimization Service)
010 * C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Acrobat Update Service)
010 * C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe® Flash® Player Update Service 12.0 r0)
010 * C:\Program Files\AVAST Software\Avast\AvastSvc.exe (avast! Service)
010 * C:\Program Files\Comodo\Dragon\dragon_updater.exe (dragon_updater.exe)
010 * C:\PROGRA~1\GbPlugin\GbpSv.exe (G-Buster Browser Defense - Service)
011 * C:\Windows\system32\drivers\aswRvrt.sys (aswRvrt.sys)
011 C:\Windows\system32\drivers\aswSP.sys (aswSP.sys)
011 * C:\Windows\system32\drivers\aswVmm.sys (aswVmm.sys)
011 * C:\Windows\system32\drivers\aswMonFlt.sys (avast! File System Minifilter for Windows 2003/Vista)
011 * C:\Windows\system32\drivers\aswSnx.sys (avast! Virtualization Driver)
011 * C:\Windows\system32\drivers\aswRdr2.sys (avast! WFP Redirect Driver)
011 * C:\Windows\System32\DRIVERS\cmderd.sys (COMODO Internet Security Eradication Driver)
011 * C:\Windows\system32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver)
011 * C:\Windows\system32\drivers\gbpkm.sys (GbPlugin Device Driver)
011 * C:\Windows\system32\DRIVERS\gbpndisrd.sys (GbPlugin NDIS Device Driver)
011 * C:\Windows\system32\DRIVERS\gbpndisrd.sys (NdisrdMP)
011 * C:\Windows\system32\drivers\aswStm.sys (Stream Filter)
035 * C:\Program Files\Google\Chrome\Application\32.0.1700.107\Installer\chrmstp.exe (Google Inc.) {8A69D345-D564-463c-AFF1-A69D9E530F96}
041 * C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F}
042 GUID / CLSID not found {2670000A-7350-4f3c-8081-5663EE0C6C49}
047 Zone: imagem.caixa.gov.br : *.imagem.caixa.gov.br
047 Zone: internetbanking.caixa.gov.br : *.internetbanking.caixa.gov.br
047 Zone: www.bancobrasil.com.br : *.www.bancobrasil.com.br
047 Zone: www.bb.com.br : *.www.bb.com.br
047 Zone: www.caixa.gov.br : *.www.caixa.gov.br
047 Zone: www14.bancobrasil.com.br : *.www14.bancobrasil.com.br
047 Zone: www2.bancobrasil.com.br : *.www2.bancobrasil.com.br
050 * C:\Program Files\GbPlugin\gbiehcef.dll (Caixa Economica Federal) {E37CB5F0-51F5-4395-A808-5FA49E399003}
050 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {E37CB5F0-51F5-4395-A808-5FA49E399F83}
052 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {C41A1C0E-EA6C-11D4-B1B8-444553540000}
052 * C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) {8E5E2654-AD2D-48bf-AC2D-D17F00898D06}
052 * C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
052 * C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) {DBC80044-A445-435b-BC74-9C25C1C588A9}
061 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
061 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {98C11555-BC81-40aa-A053-DAADC5630000}
061 * C:\Program Files\GbPlugin\gbiehCef.dll (Caixa Economica Federal) {98C11555-BC81-40aa-A053-DAADC5630003}
061 * C:\Program Files\GbPlugin\gbiehcef.dll (Caixa Economica Federal) {E37CB5F0-51F5-4395-A808-5FA49E399003}
061 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {E37CB5F0-51F5-4395-A808-5FA49E399F83}
062 * C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll (Adobe Systems, Inc.) {F9DB5320-233E-11D1-9F84-707F02C10627}
067 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil)
073 Adobe Flash Player Updater.job : C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
100 Search Page HKCU : http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
104 GUID / CLSID not found {7530BFB8-7293-4D34-9923-61A11451AFC5}
104 * C:\Program Files\Java\jre7\bin\jp2iexp.dll {CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA}
104 * C:\Program Files\Java\jre7\bin\jp2iexp.dll {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
104 * C:\Windows\system32\Macromed\Flash\Flash32_12_0_0_44.ocx (Adobe Systems, Inc.) {D27CDB6E-AE6D-11CF-96B8-444553540000}
105 E&xport to Microsoft Excel : res://C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
105 E&xportar para o Microsoft Excel : res://C:\PROGRA~1\MIF5BA~1\Office12\EXCEL.EXE/3000
105 Se&nd to OneNote : res://C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
173 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
173 GUID / CLSID not found
221 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
221 GUID / CLSID not found
223 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
223 * C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes Corporation) {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
225 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
225 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
225 * C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes Corporation) {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
225 * C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes Corporation) {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
231 * C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll (Adobe Systems, Inc.) PDF Column Info
241 GUID / CLSID not found {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}
241 GUID / CLSID not found {BBACC218-34EA-4666-9D7A-C78F2274A524}
241 GUID / CLSID not found {F241C880-6982-4CE5-8CF7-7085BA96DA5A}
 241 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
254 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {98C11555-BC81-40aa-A053-DAADC5630000}

Missing files
-------------
011 System32\DRIVERS\AvgArCln.sys
011 System32\DRIVERS\avgarkt.sys
011 C:\Windows\system32\drivers\tvelms.sys
032 rdpclip

Obrigado
#Leandro#
#Leandro# Super Participante Registrado
235 Mensagens 103 Curtidas
#4 Por #Leandro#
19/02/2014 - 16:15
Tmfeijo disse:
Boa tarde !

Aqui em meu sistema; tudo que clico demora para abrir. Tenho que primar umas 4 vezes para abrir arquivos, pastas e programas .cap_chateado.png



Estes drivers :

011 * C:\Windows\System32\DRIVERS\cmderd.sys (COMODO Internet Security Eradication Driver)
011 * C:\Windows\system32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver) ; são do CIS . Podemos dar um fix ? Ou é dividido com o mesmo driver do navegador da comodo ?



Após muitas tentativas consegui rodar o AVG anti rootkit . Nada foi encontrado !

Os que estão em negrito; logo abaixo no log; sairam em vermelho no mesmo .


Os drivers acima pertence ao Anti vírus COMODO Internet Security.., caso voce desinstalou o Comodo Anti vírus, vou te explicar como fixar a entrada!
Se ele ainda estiver instalado recomendo que desinstale pois dois Anti vírus causa conflito e lentidão no sistema!!

E as entradas em vermelho são arquivos que foram deletados que não existe, e suas informações ficam gravado no registro, vou informa quais podem ser Fixado.

=======================================

1.
Faça um novo Scan de Runscanner, e duplo clique para selecionar as linhas abaixo.


011 * C:\Windows\System32\DRIVERS\cmderd.sys (COMODO Internet Security Eradication Driver)
011 * C:\Windows\system32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver)
042 GUID / CLSID not found {2670000A-7350-4f3c-8081-5663EE0C6C49}
104 GUID / CLSID not found {7530BFB8-7293-4D34-9923-61A11451AFC5}
241 GUID / CLSID not found {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}
241 GUID / CLSID not found {BBACC218-34EA-4666-9D7A-C78F2274A524}
241 GUID / CLSID not found {F241C880-6982-4CE5-8CF7-7085BA96DA5A}
011 System32\DRIVERS\AvgArCln.sys
011 System32\DRIVERS\avgarkt.sys
011 C:\Windows\system32\drivers\tvelms.sys
032 rdpclip



2.
Depois clique na aba [Item Fixer] e depois clique em [Fix selected items] > OK


Depois faça um novo Scan e salve o relatório e cole o novo relatório na sua próxima resposta!
Que o destino nos livre dos lobos vestidos de ovelha, do ódio por trás de um sorriso, da inveja disfarçada de amor e da falsidade disfarçada de amigo!!!!!! AMÉM
TmfeijoMMonroe
TmfeijoMMonr... Cyber Highlander Registrado
13.7K Mensagens 4.2K Curtidas
#5 Por TmfeijoMMonr...
19/02/2014 - 16:53
Boa tarde !


Nossa sempre tive problemas com rootkits chineses aqui :


http://forum.imasters.com.br/topic/354423-resolvidopc-faz-barulho-como-uma-catraca/


punk.gifpunk.gif



Para mim a pior infecção na rede .



Runscanner logfile http://www.runscanner.net

* = signed file
- = file not found

General info
------------
Computer name : EDSON-PC
Creation time : 19/02/2014 16:50:18
Hosts <> 127.0.0.1 : 0
Hosts file location : %SystemRoot%\System32\drivers\etc
IE version : 9.11.9600.16518
OS : Windows 7 Home Basic
OS Build : 7601
OS SP : Service Pack 1
RunScanner Version : 2.0.0.60
User Language : Português (Brasil)
User rights : Administrator
Windows folder : C:\Windows

Running processes
-----------------
* C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
* C:\Windows\System32\wininit.exe (Microsoft Corporation)
* C:\Windows\System32\winlogon.exe (Microsoft Corporation)
* C:\Windows\System32\services.exe (Microsoft Corporation)
* C:\Windows\System32\spoolsv.exe (Microsoft Corporation)
* C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
* C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
* C:\Program Files\Comodo\Dragon\dragon_updater.exe
* C:\PROGRA~1\GbPlugin\gbpsv.exe (GAS Tecnologia)
* C:\Windows\System32\dwm.exe (Microsoft Corporation)
* C:\Windows\System32\smss.exe (Microsoft Corporation)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Update\1.3.22.5\GoogleCrashHandler.exe (Google Inc.)
* C:\Windows\System32\SearchIndexer.exe (Microsoft Corporation)
* C:\Windows\system32\audiodg.exe (Microsoft Corporation)
* C:\Windows\System32\lsass.exe (Microsoft Corporation)
* C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
* C:\Windows\System32\SearchFilterHost.exe (Microsoft Corporation)
* C:\Windows\System32\SearchProtocolHost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\taskhost.exe (Microsoft Corporation)
* C:\Windows\System32\csrss.exe (Microsoft Corporation)
* C:\Windows\System32\csrss.exe (Microsoft Corporation)
* C:\Users\EDSON\Downloads\runscanner (2).exe (Runscanner.net)
* C:\Users\EDSON\Downloads\runscanner.exe (Runscanner.net)
* C:\Users\EDSON\Downloads\runscanner (1).exe (Runscanner.net)
* C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
* C:\Windows\System32\lsm.exe (Microsoft Corporation)
* C:\Windows\explorer.exe (Microsoft Corporation)

Unrated items
-------------
002 * C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
010 * C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (.NET Runtime Optimization Service)
010 * C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Acrobat Update Service)
010 * C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe® Flash® Player Update Service 12.0 r0)
010 * C:\Program Files\AVAST Software\Avast\AvastSvc.exe (avast! Service)
010 * C:\Program Files\Comodo\Dragon\dragon_updater.exe (dragon_updater.exe)
010 * C:\PROGRA~1\GbPlugin\GbpSv.exe (G-Buster Browser Defense - Service)
011 * C:\Windows\system32\drivers\aswRvrt.sys (aswRvrt.sys)
011 C:\Windows\system32\drivers\aswSP.sys (aswSP.sys)
011 * C:\Windows\system32\drivers\aswVmm.sys (aswVmm.sys)
011 * C:\Windows\system32\drivers\aswMonFlt.sys (avast! File System Minifilter for Windows 2003/Vista)
011 * C:\Windows\system32\drivers\aswSnx.sys (avast! Virtualization Driver)
011 * C:\Windows\system32\drivers\aswRdr2.sys (avast! WFP Redirect Driver)
011 * C:\Windows\system32\drivers\gbpkm.sys (GbPlugin Device Driver)
011 * C:\Windows\system32\DRIVERS\gbpndisrd.sys (GbPlugin NDIS Device Driver)
011 * C:\Windows\system32\DRIVERS\gbpndisrd.sys (NdisrdMP)
011 * C:\Windows\system32\drivers\aswStm.sys (Stream Filter)
035 * C:\Program Files\Google\Chrome\Application\32.0.1700.107\Installer\chrmstp.exe (Google Inc.) {8A69D345-D564-463c-AFF1-A69D9E530F96}
041 * C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F}
047 Zone: www.bancobrasil.com.br : *.www.bancobrasil.com.br
047 Zone: www.bb.com.br : *.www.bb.com.br
047 Zone: www14.bancobrasil.com.br : *.www14.bancobrasil.com.br
047 Zone: www2.bancobrasil.com.br : *.www2.bancobrasil.com.br
050 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {E37CB5F0-51F5-4395-A808-5FA49E399F83}
052 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {C41A1C0E-EA6C-11D4-B1B8-444553540000}
052 * C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) {8E5E2654-AD2D-48bf-AC2D-D17F00898D06}
052 * C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
052 * C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) {DBC80044-A445-435b-BC74-9C25C1C588A9}
061 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
061 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {98C11555-BC81-40aa-A053-DAADC5630000}
061 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {E37CB5F0-51F5-4395-A808-5FA49E399F83}
062 * C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll (Adobe Systems, Inc.) {F9DB5320-233E-11D1-9F84-707F02C10627}
067 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil)
073 Adobe Flash Player Updater.job : C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
100 Search Page HKCU : http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
104 * C:\Program Files\Java\jre7\bin\jp2iexp.dll {CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA}
104 * C:\Program Files\Java\jre7\bin\jp2iexp.dll {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
104 * C:\Windows\system32\Macromed\Flash\Flash32_12_0_0_44.ocx (Adobe Systems, Inc.) {D27CDB6E-AE6D-11CF-96B8-444553540000}
105 E&xport to Microsoft Excel : res://C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
105 E&xportar para o Microsoft Excel : res://C:\PROGRA~1\MIF5BA~1\Office12\EXCEL.EXE/3000
105 Se&nd to OneNote : res://C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
173 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
221 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
223 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
223 * C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes Corporation) {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
225 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
225 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
225 * C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes Corporation) {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
225 * C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes Corporation) {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
231 * C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll (Adobe Systems, Inc.) PDF Column Info
241 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
254 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {98C11555-BC81-40aa-A053-DAADC5630000}

Missing files
-------------
011 System32\DRIVERS\AvgArCln.sys
011 System32\DRIVERS\avgarkt.sys
032 rdpclip



Este rdpclip com vários fix não vaza do log . Seria do próprio runscanner ?
#Leandro#
#Leandro# Super Participante Registrado
235 Mensagens 103 Curtidas
#6 Por #Leandro#
19/02/2014 - 17:15
O relatório de Runscanner está limpo nada malicioso encontrado!

----------------------------------

1.
Baixe o Gmer Anti-Rootkits
http://www2.gmer.net/gmer.zip

2.
Extraia o arquivo e execute o Gmer, ira iniciar o Scan automaticamente, ao termino clique no botão [Save...]

Salve o relatório e cole aqui em seu tópico.
Que o destino nos livre dos lobos vestidos de ovelha, do ódio por trás de um sorriso, da inveja disfarçada de amor e da falsidade disfarçada de amigo!!!!!! AMÉM
TmfeijoMMonroe
TmfeijoMMonr... Cyber Highlander Registrado
13.7K Mensagens 4.2K Curtidas
#7 Por TmfeijoMMonr...
19/02/2014 - 18:19
Bom final de tarde !


Tive que restaurar o sistema; por outro motivo/problema .

Dei um fix nos vermelhões novamente e :


Editando :

Seguindo as antigas instruções; ao rodar novamente; surgiu mais um vermelhão; o ficheiro C:\Users\EDSON\AppData\Local\Temp\agloapog.sys .



Runscanner logfile http://www.runscanner.net

* = signed file
- = file not found

General info
------------
Computer name : EDSON-PC
Creation time : 19/02/2014 18:28:30
Hosts <> 127.0.0.1 : 0
Hosts file location : %SystemRoot%\System32\drivers\etc
IE version : 9.11.9600.16518
OS : Windows 7 Home Basic
OS Build : 7601
OS SP : Service Pack 1
RunScanner Version : 2.0.0.60
User Language : Português (Brasil)
User rights : Administrator
Windows folder : C:\Windows

Running processes
-----------------
* C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
* C:\Windows\System32\wininit.exe (Microsoft Corporation)
* C:\Windows\System32\winlogon.exe (Microsoft Corporation)
* C:\Windows\System32\services.exe (Microsoft Corporation)
* C:\Windows\System32\spoolsv.exe (Microsoft Corporation)
* C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
* C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
* C:\Windows\System32\notepad.exe (Microsoft Corporation)
* C:\Program Files\Comodo\Dragon\dragon_updater.exe
* C:\PROGRA~1\GbPlugin\gbpsv.exe (GAS Tecnologia)
* C:\Windows\System32\dwm.exe (Microsoft Corporation)
* C:\Windows\System32\smss.exe (Microsoft Corporation)
C:\Users\EDSON\AppData\Local\Temp\Temp1_gmer.zip\gmer.exe
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Update\1.3.22.5\GoogleCrashHandler.exe (Google Inc.)
* C:\Windows\System32\SearchIndexer.exe (Microsoft Corporation)
* C:\Windows\system32\audiodg.exe (Microsoft Corporation)
* C:\Windows\System32\lsass.exe (Microsoft Corporation)
* C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
* C:\Windows\System32\SearchFilterHost.exe (Microsoft Corporation)
* C:\Windows\System32\SearchProtocolHost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\taskhost.exe (Microsoft Corporation)
* C:\Windows\System32\csrss.exe (Microsoft Corporation)
* C:\Windows\System32\csrss.exe (Microsoft Corporation)
* C:\Users\EDSON\Downloads\runscanner (3).exe (Runscanner.net)
* C:\Users\EDSON\Downloads\runscanner (2).exe (Runscanner.net)
* C:\Users\EDSON\Downloads\runscanner.exe (Runscanner.net)
* C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
* C:\Windows\System32\lsm.exe (Microsoft Corporation)
* C:\Windows\explorer.exe (Microsoft Corporation)
* C:\Windows\System32\wbem\WmiPrvSE.exe (Microsoft Corporation)

Unrated items
-------------
002 * C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
010 * C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (.NET Runtime Optimization Service)
010 * C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Acrobat Update Service)
010 * C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe® Flash® Player Update Service 12.0 r0)
010 * C:\Program Files\AVAST Software\Avast\AvastSvc.exe (avast! Service)
010 * C:\Program Files\Comodo\Dragon\dragon_updater.exe (dragon_updater.exe)
010 * C:\PROGRA~1\GbPlugin\GbpSv.exe (G-Buster Browser Defense - Service)
011 * C:\Windows\system32\drivers\aswRvrt.sys (aswRvrt.sys)
011 C:\Windows\system32\drivers\aswSP.sys (aswSP.sys)
011 * C:\Windows\system32\drivers\aswVmm.sys (aswVmm.sys)
011 * C:\Windows\system32\drivers\aswMonFlt.sys (avast! File System Minifilter for Windows 2003/Vista)
011 * C:\Windows\system32\drivers\aswSnx.sys (avast! Virtualization Driver)
011 * C:\Windows\system32\drivers\aswRdr2.sys (avast! WFP Redirect Driver)
011 * C:\Windows\system32\drivers\gbpkm.sys (GbPlugin Device Driver)
011 * C:\Windows\system32\DRIVERS\gbpndisrd.sys (GbPlugin NDIS Device Driver)
011 * C:\Windows\system32\DRIVERS\gbpndisrd.sys (NdisrdMP)
011 * C:\Windows\system32\drivers\aswStm.sys (Stream Filter)
035 * C:\Program Files\Google\Chrome\Application\32.0.1700.107\Installer\chrmstp.exe (Google Inc.) {8A69D345-D564-463c-AFF1-A69D9E530F96}
041 * C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F}
047 Zone: www.bancobrasil.com.br : *.www.bancobrasil.com.br
047 Zone: www.bb.com.br : *.www.bb.com.br
047 Zone: www14.bancobrasil.com.br : *.www14.bancobrasil.com.br
047 Zone: www2.bancobrasil.com.br : *.www2.bancobrasil.com.br
050 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {E37CB5F0-51F5-4395-A808-5FA49E399F83}
052 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {C41A1C0E-EA6C-11D4-B1B8-444553540000}
052 * C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) {8E5E2654-AD2D-48bf-AC2D-D17F00898D06}
052 * C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
052 * C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) {DBC80044-A445-435b-BC74-9C25C1C588A9}
061 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
061 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {98C11555-BC81-40aa-A053-DAADC5630000}
061 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {E37CB5F0-51F5-4395-A808-5FA49E399F83}
062 * C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll (Adobe Systems, Inc.) {F9DB5320-233E-11D1-9F84-707F02C10627}
067 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil)
073 Adobe Flash Player Updater.job : C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
100 Search Page HKCU : http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
104 * C:\Program Files\Java\jre7\bin\jp2iexp.dll {CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA}
104 * C:\Program Files\Java\jre7\bin\jp2iexp.dll {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
104 * C:\Windows\system32\Macromed\Flash\Flash32_12_0_0_44.ocx (Adobe Systems, Inc.) {D27CDB6E-AE6D-11CF-96B8-444553540000}
105 E&xport to Microsoft Excel : res://C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
105 E&xportar para o Microsoft Excel : res://C:\PROGRA~1\MIF5BA~1\Office12\EXCEL.EXE/3000
105 Se&nd to OneNote : res://C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
173 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
221 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
223 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
223 * C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes Corporation) {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
225 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
225 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
225 * C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes Corporation) {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
225 * C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes Corporation) {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
231 * C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll (Adobe Systems, Inc.) PDF Column Info
241 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
254 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {98C11555-BC81-40aa-A053-DAADC5630000}

Missing files
-------------
011 C:\Users\EDSON\AppData\Local\Temp\agloapog.sys
032 rdpclip




Runscanner logfile http://www.runscanner.net

* = signed file
- = file not found

General info
------------
Computer name : EDSON-PC
Creation time : 19/02/2014 18:13:26
Hosts <> 127.0.0.1 : 0
Hosts file location : %SystemRoot%\System32\drivers\etc
IE version : 9.11.9600.16518
OS : Windows 7 Home Basic
OS Build : 7601
OS SP : Service Pack 1
RunScanner Version : 2.0.0.60
User Language : Português (Brasil)
User rights : Administrator
Windows folder : C:\Windows

Running processes
-----------------
* C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
* C:\Windows\System32\wininit.exe (Microsoft Corporation)
* C:\Windows\System32\winlogon.exe (Microsoft Corporation)
* C:\Windows\System32\services.exe (Microsoft Corporation)
* C:\Windows\System32\spoolsv.exe (Microsoft Corporation)
* C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
* C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
* C:\Program Files\Comodo\Dragon\dragon_updater.exe
* C:\PROGRA~1\GbPlugin\gbpsv.exe (GAS Tecnologia)
* C:\Windows\System32\dwm.exe (Microsoft Corporation)
* C:\Windows\System32\smss.exe (Microsoft Corporation)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
* C:\Program Files\Google\Update\1.3.22.5\GoogleCrashHandler.exe (Google Inc.)
* C:\Windows\System32\SearchIndexer.exe (Microsoft Corporation)
* C:\Windows\servicing\TrustedInstaller.exe (Microsoft Corporation)
* C:\Windows\system32\audiodg.exe (Microsoft Corporation)
* C:\Windows\System32\lsass.exe (Microsoft Corporation)
* C:\Windows\System32\taskeng.exe (Microsoft Corporation)
* C:\Windows\System32\taskeng.exe (Microsoft Corporation)
* C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
* C:\Windows\System32\SearchFilterHost.exe (Microsoft Corporation)
* C:\Windows\System32\SearchProtocolHost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\svchost.exe (Microsoft Corporation)
* C:\Windows\System32\taskhost.exe (Microsoft Corporation)
* C:\Windows\System32\csrss.exe (Microsoft Corporation)
* C:\Windows\System32\csrss.exe (Microsoft Corporation)
* C:\Users\EDSON\Downloads\runscanner.exe (Runscanner.net)
* C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
* C:\Windows\System32\lsm.exe (Microsoft Corporation)
* C:\Windows\explorer.exe (Microsoft Corporation)
* C:\Windows\System32\wbem\WmiPrvSE.exe (Microsoft Corporation)
* C:\Windows\System32\wbem\WmiPrvSE.exe (Microsoft Corporation)

Unrated items
-------------
002 * C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
010 * C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (.NET Runtime Optimization Service)
010 * C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Acrobat Update Service)
010 * C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe® Flash® Player Update Service 12.0 r0)
010 * C:\Program Files\AVAST Software\Avast\AvastSvc.exe (avast! Service)
010 * C:\Program Files\Comodo\Dragon\dragon_updater.exe (dragon_updater.exe)
010 * C:\PROGRA~1\GbPlugin\GbpSv.exe (G-Buster Browser Defense - Service)
011 * C:\Windows\system32\drivers\aswRvrt.sys (aswRvrt.sys)
011 C:\Windows\system32\drivers\aswSP.sys (aswSP.sys)
011 * C:\Windows\system32\drivers\aswVmm.sys (aswVmm.sys)
011 * C:\Windows\system32\drivers\aswMonFlt.sys (avast! File System Minifilter for Windows 2003/Vista)
011 * C:\Windows\system32\drivers\aswSnx.sys (avast! Virtualization Driver)
011 * C:\Windows\system32\drivers\aswRdr2.sys (avast! WFP Redirect Driver)
011 * C:\Windows\system32\drivers\gbpkm.sys (GbPlugin Device Driver)
011 * C:\Windows\system32\DRIVERS\gbpndisrd.sys (GbPlugin NDIS Device Driver)
011 * C:\Windows\system32\DRIVERS\gbpndisrd.sys (NdisrdMP)
011 * C:\Windows\system32\drivers\aswStm.sys (Stream Filter)
035 * C:\Program Files\Google\Chrome\Application\32.0.1700.107\Installer\chrmstp.exe (Google Inc.) {8A69D345-D564-463c-AFF1-A69D9E530F96}
041 * C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F}
047 Zone: www.bancobrasil.com.br : *.www.bancobrasil.com.br
047 Zone: www.bb.com.br : *.www.bb.com.br
047 Zone: www14.bancobrasil.com.br : *.www14.bancobrasil.com.br
047 Zone: www2.bancobrasil.com.br : *.www2.bancobrasil.com.br
050 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {E37CB5F0-51F5-4395-A808-5FA49E399F83}
052 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {C41A1C0E-EA6C-11D4-B1B8-444553540000}
052 * C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) {8E5E2654-AD2D-48bf-AC2D-D17F00898D06}
052 * C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
052 * C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) {DBC80044-A445-435b-BC74-9C25C1C588A9}
061 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
061 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {98C11555-BC81-40aa-A053-DAADC5630000}
061 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {E37CB5F0-51F5-4395-A808-5FA49E399F83}
062 * C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll (Adobe Systems, Inc.) {F9DB5320-233E-11D1-9F84-707F02C10627}
067 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil)
073 Adobe Flash Player Updater.job : C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
100 Search Page HKCU : http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
104 * C:\Program Files\Java\jre7\bin\jp2iexp.dll {CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA}
104 * C:\Program Files\Java\jre7\bin\jp2iexp.dll {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
104 * C:\Windows\system32\Macromed\Flash\Flash32_12_0_0_44.ocx (Adobe Systems, Inc.) {D27CDB6E-AE6D-11CF-96B8-444553540000}
105 E&xport to Microsoft Excel : res://C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
105 E&xportar para o Microsoft Excel : res://C:\PROGRA~1\MIF5BA~1\Office12\EXCEL.EXE/3000
105 Se&nd to OneNote : res://C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
173 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
221 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
223 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
223 * C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes Corporation) {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
225 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
225 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
225 * C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes Corporation) {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
225 * C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll (Malwarebytes Corporation) {57CE581A-0CB6-4266-9CA0-19364C90A0B3}
231 * C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll (Adobe Systems, Inc.) PDF Column Info
241 * C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) {472083B0-C522-11CF-8763-00608CC02F24}
254 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {98C11555-BC81-40aa-A053-DAADC5630000}

Missing files
-------------
032 rdpclip


Está rodando o g mer !!!


Obrigado
#Leandro#
#Leandro# Super Participante Registrado
235 Mensagens 103 Curtidas
#8 Por #Leandro#
19/02/2014 - 18:45
Esse arquivo pertence ao Gmer, depois que o programa é finalizado o driver utilizado pelo Gmer e deletado!
C:\DOCUME~1\CLAREN~1\LOCALS~1\Temp\agloapog.sys

E não recomendo fixar esse entrada -> 032 rdpclip ignore-o
Que o destino nos livre dos lobos vestidos de ovelha, do ódio por trás de um sorriso, da inveja disfarçada de amor e da falsidade disfarçada de amigo!!!!!! AMÉM
TmfeijoMMonroe
TmfeijoMMonr... Cyber Highlander Registrado
13.7K Mensagens 4.2K Curtidas
#13 Por TmfeijoMMonr...
19/02/2014 - 20:29
Boa noite !


Ok . Desfragmentação de disco ! Viável realizar com o próprio recurso do sistema operacional ou utilizar um software para tanto ?


Quanto ao cleanner . Certa vez fui executar uma limpeza de disco<<< avançada <<< em limpeza do dispositivo; não me lembro bem qual a opção e :


https://www.hardware.com.br/comunidade/atualizacao-drivers/1206241/



Abraços e obrigado
#Leandro#
#Leandro# Super Participante Registrado
235 Mensagens 103 Curtidas
#14 Por #Leandro#
20/02/2014 - 09:53
Um excelente desfragmentador:
http://www.superdownloads.com.br/download/196/auslogics-disk-defrag-portable/

Sobre o Cleanner, recomendo que não utilize mais essa opção de Limpeza de Disco, alem de ser lento o processo pode danificar realmente o sistema!
Abraços!
Que o destino nos livre dos lobos vestidos de ovelha, do ódio por trás de um sorriso, da inveja disfarçada de amor e da falsidade disfarçada de amigo!!!!!! AMÉM
TmfeijoMMonroe
TmfeijoMMonr... Cyber Highlander Registrado
13.7K Mensagens 4.2K Curtidas
#15 Por TmfeijoMMonr...
20/02/2014 - 10:17
Bom dia !




Editando :

Meu pc ainda continua estranho ; tudo demora mais ainda para abrir ou fechar janelas ; segue logs compatíveis para tanto :
Combofix :

http://cjoint.com/14fe/DBvoZecGOf5.htm





Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:46:45, on 22/02/2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.16518)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Internet Explorer\IELowutil.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Users\EDSON\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\PROGRAM FILES\GBPLUGIN\gbieh.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MIF5BA~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: www.bancobrasil.com.br
O15 - Trusted Zone: www14.bancobrasil.com.br
O15 - Trusted Zone: www2.bancobrasil.com.br
O15 - Trusted Zone: www.bb.com.br
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: GbPluginBb - C:\PROGRAM FILES\GBPLUGIN\gbieh.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: COMODO Dragon Update Service (DragonUpdater) - Unknown owner - C:\Program Files\Comodo\Dragon\dragon_updater.exe
O23 - Service: Gbp Service (GbpSv) - GAS Tecnologia - C:\PROGRA~1\GbPlugin\GbpSv.exe
O23 - Service: Serviço do Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

--
End of file - 4602 bytes




DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 11.0.9600.16518 BrowserJavaVersion: 10.51.2
Run by EDSON at 18:46:00 on 2014-02-21
Microsoft Windows 7 Home Basic 6.1.7601.1.1252.55.1046.18.1981.944 [GMT -3:00]
.
AV: avast! Antivirus *Enabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Enabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\PROGRA~1\GbPlugin\GbpSv.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Comodo\Dragon\dragon_updater.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Google\Update\1.3.22.5\GoogleCrashHandler.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Glary Utilities 4\Integrator.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
.
============== Pseudo HJT Report ===============
.
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: GbIehObj Class: {C41A1C0E-EA6C-11D4-B1B8-444553540000} - c:\program files\gbplugin\gbieh.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
TB: avast! Online Security: {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - c:\program files\avast software\avast\aswWebRepIE.dll
mRun: [AvastUI.exe] "c:\program files\avast software\avast\AvastUI.exe" /nogui
uPolicies-Explorer: NoDrives = dword:0
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
uPolicies-Explorer: NoDriveAutoRun = dword:3
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:0
mPolicies-Explorer: NoDriveAutoRun = dword:3
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
IE: E&xport to Microsoft Excel - c:\program files\microsoft office 15\root\office15\EXCEL.EXE/3000
IE: E&xportar para o Microsoft Excel - c:\progra~1\mif5ba~1\office12\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\program files\microsoft office 15\root\office15\ONBttnIE.dll/105
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0017-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 192.168.0.1
TCP: Interfaces\{A2458CE2-E6B6-4CE4-8F90-BF654280773E} : DHCPNameServer = 192.168.0.1
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Notify: GbPluginBb - c:\program files\gbplugin\gbieh.dll
Notify: igfxcui - igfxdev.dll
SEH: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399F83} - c:\program files\gbplugin\gbieh.dll
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\32.0.1700.107\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
.
============= SERVICES / DRIVERS ===============
.
R0 aswRvrt;avast! Revert;c:\windows\system32\drivers\aswRvrt.sys [2013-11-2 49944]
R0 aswVmm;avast! VM Monitor;c:\windows\system32\drivers\aswVmm.sys [2013-11-2 180248]
R0 GbpKm;Gbp KernelMode;c:\windows\system32\drivers\gbpkm.sys [2012-7-20 49536]
R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2013-6-18 211560]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2013-11-2 775952]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2013-11-2 67824]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2014-1-29 50344]
R2 DragonUpdater;COMODO Dragon Update Service;c:\program files\comodo\dragon\dragon_updater.exe [2014-1-28 2135232]
R2 GbpSv;Gbp Service;c:\progra~1\gbplugin\GbpSv.exe [2013-10-18 452136]
R2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2013-6-18 107392]
R3 aswStm;aswStm;c:\windows\system32\drivers\aswstm.sys [2013-12-20 64168]
R3 NdisrdMP;NdisrdMP;c:\windows\system32\drivers\GbpNdisrd.sys [2013-7-12 31088]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-3-1 139776]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 cxbu0wdm;OMNIKEY 3x21;c:\windows\system32\drivers\cxbu0wdm.sys [2011-9-6 119040]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\ieetwcollector.exe [2014-2-12 108032]
S3 Ndisrd;GAS Tecnologia Service;c:\windows\system32\drivers\GbpNdisrd.sys [2013-7-12 31088]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-10-29 14848]
S3 rootrepeal;rootrepeal;c:\windows\system32\drivers\rootrepeal.sys [2014-2-21 34816]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2014-2-12 49152]
S3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-10-29 27136]
.
=============== Created Last 30 ================
.
2014-02-21 20:55:35 -------- d-----w- c:\users\edson\appdata\roaming\Runscanner.net
2014-02-21 19:55:31 22304 ----a-w- c:\windows\system32\RegBootDefrag.exe
2014-02-21 19:33:52 -------- d-----w- c:\programdata\GlarySoft
2014-02-21 19:31:23 -------- d-----w- c:\users\edson\appdata\roaming\GlarySoft
2014-02-21 19:31:10 101664 ----a-w- c:\windows\system32\BootDefrag.exe
2014-02-21 19:31:03 -------- d-----w- c:\program files\Glary Utilities 4
2014-02-21 17:32:28 -------- d-----w- c:\windows\AF54923662584AC6A0435B5B89C6EB61.TMP
2014-02-21 17:26:50 -------- d-----w- c:\program files\common files\Wise Installation Wizard
2014-02-21 17:21:40 34816 ----a-w- c:\windows\system32\drivers\rootrepeal.sys
2014-02-21 13:36:31 -------- d-sh--w- C:\$RECYCLE.BIN
2014-02-13 13:19:08 5693440 ----a-w- c:\windows\system32\mstscax.dll
2014-02-12 14:15:25 32256 ----a-w- c:\windows\system32\TsUsbGDCoInstaller.dll
2014-02-12 14:15:21 12800 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-02-12 14:15:19 49152 ----a-w- c:\windows\system32\drivers\TsUsbFlt.sys
2014-02-12 14:15:17 17920 ----a-w- c:\windows\system32\wksprtPS.dll
2014-02-12 14:15:17 14336 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-02-12 14:15:16 855552 ----a-w- c:\windows\system32\rdvidcrl.dll
2014-02-12 14:15:16 76288 ----a-w- c:\windows\system32\TSWbPrxy.exe
2014-02-12 14:15:16 53248 ----a-w- c:\windows\system32\tsgqec.dll
2014-02-12 14:15:16 50176 ----a-w- c:\windows\system32\MsRdpWebAccess.dll
2014-02-12 14:15:16 350208 ----a-w- c:\windows\system32\wksprt.exe
2014-02-12 14:15:16 1068544 ----a-w- c:\windows\system32\mstsc.exe
2014-02-12 14:13:57 792576 ----a-w- c:\windows\system32\TSWorkspace.dll
2014-02-12 14:00:52 454656 ----a-w- c:\windows\system32\vbscript.dll
2014-02-12 13:58:28 2048 ----a-w- c:\windows\system32\msxml3r.dll
2014-02-12 13:58:28 1237504 ----a-w- c:\windows\system32\msxml3.dll
2014-02-12 13:58:15 1987584 ----a-w- c:\windows\system32\d3d10warp.dll
2014-02-12 13:58:14 3419136 ----a-w- c:\windows\system32\d2d1.dll
2014-02-12 13:57:54 594944 ----a-w- c:\windows\system32\RMActivate_isv.exe
2014-02-12 13:57:54 572416 ----a-w- c:\windows\system32\RMActivate.exe
2014-02-12 13:57:54 510976 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2014-02-12 13:57:54 508928 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2014-02-12 13:57:54 428032 ----a-w- c:\windows\system32\secproc.dll
2014-02-12 13:57:54 423936 ----a-w- c:\windows\system32\secproc_isv.dll
2014-02-12 13:57:53 87040 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2014-02-12 13:57:53 87040 ----a-w- c:\windows\system32\secproc_ssp.dll
2014-02-12 13:57:53 390144 ----a-w- c:\windows\system32\msdrm.dll
2014-02-03 11:38:02 -------- d-----w- c:\users\edson\appdata\local\Comodo
2014-02-01 22:56:57 -------- d-----w- c:\users\edson\appdata\local\Adobe
2014-02-01 18:22:43 -------- d-sh--w- c:\programdata\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-01-31 23:22:59 -------- d-----w- c:\windows\system32\wbem\repository
2014-01-30 21:49:07 -------- d-----w- c:\program files\Gadwin Systems
2014-01-29 19:50:56 -------- d-----w- c:\users\edson\appdata\local\Temp
2014-01-29 17:50:30 32768 ----a-w- c:\program files\common files\installshield\professional\runtime\Objectps.dll
2014-01-29 17:50:29 733184 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\iKernel.dll
2014-01-29 17:50:29 69715 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\ctor.dll
2014-01-29 17:50:29 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\DotNetInstaller.exe
2014-01-29 17:50:29 266240 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\iscript.dll
2014-01-29 17:50:29 172032 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\iuser.dll
2014-01-29 17:50:26 180356 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\iGdi.dll
2014-01-29 17:50:25 303236 ----a-w- c:\program files\common files\installshield\professional\runtime\10\01\intel32\setup.dll
.
==================== Find3M ====================
.
2014-02-21 21:03:36 31088 ----a-w- c:\windows\system32\drivers\GbpNdisrd.sys
2014-02-20 23:19:20 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-02-20 23:19:20 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-02-06 10:20:26 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-02-06 10:19:55 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2014-02-06 10:01:36 61952 ----a-w- c:\windows\system32\iesetup.dll
2014-02-06 10:00:46 51200 ----a-w- c:\windows\system32\ieetwproxystub.dll
2014-02-06 09:47:22 112128 ----a-w- c:\windows\system32\ieUnatt.exe
2014-02-06 09:47:18 108032 ----a-w- c:\windows\system32\ieetwcollector.exe
2014-02-06 09:46:27 553472 ----a-w- c:\windows\system32\jscript9diag.dll
2014-02-06 09:25:36 4244480 ----a-w- c:\windows\system32\jscript9.dll
2014-02-06 09:09:30 1964032 ----a-w- c:\windows\system32\inetcpl.cpl
2014-02-06 08:41:35 1820160 ----a-w- c:\windows\system32\wininet.dll
2014-01-30 11:46:38 48392 ----a-w- c:\windows\system32\certsentry.dll
2014-01-29 17:31:08 775952 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2014-01-29 17:31:08 67824 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-01-29 17:31:08 64168 ----a-w- c:\windows\system32\drivers\aswstm.sys
2014-01-29 17:31:07 43152 ----a-w- c:\windows\avastSS.scr
2014-01-16 13:01:13 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-12-20 13:45:48 180248 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-11-27 01:14:25 258560 ----a-w- c:\windows\system32\drivers\usbhub.sys
2013-11-27 01:13:46 284672 ----a-w- c:\windows\system32\drivers\usbport.sys
2013-11-27 01:13:44 76288 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2013-11-27 01:13:41 43520 ----a-w- c:\windows\system32\drivers\usbehci.sys
2013-11-27 01:13:38 20480 ----a-w- c:\windows\system32\drivers\usbohci.sys
2013-11-27 01:13:36 24064 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2013-11-27 01:13:33 6016 ----a-w- c:\windows\system32\drivers\usbd.sys
2013-11-26 11:11:29 240576 ----a-w- c:\windows\system32\drivers\netio.sys
2013-11-26 10:10:21 2349056 ----a-w- c:\windows\system32\win32k.sys
.
============= FINISH: 18:46:24,61 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Basic
Boot Device: \Device\HarddiskVolume1
Install Date: 17/06/2012 14:35:41
System Uptime: 21/02/2014 19:03:10 (-1 hours ago)
.
Motherboard: MEGA | | G41T-M7 LGT
Processor: Intel(R) Celeron(R) CPU E3400 @ 2.60GHz | CPU 1 | 2593/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 466 GiB total, 428,375 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP975: 21/02/2014 12:47:56 - End of disinfection
RP976: 21/02/2014 12:51:17 - PS SA AT 2070 CD GER JF TBM
RP977: 21/02/2014 15:26:58 - Installed SpyHunter
RP978: 21/02/2014 15:31:57 - Removed SpyHunter
RP979: 21/02/2014 17:13:06 - PS SA AT 2070 CD
RP980: 21/02/2014 18:23:58 - PS SA AT 2070 CD GER A GL
.
==== Installed Programs ======================
.
Adobe Flash Player 12 ActiveX
Adobe Flash Player 12 Plugin
Adobe Reader XI (11.0.06)
Atualização do produto Microsoft Office Excel 2007 Help (KB963678)
Atualização do produto Microsoft Office Outlook 2007 Help (KB963677)
Atualização do produto Microsoft Office Powerpoint 2007 Help (KB963669)
Atualização do produto Microsoft Office Word 2007 Help (KB963665)
avast! Free Antivirus
Comodo Dragon
D3DX10
Gadwin PrintScreen
Glary Utilities 4.6
Google Chrome
Google Update Helper
Java 7 Update 51
Java Auto Updater
Malwarebytes Anti-Malware versão 1.75.0.1300
Microsoft .NET Framework 4.5.1
Microsoft .NET Framework 4.5.1 (Português do Brasil)
Microsoft .NET Framework 4.5.1 (PTB)
Microsoft Application Error Reporting
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (Portuguese (Brazil)) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (Portuguese (Brazil)) 2007
Microsoft Office File Validation Add-In
Microsoft Office Groove MUI (Portuguese (Brazil)) 2007
Microsoft Office InfoPath MUI (Portuguese (Brazil)) 2007
Microsoft Office OneNote MUI (Portuguese (Brazil)) 2007
Microsoft Office Outlook MUI (Portuguese (Brazil)) 2007
Microsoft Office PowerPoint MUI (Portuguese (Brazil)) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (Portuguese (Brazil)) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (Portuguese (Brazil)) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (Portuguese (Brazil)) 2007
Microsoft Office Shared MUI (Portuguese (Brazil)) 2007
Microsoft Office Word MUI (Portuguese (Brazil)) 2007
Microsoft Silverlight
Microsoft SkyDrive
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Revo Uninstaller 1.95
Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596825) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597973) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687439) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760411) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760415) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760585) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760591) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2817641) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2827326) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2837615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2850022) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2827324) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office Outlook 2007 (KB2825644) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2597971) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2837617) 32-Bit Edition
swMSM
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2850085) 32-Bit Edition
VC 9.0 Runtime
.
==== End Of File ===========================


Editando 2 :


Já faz um mês que tive um caso com o baidu aqui também :

http://www.forumpcbrasil.com/t1484-resolvido-baidu-como-remove-lo-do-pc


Vendo o problema do nosso colega foldmat; aqui :


https://www.hardware.com.br/comunidade/baidu-removendo/1334219/ ; resolvi testar/rodar a ferramenta que nosso outro colega ; o Henrique - RJ; o indicou ; um removedor do baidu , hao123 e PCfaster :

http://www.removerhao123.com.br/ . E parece que deu certo !!! (Todos programas e arquivos ao primar estão abrindo normal e rápido ) . Mas antes dei uma boa roçada/otimizada aqui com o limpador/otimizador glary utilities 4 .


http://www.superdownloads.com.br/download/56/glary-utilities/


Agora para ajudar o avast bloqueiou um tal de Kickstarter


MP ao Henrique - RJ ( mensagem à todos internautas ) :


Boa tarde !


Tenho poucos programas instalados; para poder rodar melhor o seven . Assim sendo quando preciso de um software instalo e removo já/após a utilização do mesmo .

Só mantenho o AV por que precisa mesmo ( nem tanto na varredura e sim em uma detecção em tempo real ; no caso avast ; a sua proteção ativa que é muito boa) . Se não nem deixava aqui um AV .

Já pensei tbm em remover o malwarebytes; instalar sempre que for usar ; mas tenho certo receio de ser infectado e não ser possível a tua instalação . Aí complica tudo sem este excelente removedor de malwares .

Agora já o glary utilidades ; pretendo deixar aqui um tempo; pois como vc pode ver no tópico; este otimizador/limpador me ajudou muito . Parece !! Eu já conhecia - o em outras versões; sempre foi bom .


Abraços
Responder Tópico
© 1999-2024 Hardware.com.br. Todos os direitos reservados.
Imagem do Modal