Estou com um hijacker no PC.. como remover?

Question

eu passei o dns repair do nicolas cool man e detectou esses hijacker ai na foto, e agora eu preciso de algum programa para remover? não estou conseguindo remover pelo o dns reapair, pode ser a versão, não achei outra preciso de ajuda para remover todos os esses hijackers. foi esse programa dnssapi.dll. eu vou colocar uma foto e alguém me ajuda?

como posso remover esses hijackes?

como posso remover esses hijackes?

Answer

/!\ Bom Dia! [COLOR=#0000b3]Nickolas1993 [/COLOR]/!\

https://www.hardware.com.br/static/c/m/2d441aee0b3a76b54acd825fe2334586
http://www.hardware.com.br/comunidade/v-t/1226830/
Siga as recomenda&ccedil;&otilde;es oficiais deste T&oacute;pico e poste: [COLOR=green]FRST.txt[/COLOR] + [COLOR=green]Addition.txt
[/COLOR]
https://www.hardware.com.br/static/c/m/3ed0a67d0b61855daeb1fe37fee406eb

Answer

Antes de sugerir qualquer solu&ccedil;&atilde;o, voc&ecirc; est&aacute; enfrentando algum problema no computador ?!

Answer

https://www.cjoint.com/c/JHbp5pIU2Il

https://www.cjoint.com/c/JHbqangj4gl[SPOILER][/SPOILER]

Answer

https://up.security-x.fr/file.php?h=R0385fea5a11099062e7d1e63e23b7691[SPOILER][/SPOILER]

Answer

/!\ Boa Noite! [COLOR=#0000ff]Nickolas1993 [/COLOR]/!\

> Desinstale:

[COLOR=#660000]>> Registry Doctor[/COLOR] (Shareware Version) (HKLM-x32\...\Registry Doctor (Shareware Version)_is1) (Version: 1.00 - &copy; Optimize Your PC)
[COLOR=#ff0000]>> SpyHunter 5[/COLOR] (HKLM-x32\...\SpyHunter5) (Version: 5.9.15.197 - EnigmaSoft Limited)
[COLOR=#660000]>> Malware Eraser vers&atilde;o 1.2 [/COLOR](HKLM-x32\...\{D382E642-7EA5-4754-8DEB-1F9E931FF85F}_is1) (Version: 1.2 - TCPmonitor.altervista.org)
[COLOR=#660000]>> Mz 7 Optimizer[/COLOR] (HKLM\...\Mz7Optimizer_is1) (Version: 1.1.0 - Mz 7 Optimizer)
[COLOR=#660000]>> Network Mechanic[/COLOR] (HKLM-x32\...\Network Mechanic) (Version: 3.1 - Benutec Software, INC)
[COLOR=#b30000]>> Throttle[/COLOR] (HKLM-x32\...\Throttle_is1) (Version: 8.7.13.2020 - PGWARE LLC)
[COLOR=#b30000]>> WinLib Toolbar Cleaner[/COLOR] (HKLM-x32\...\WinLib Toolbar Cleaner_is1) (Version: - WinLib LLC)
>
>
> Copie estas informa&ccedil;&otilde;es que est&atilde;o no Spoiler,para o Bloco de Notas.
> Salve-as com o nome [COLOR=green]fixlist[/COLOR].  Salve-as ao desktop! ( &Aacute;rea de trabalho ... )
> Mova a [COLOR=#663300]FRST [/COLOR]ao desktop! (Executando a partir de C:\Users\HP\[COLOR=#ff0000]Downloads[/COLOR])  EnigmaSoft Limited) C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe
(EnigmaSoft Limited -> EnigmaSoft Limited) C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe
(EnigmaSoft Limited -> EnigmaSoft Limited) C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe
(Secure Hunter LLC -> SecureHunter LLC) [Arquivo n&atilde;o assinado] C:\Program Files (x86)\SecureHunter\AntiMalwarePro\bin\shrtsrv.exe
Tcpip\..\Interfaces\{31BCF75D-3188-4041-ACD8-2F43FA8245E5}: [NameServer] 4.2.2.1,4.2.2.2
Tcpip\..\Interfaces\{F7250A6F-4E0E-498A-9BAE-A4829A3F41C8}: [NameServer] 4.2.2.1,4.2.2.2
FF Plugin: @microsoft.com/GENUINE -> disabled [Nenhum Arquivo]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Nenhum Arquivo]
R2 EsgShKernel; C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe [12419128 2020-07-30] (EnigmaSoft Limited -> EnigmaSoft Limited)
S2 luminati_net_updater_win_megacubo_tv; C:\Users\HP\AppData\Roaming\Megacubo\305B\net_updater64.exe [2700624 2020-07-29] (Luminati Networks -> Luminati Networks Ltd.)
R2 Secure Hunter Service; C:\Program Files (x86)\SecureHunter\AntiMalwarePro\bin\shrtsrv.exe [47872 2016-11-22] (Secure Hunter LLC -> SecureHunter LLC) [Arquivo n&atilde;o assinado]
R2 ShMonitor; C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe [526904 2020-07-30] (EnigmaSoft Limited -> EnigmaSoft Limited)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
2020-07-31 23:17 - 2020-07-31 23:17 - 000028376 _____ C:\ComboFix.txt
2020-07-31 23:08 - 2011-06-26 03:45 - 000256000 _____ C:\Windows\PEV.exe
2020-07-31 23:08 - 2010-11-07 14:20 - 000208896 _____ C:\Windows\MBR.exe
2020-07-31 23:08 - 2009-04-20 01:56 - 000060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2020-07-31 23:08 - 2000-08-30 21:00 - 000518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2020-07-31 23:08 - 2000-08-30 21:00 - 000406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2020-07-31 23:08 - 2000-08-30 21:00 - 000098816 _____ C:\Windows\sed.exe
2020-07-31 23:08 - 2000-08-30 21:00 - 000080412 _____ C:\Windows\grep.exe
2020-07-31 23:08 - 2000-08-30 21:00 - 000068096 _____ C:\Windows\zip.exe
2020-07-31 23:07 - 2020-07-31 23:17 - 000000000 ____D C:\Qoobox
2020-07-31 23:07 - 2020-07-31 23:15 - 000000000 ____D C:\Windows\erdnt
2020-07-31 23:06 - 2020-07-31 23:07 - 005659583 ____R (Swearware) C:\Users\HP\Downloads\ComboFix.exe
2020-07-30 19:35 - 2020-08-01 12:47 - 000076744 _____ (EnigmaSoft Limited) C:\Windows\system32\Drivers\EnigmaFileMonDriver.sys
2020-07-30 19:35 - 2020-07-30 19:35 - 000001014 _____ C:\Users\Todos os Usu&aacute;rios\Desktop\SpyHunter5.lnk
2020-07-30 19:35 - 2020-07-30 19:35 - 000001014 _____ C:\Users\Public\Desktop\SpyHunter5.lnk
2020-07-30 19:35 - 2020-07-30 19:35 - 000001014 _____ C:\ProgramData\Desktop\SpyHunter5.lnk
2020-07-30 19:35 - 2020-07-30 19:35 - 000000000 ____D C:\Users\Todos os Usu&aacute;rios\EnigmaSoft Limited
2020-07-30 19:35 - 2020-07-30 19:35 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EnigmaSoft
2020-07-30 19:35 - 2020-07-30 19:35 - 000000000 ____D C:\ProgramData\EnigmaSoft Limited
2020-07-30 19:34 - 2020-07-30 19:35 - 000000000 ____D C:\sh5ldr
2020-07-30 19:28 - 2020-07-30 19:28 - 000000000 ____D C:\Program Files\EnigmaSoft
2020-07-30 19:27 - 2020-07-30 19:28 - 006455520 _____ (EnigmaSoft Limited) C:\Users\HP\Downloads\SpyHunter-Installer.exe
2020-07-30 18:11 - 2020-07-30 18:11 - 000000000 ____D C:\Program Files\Trojan Killer
2020-07-30 18:10 - 2020-07-30 18:10 - 000001010 _____ C:\Users\Todos os Usu&aacute;rios\Desktop\Trojan Killer.lnk
2020-07-30 18:10 - 2020-07-30 18:10 - 000001010 _____ C:\Users\Public\Desktop\Trojan Killer.lnk
2020-07-30 18:10 - 2020-07-30 18:10 - 000001010 _____ C:\ProgramData\Desktop\Trojan Killer.lnk
2020-07-30 18:09 - 2020-07-30 18:23 - 000000000 ____D C:\Program Files (x86)\Trojan Killer
2020-07-30 17:57 - 2020-07-30 18:53 - 000000000 ____D C:\Program Files\GridinSoft Anti-Malware
2020-07-30 17:57 - 2020-07-30 18:51 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GridinSoft Anti-Malware
2020-07-30 17:57 - 2020-07-30 17:57 - 000000000 ____D C:\Users\Todos os Usu&aacute;rios\GridinSoft
2020-07-30 17:57 - 2020-07-30 17:57 - 000000000 ____D C:\ProgramData\GridinSoft
2020-07-30 17:56 - 2020-01-17 16:24 - 000000509 _____ C:\Users\HP\Desktop\readme.txt
2020-07-30 17:48 - 2020-07-30 17:59 - 080169795 _____ C:\Users\HP\Downloads\Trojan Killer [Portable Edition] 2.1.30 [MrSzzS].zip
2020-07-30 17:45 - 2020-07-30 17:56 - 090289118 _____ C:\Users\HP\Downloads\GridinSoft Anti-Malware 4.1.45.4945 [MrSzzS].zip
2020-07-29 20:49 - 2020-07-30 22:09 - 000000000 ____D C:\Users\HP\AppData\Local\megacubo
2020-07-28 00:27 - 2020-07-28 00:27 - 000001134 _____ C:\Users\Todos os Usu&aacute;rios\Desktop\Megacubo.lnk
2020-07-28 00:27 - 2020-07-28 00:27 - 000001134 _____ C:\Users\Public\Desktop\Megacubo.lnk
2020-07-28 00:27 - 2020-07-28 00:27 - 000001134 _____ C:\ProgramData\Desktop\Megacubo.lnk
2020-07-28 00:27 - 2020-07-28 00:27 - 000000000 ____D C:\Users\HP\AppData\Roaming\Megacubo
2020-07-28 00:27 - 2020-07-28 00:27 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Megacubo
2020-07-27 08:03 - 2020-07-27 08:04 - 000000000 ____D C:\Program Files (x86)\Malware Scan
2020-07-27 07:53 - 2020-07-27 18:26 - 000000000 ____D C:\Users\Todos os Usu&aacute;rios\Documents\Wise Anit Malware
2020-07-27 07:53 - 2020-07-27 18:26 - 000000000 ____D C:\Users\Public\Documents\Wise Anit Malware
2020-07-27 07:53 - 2020-07-27 18:26 - 000000000 ____D C:\ProgramData\Documents\Wise Anit Malware
2020-07-27 07:52 - 2020-07-27 07:52 - 000000000 ____D C:\Program Files\Wise
2020-07-27 07:48 - 2020-07-27 07:51 - 077049444 _____ C:\Users\HP\Downloads\Wise.Anti.Malware.PRO.2.1.8.106.zip
2020-07-27 07:40 - 2020-07-30 18:23 - 000000000 ____D C:\Users\HP\Desktop\PCHunter_free
2020-07-27 06:51 - 2020-07-27 06:51 - 000000000 ____D C:\Program Files (x86)\SecureHunter
2020-07-27 06:50 - 2020-07-27 06:51 - 022610038 _____ C:\Users\HP\Downloads\SecureHunterProSetup.zip
2020-07-27 06:45 - 2020-07-27 06:55 - 000000000 ____D C:\Users\HP\AppData\Local\Xvirus
2020-07-27 06:45 - 2020-07-27 06:45 - 000000000 ____D C:\Users\HP\AppData\Roaming\xvirusam
2020-07-27 06:44 - 2020-07-27 06:55 - 000000000 ____D C:\Program Files (x86)\Xvirus Anti-Malware
2020-07-27 06:44 - 2020-07-27 06:44 - 002984960 _____ (Xvirus) C:\Users\HP\Downloads\xvirus-setup.exe
2020-07-27 06:34 - 2020-07-27 06:34 - 000840422 _____ (WinLib LLC ) C:\Users\HP\Downloads\WinLib_ToolbarCleaner_Trial.exe
2020-07-27 06:34 - 2020-07-27 06:34 - 000000000 ____D C:\Program Files (x86)\WinLib LLC
2020-07-27 06:27 - 2020-07-27 06:28 - 000000785 _____ C:\rapport.txt
2020-07-27 06:27 - 2020-07-27 06:28 - 000000000 _____ C:\Windows\SysWOW64\tmp.txt
2020-07-27 06:26 - 2020-07-27 06:26 - 000000724 _____ C:\abtext.txt
2020-07-27 06:25 - 2020-07-27 06:28 - 000000000 ____D C:\Users\HP\Downloads\SmitfraudFix
2020-07-27 06:23 - 2020-07-27 06:37 - 000003136 _____ C:\Windows\system32\Tasks\GridinSoft Anti-Ransomware
2020-07-27 06:22 - 2020-07-27 06:22 - 003668968 _____ (GridinSoft, LLC. ) C:\Users\HP\Downloads\anti-ransomware.exe
2020-07-27 06:14 - 2020-07-27 06:14 - 002105973 _____ C:\Users\HP\Downloads\SpyDLLRemover(3).zip
2020-07-27 06:14 - 2020-07-27 06:14 - 002105973 _____ C:\Users\HP\Downloads\SpyDLLRemover(2).zip
2020-07-27 05:56 - 2020-07-31 23:22 - 000000000 ____D C:\AdwCleaner
2020-07-27 05:55 - 2020-07-27 05:56 - 008414384 _____ (Malwarebytes) C:\Users\HP\Downloads\adwcleaner_8.0.7.exe
2020-07-27 05:52 - 2020-07-27 05:52 - 000000000 ____D C:\Program Files (x86)\TeaTimer (Spybot - Search & Destroy)
2020-07-27 05:52 - 2020-07-27 05:52 - 000000000 ____D C:\Program Files (x86)\SDHelper (Spybot - Search & Destroy)
2020-07-27 05:52 - 2020-07-27 05:52 - 000000000 ____D C:\Program Files (x86)\Misc. Support Library (Spybot - Search & Destroy)
2020-07-27 05:52 - 2020-07-27 05:52 - 000000000 ____D C:\Program Files (x86)\File Scanner Library (Spybot - Search & Destroy)
2020-07-27 05:49 - 2020-07-27 05:57 - 000000000 ____D C:\Users\Todos os Usu&aacute;rios\Spybot - Search & Destroy
2020-07-27 05:49 - 2020-07-27 05:57 - 000000000 ____D C:\ProgramData\Spybot - Search & Destroy
2020-07-27 05:49 - 2020-07-27 05:57 - 000000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy
2020-07-27 05:49 - 2020-07-27 05:49 - 004354084 _____ (Safer Networking Limited ) C:\Users\HP\Downloads\spybotsd13.exe
020-07-27 05:21 - 2020-07-27 05:21 - 000532480 _____ (Trend Micro Incorporated) C:\Users\HP\Downloads\cwshredder.exe
2020-07-27 05:20 - 2020-07-27 05:21 - 000000259 _____ C:\Users\HP\Downloads\noadware.zip
2020-07-27 05:04 - 2020-07-27 05:06 - 000000000 ____D C:\Users\HP\AppData\Local\Remove Toolbar Buddy
2020-07-27 05:04 - 2020-07-27 05:04 - 000000000 ____D C:\Program Files (x86)\Scorpio Software
2020-07-27 05:03 - 2020-07-27 05:03 - 004860728 _____ (Scorpio Software ) C:\Users\HP\Downloads\RemoveToolbarBuddy6.1.exe
2020-07-27 04:50 - 2020-07-27 04:51 - 015262304 _____ (Sorentio Systems Ltd. ) C:\Users\HP\Downloads\S4BToolbarCleaner.exe
2020-07-27 03:56 - 2011-02-26 05:41 - 000000452 _____ C:\Users\HP\Desktop\Readme.html
2020-07-27 03:55 - 2020-07-27 03:55 - 002105973 _____ C:\Users\HP\Downloads\SpyDLLRemover(1).zip
2020-07-27 03:54 - 2020-07-27 03:55 - 002105973 _____ C:\Users\HP\Downloads\SpyDLLRemover.zip
2020-07-27 01:38 - 2020-07-27 01:38 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Registry Doctor
2020-07-27 01:37 - 2020-07-27 01:38 - 002050065 _____ C:\Users\HP\Downloads\rdsetup.exe
2020-07-27 01:31 - 2020-07-30 18:23 - 000000000 ____D C:\Users\Todos os Usu&aacute;rios\MacPaw Inc
2020-07-27 01:31 - 2020-07-30 18:23 - 000000000 ____D C:\ProgramData\MacPaw Inc
2020-07-27 01:30 - 2020-07-27 01:31 - 028945224 _____ (MacPaw, Inc. ) C:\Users\HP\Downloads\CleanMyPC.exe
2020-07-27 01:16 - 2020-07-27 01:17 - 003980210 _____ (Rad Corporation) C:\Users\HP\Downloads\rad-kk.exe
2020-07-27 01:16 - 2020-07-27 01:17 - 000000000 ____D C:\Program Files (x86)\Malware Eraser
2020-07-27 01:16 - 2020-07-27 01:16 - 001214902 _____ (TCPmonitor.altervista.org ) C:\Users\HP\Downloads\Malware_Eraser_Setup1.2.exe
2020-07-27 01:16 - 2020-07-27 01:16 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malware Eraser
2020-07-27 01:14 - 2020-07-27 01:14 - 002801055 _____ C:\Users\HP\Downloads\pcttFixTool.zip
2020-07-27 01:14 - 2020-07-27 01:14 - 000000000 ____D C:\Users\HP\AppData\Roaming\PCTools
2020-07-27 01:12 - 2020-07-27 01:12 - 000000000 ____D C:\Users\Todos os Usu&aacute;rios\ESET
2020-07-27 01:12 - 2020-07-27 01:12 - 000000000 ____D C:\ProgramData\ESET
2020-07-27 01:11 - 2020-07-27 01:11 - 000000000 ____D C:\Users\HP\AppData\Local\VirCleaner
2020-07-27 01:10 - 2020-07-27 01:10 - 003238369 _____ C:\Users\HP\Downloads\VirCleaner.zip
2020-07-27 01:10 - 2020-07-27 01:10 - 002991832 _____ (ESET) C:\Users\HP\Downloads\ERARemover_x64.exe
2020-07-27 01:09 - 2020-07-27 01:09 - 000008888 _____ C:\Users\HP\Downloads\MalWareSpy.zip
2020-07-27 01:07 - 2020-07-27 01:07 - 000237056 _____ (SC BitDefender , Romania) C:\Users\HP\Downloads\ZbotRemovalTool.exe
2020-07-27 01:06 - 2020-07-27 01:06 - 000000000 ____D C:\Program Files (x86)\NoVirusThanks
2020-07-27 01:05 - 2020-07-27 01:05 - 001699163 _____ (NoVirusThanks Company Srl ) C:\Users\HP\Downloads\NVTArk_Free_Setup.exe
2020-07-27 00:54 - 2020-07-27 00:55 - 002698691 _____ C:\Users\HP\Downloads\RunPEDetectorV2.zip
2020-07-27 00:48 - 2020-07-27 00:48 - 000061440 _____ (Sergiwa Software - www.sergiwa.com) C:\Users\HP\Downloads\PRT.exe
2020-07-27 00:46 - 2020-07-27 00:46 - 001927226 _____ C:\Users\HP\Downloads\Baixaki_MV Antivirus and Internet Security 2013.msi
2020-07-27 00:42 - 2020-07-27 00:42 - 003140040 _____ (Software ) C:\Users\HP\Downloads\Baixaki_MV Antivirus and Internet Security 2013_1504909455.exe
2020-07-27 00:42 - 2020-07-27 00:42 - 001811993 _____ (Lunarsoft ) C:\Users\HP\Downloads\Anti-Malware_Toolkit_Setup.exe
2020-07-27 00:42 - 2020-07-27 00:42 - 000000000 ____D C:\Users\HP\AppData\Local\Lunarsoft
2020-07-27 00:00 - 2020-07-27 00:00 - 000249856 ____N (Microsoft Corporation) C:\Windows\Setup1.exe
2020-07-27 00:00 - 2020-07-27 00:00 - 000073216 _____ (Microsoft Corporation) C:\Windows\ST6UNST.EXE
2020-07-27 00:00 - 2020-07-27 00:00 - 000000000 ____D C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TCSpeedBooster
2020-07-27 00:00 - 2020-07-27 00:00 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TCSpeedBooster
2020-07-27 00:00 - 2020-07-27 00:00 - 000000000 ____D C:\Program Files (x86)\TCSpeedBooster
2020-07-26 23:59 - 2020-07-27 00:00 - 002758395 _____ C:\Users\HP\Downloads\TCSpeedBooster.zip
2020-07-26 18:40 - 2020-07-26 18:40 - 002676208 _____ C:\Users\HP\Downloads\nettweakpro.exe
2020-07-26 18:40 - 2020-07-26 18:40 - 001065505 _____ C:\Users\HP\Downloads\MemBoost_1959(1).zip
2020-07-26 18:39 - 2020-07-26 18:40 - 001065505 _____ C:\Users\HP\Downloads\MemBoost_1959.zip
2020-07-26 18:31 - 2020-07-26 18:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\M Internet Optimizer
2020-07-26 18:31 - 2020-07-26 18:31 - 000000000 ____D C:\Windows\M Internet Optimizer
2020-07-26 18:30 - 2020-07-26 18:31 - 003768793 _____ C:\Users\HP\Downloads\MInternetOptimizer2.0.rar
2020-07-26 18:29 - 2020-07-26 18:30 - 003832958 _____ (PGWARE LLC ) C:\Users\HP\Downloads\throttle.exe
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> Nenhum Arquivo
FirewallRules: [{81440807-D47C-4D2A-B8B2-1D42DC009201}] => (Allow) C:\Users\HP\AppData\Roaming\Megacubo\305B\megacubo.exe (The NW.js Community) [Arquivo n&atilde;o assinado]
FirewallRules: [{F4E1D587-B5C0-4E5E-9DD0-FE272A612BE7}] => (Allow) C:\Users\HP\AppData\Roaming\Megacubo\305B\megacubo.exe (The NW.js Community) [Arquivo n&atilde;o assinado]
C:\Program Files (x86)\SecureHunter\AntiMalwarePro\bin\shrtsrv.exe
C:\Program Files (x86)\SecureHunter\AntiMalwarePro
C:\Program Files (x86)\SecureHunter
CMD: ipconfig /flushdns
CreateRestorePoint:
RemoveProxy:
EmptyTemp:
Reboot:
Hosts:
end::[/COLOR][/spoiler]

https://www.hardware.com.br/static/c/m/2c364acc7790f747620c7fb0d29a2fb3

> Execute FRST/FRST64 >> Clique Corrigir  Poste o relat&oacute;rio [COLOR=darkred]Resultado da Corre&ccedil;&atilde;o pela Farbar Recovery Scan Tool[/COLOR]. ([COLOR=green]Fixlog.txt[/COLOR])
> Este e outros relat&oacute;rios,podem ser encontrados na pasta: Disco Local (C) > FRST >[COLOR=#663300] Logs
[/COLOR]
< [COLOR=red]Pe&ccedil;o aos visitantes que n&atilde;o utilizem este script em outros computadores,sob risco de danos aos mesmos![/COLOR] >

[]s

Answer

/!\ Boa Noite! [COLOR=#0000b3]Nickolas1993[/COLOR] /!\ > Pode ter havido corrupção do ficheiro ([COLOR=#0059b3]dnsapi.dll[/COLOR]),pois o mesmo é legítimo. NB: [COLOR=#ff0000]This software is no longer maintained ![/COLOR] > Estou editando este Post,para incluir algumas informações sobre o [COLOR=#006666]RepairDNS[/COLOR] de[COLOR=#006600] Nicolas Coolman[/COLOR]. Onde ,devido ao fato de apresentar muitos falso positivo,foi a mesma [COLOR=#b30000]descontinuada[/COLOR]. > A ferramenta [COLOR=#006666]ZHPCleaner[/COLOR],do mesmo autor,costuma apontar configurações legítimas de rede, [COLOR=#4da6ff][[/COLOR][COLOR=#660000]MD5.9B86DF86D1EFF32893BC3FB49BFAA993[/COLOR][COLOR=#4da6ff]] - 08/06/2018 - (.Microsoft Corporation - DLL da API de cliente DNS.) -- C:\Windows\System32\[/COLOR][COLOR=#003366]dnsapi.dll[/COLOR][COLOR=#4da6ff] [357888] [Unsigned] =>.Microsoft Corporation [[/COLOR][COLOR=#660000]MD5.4A35D7B172AFF9C6B362D7297568836A[/COLOR][COLOR=#4da6ff]] - 08/06/2018 - (.Microsoft Corporation - DLL da API de cliente DNS.) -- C:\Windows\Syswow64\[/COLOR][COLOR=#003366]dnsapi.dll[/COLOR][COLOR=#4da6ff] [269824] [Unsigned] =>.Microsoft Corporation[/COLOR] > Ps: Estas são as corretas assinaturas do ficheiro,quando são instalados pela [COLOR=#0059b3]Microsoft[/COLOR]. > Baixe: < https://www.hardware.com.br/static/c/m/521cfd54cbd21c9a4bf097ff4be0dc22 > < https://www.hardware.com.br/static/c/m/d4a4f08ba02aff62cd933f4ad8a73d12 > ( [COLOR=#59b300]... de Nicolas Coolman[/COLOR] ) https://nicolascoolman.eu/ > Ou daqui! > Estando na página,clique: Télécharger > Salve-a ao desktop! ( [COLOR=green]ZHPDiag3[/COLOR] ) https://www.hardware.com.br/static/c/m/cde570462a8d1c3a40bc9cb338ae70ab > Feche o navegador! > Execute ZHPDiag3.exe,como administrador,para instalar a ferramenta! https://www.hardware.com.br/static/c/m/b873216b9e55d44ceb35891f642a99e0 > Ao surgir esta tela,evite clicar em Atualização! Feche-a clicando no [X]. https://www.hardware.com.br/static/c/m/d86002e3e2579c7c6da3dc23ce7bbffe > Clique Scanner. https://www.hardware.com.br/static/c/m/c9ee71ca8c8f585229f149d52f6b6034 > Aguarde a conclusão! ( ...de [COLOR=#660000]1%[/COLOR] até [COLOR=#660000]100%[/COLOR] ) https://www.hardware.com.br/static/c/m/a373ae0a91792d6963928b4ebe2114c7 > À seguir,clique Relatório. > O relatório estará disponibilizado em formato html. file:///C:/Users/xxx.../AppData/Roaming/ZHP/ZHPDiag.html file:///C:/Users/xxx.../AppData/Roaming/ZHP/ZHPDiag.txt Este será seu relatório direto,obtido ao modificar na barra de endereços,de (.html) para (.txt). Depois,basta selecionar (ctrl + A),copiar (ctrl + C) e colar ao seu Post ou Bloco de Notas. (ctrl + V) > Copie-o a um Bloco de Notas. > Poste-o em sua resposta! ([COLOR=green]~ Modo: Scanner[/COLOR]) > Ps: Como o log será extenso,hospede-o em [COLOR=blue]Pjjoint.malekal[/COLOR]. https://www.hardware.com.br/static/c/m/e3a053269259d26cded7829df7d631ef > Ou acesse: < [COLOR=blue]1fichier.com[/COLOR] > > Ou acesse: < https://www.hardware.com.br/static/c/m/18a3c8e9c6f035ab411768cfd18c8155 > > Clique no botão Parcourir... > Busque o relatório ao desktop. > Clique no botão Abrir. > Clique no botão Créer le lien Cjoint. > Copie o link que está ao lado de Le lien a été créé e poste-o em sua resposta. https://www.hardware.com.br/static/c/m/9ad2ede3936853f26a25c5bc60c31995 > Ou clique Copier le lien (*) e cole o link ao seu Post. utilizando spoiler. []s

Answer

https://cjoint.com/c/JHcugupmgVl

https://1fichier.com/?5gz12pb6lxwqrs49jgdw

fiz o upload do zhpdiag.txt nos dois sites e agora?
algum deve estar certo...

Answer

/!\ Boa Noite! [COLOR=#0000ff]Nickolas1993[/COLOR] /!\ [MD5.9B86DF86D1EFF32893BC3FB49BFAA993] - 08/06/2018 - (.Microsoft Corporation - DLL da API de cliente DNS.) -- C:\Windows\System32\[COLOR=#0000b3]dnsapi.dll[/COLOR] [357888] [Unsigned] =>.Microsoft Corporation [MD5.4A35D7B172AFF9C6B362D7297568836A] - 08/06/2018 - (.Microsoft Corporation - DLL da API de cliente DNS.) -- C:\Windows\Syswow64\[COLOR=#0000b3]dnsapi.dll[/COLOR] > As assinaturas do ficheiro [COLOR=#336600]dnsapi.dll[/COLOR],em seu log,não diferem da que lhe passei! > Portanto,[COLOR=#b30000]falso positivo[/COLOR] qualquer indicação do ficheiro ser um[COLOR=#660000] Trojan.DNSChanger[/COLOR]. > Baixe: < https://www.hardware.com.br/static/c/m/b4a7910c2e431cae33f07d2f539dccb5 > http://www.commentcamarche.net/download/telecharger-34102185-zhpfix > Ou aqui! > Estando na página,clique: [COLOR=blue]Télécharger[/COLOR] > Salve-o ao desktop! > Instale-o,clicando em: [COLOR=#660000]Suivant[/COLOR] >> [COLOR=#660000]Suivant[/COLOR] >>...>> [COLOR=#660000]Suivant [/COLOR]>> [COLOR=#660000]Suivant [/COLOR]>> [COLOR=#660000]Installer [/COLOR]>> [COLOR=#660000]Terminer[/COLOR] Ps: Caso surja uma mensagem do [COLOR=#0059b3]Windows[/COLOR] com a frase [COLOR=#b35900]Deseja permitir que o programa de um fornecedor desconhecido faça alterações neste computador?[/COLOR] Clique Sim > Execute este script na ferramenta ZHPFix. [spoiler][COLOR=darkred]Script ZHPFix EmptyPrefetch EmptyClsid EmptyFlash EmptyTemp FirewallRaz ShortcutFix Ifeofix sysrestore SR - Demand [00/00/0000] [ 0] efavdrv (efavdrv) . (...) - C:\Windows\system32\drivers\efavdrv.sys (.not file.) [Unsigned] SR - Demand [00/00/0000] [ 0] EnigmaFileMonDriver Mini-Filter Driver (EnigmaFileMonDriver) . (...) - C:\Windows\System32\drivers\EnigmaFileMonDriver.sys (.not file.) [Unsigned] SR - Demand [00/00/0000] [ 0] (VGPU) . (...) - C:\Windows\System32\drivers\rdvgkmd.sys (.not file.) [Unsigned] O4 - GS\Quicklaunch [Administrador]: Megacubo.lnk . (...) C:\Users\HP\AppData\Roaming\Megacubo\305B\megacubo.exe --disable-crash-handler=true [Unsigned] O4 - GS\Quicklaunch [Convidado]: Megacubo.lnk . (...) C:\Users\HP\AppData\Roaming\Megacubo\305B\megacubo.exe --disable-crash-handler=true [Unsigned] O42 - Logiciel: SpyHunter 5 - (.EnigmaSoft Limited.) [HKLM][64Bits] -- SpyHunter5 [Unsigned] =>.EnigmaSoft Limited HKLM\SOFTWARE\EnigmaSoft =>.Enigma Software Group, LLC HKCU\SOFTWARE\Baixaki =>.Baixaki HKLM\SOFTWARE\WOW6432Node\Swearware =>.Swearware HKU\S-1-5-21-1462356998-1902129199-331163287-1000\SOFTWARE\Baixaki =>.Baixaki O43 - CFD: 27/07/2020 - [0] SHD -- C:\Users\HP\AppData\Local\EmieSiteList =>.ATTENTION O43 - CFD: 27/07/2020 - [0] SHD -- C:\Users\HP\AppData\Local\EmieUserList =>.ATTENTION O61 - LFC: 2020/08/01 21:45:38 A . (.Gino.) -- C:\Users\HP\Downloads\RepairDNS_2283890330.exe [3783120] {5F91B23C61D7F7200B8CED3CB7679604}. HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\WinRAR32 =>.SUP.Orphan HKLM\Software\Classes\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA} =>.SUP.Orphan HKLM\Software\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32 =>.SUP.Orphan HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR32 =>.SUP.Orphan [5F91B23C61D7F7200B8CED3CB7679604] [01/08/2020] (.AfterDawn Oy.) - C:\Users\HP\Downloads\RepairDNS_2283890330.exe =>.Not verified [6D1E78EF225B298534D84245D6ED9494] [01/08/2020] (.H&V Media Limited.) - C:\Users\HP\Downloads\ComIntRep_4058_Setup_1871928857.exe =>.Not verified [54971FF238D2B866F27FC3FE6C9AD577] [27/07/2020] (.Avira Operations GmbH & Co. KG.) - C:\Users\HP\Downloads\AviraDNSRepairEN.exe =>.Avira Operations GmbH & Co. KG [3AEA7D79BC1D84D2E1AB0FFC8BC35658] [16/08/2018] (.Avira Operations GmbH & Co. KG.) - C:\Windows\System32\DRIVERS\avkmgr.sys =>.Avira Operations GmbH & Co. KG [08A2EC4E78A09E174B192E5535984B59] [01/08/2020] (.Malwarebytes Inc.) - C:\Users\HP\Downloads\adwcleaner_8.0.7.exe =>.Malwarebytes Inc ServiceDemand:EnigmaFileMonDriver ServiceDemand:efavdrv ServiceDemand:VGPU[/COLOR][/spoiler] > Selecione e copie estas informações que estão no Spoiler,para o Bloco de Notas. > Com o Bloco de Notas aberto,faça: [COLOR=green]ctrl+a[/COLOR] >> [COLOR=green]ctrl+c[/COLOR] ( Selecionar e Copiar ) > À seguir,minimize o Bloco de Notas. > Abra a ferramenta ZHPFix. https://www.hardware.com.br/static/c/m/2dba49aed777440926285ed0eed3b66a > Clique IMPORTAÇÃO >> OK. > Ao clicar OK,[COLOR=#b30000]verifique [/COLOR]se o campo está limpo ,para que receba somente as informações do script. > Não encontrando anormalidades,clique GO. https://www.hardware.com.br/static/c/m/86701da9200a6eceac0ca1725c8a91c5 > Ou,clique CONFIGURAR >> Personalizar. > Cole as informações contidas no Bloco de Notas,ao campo da ferramenta. > Clique GO >> [COLOR=#b30000]Oui[/COLOR] >> [COLOR=#b30000]Oui[/COLOR] > Poste o relatório! (C:\Users\Usuário\AppData\Roaming\ZHP\ZHPFix[R1].txt) < [COLOR=red]Peço aos visitantes que não utilizem este script em seus computadores,sob risco de danos aos mesmos![/COLOR] > []s

Ferramentas

Mover Tópico