Com todos estes softwares esporádicos - análise rotina

Tmfeijo disse:

...

Runscanner logfile <a href="http://www.runscanner.net" target="_blank">http://www.runscanner.net</a>



* = signed file

- = file not found



General info

------------

Computer name : EDSON-PC

Creation time : 28/02/2015 09:39:34

Hosts <> 127.0.0.1 : Cannot read hosts file

Hosts file location : %SystemRoot%\System32\drivers\etc

IE version : 9.11.9600.17633

OS : Windows 7 Home Basic

OS Build : 7601

OS SP : Service Pack 1

RunScanner Version : 2.0.0.60

User Language : Português (Brasil)

User rights : Administrator

Windows folder : C:\Windows



Running processes

-----------------

* C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)

* C:\Windows\System32\wininit.exe (Microsoft Corporation)

* C:\Windows\System32\winlogon.exe (Microsoft Corporation)

* C:\Windows\System32\services.exe (Microsoft Corporation)

* C:\Windows\System32\spoolsv.exe (Microsoft Corporation)

  C:\Program Files\UX Pack\Aura\Aura.exe (Stealth Software)

  C:\Users\EDSON\Downloads\AdwCleaner.exe

* C:\Windows\System32\dllhost.exe (Microsoft Corporation)

* C:\Program Files\Firefox Developer Edition\firefox.exe (Mozilla Corporation)

* C:\Program Files\Gadwin\Gadwin PrintScreenPro\PrintScreenPro32.exe (Gadwin Systems)

* C:\PROGRA~1\GbPlugin\gbpsv.exe (GAS Tecnologia)

* C:\Windows\System32\dwm.exe (Microsoft Corporation)

* C:\Windows\System32\smss.exe (Microsoft Corporation)

* C:\Windows\System32\SearchIndexer.exe (Microsoft Corporation)

* C:\Windows\system32\audiodg.exe (Microsoft Corporation)

* C:\Windows\System32\lsass.exe (Microsoft Corporation)

* C:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)

* C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)

* C:\Windows\System32\svchost.exe (Microsoft Corporation)

* C:\Windows\System32\svchost.exe (Microsoft Corporation)

* C:\Windows\System32\svchost.exe (Microsoft Corporation)

* C:\Windows\System32\svchost.exe (Microsoft Corporation)

* C:\Windows\System32\svchost.exe (Microsoft Corporation)

* C:\Windows\System32\svchost.exe (Microsoft Corporation)

* C:\Windows\System32\svchost.exe (Microsoft Corporation)

* C:\Windows\System32\svchost.exe (Microsoft Corporation)

* C:\Windows\System32\svchost.exe (Microsoft Corporation)

* C:\Windows\System32\svchost.exe (Microsoft Corporation)

* C:\Windows\System32\taskhost.exe (Microsoft Corporation)

* C:\Windows\System32\csrss.exe (Microsoft Corporation)

* C:\Windows\System32\csrss.exe (Microsoft Corporation)

* C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (IBM Corp.)

* C:\Program Files\Trusteer\Rapport\bin\RapportService.exe (IBM Corp.)

* C:\Users\EDSON\Downloads\runscanner (1).exe (Runscanner.net)

* C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

* C:\Windows\System32\lsm.exe (Microsoft Corporation)

  C:\Program Files\UX Pack\UserTile\UserTile.exe

  C:\Windows\explorer.exe (Microsoft Corporation)

* C:\Program Files\UX Pack\WinMetro\MetroBar.exe (IObit)

* C:\Program Files\UX Pack\WinMetro\MetroStart.exe (IObit)



Unrated items

-------------

002  C:\Program Files\UX Pack\uxlaunch.exe (Windows X)

010 * C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (.NET Runtime Optimization Service)

010 * C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe® Flash® Player Update Service 16.0 r0)

010 * C:\PROGRA~1\GbPlugin\GbpSv.exe (G-Buster Browser Defense - Service)

010 * C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (RapportMgmtService)

010 * C:\Program Files\IObit\WinMetro\MetroSvc.exe (WinMetro Service)

<strong>011 * C:\Windows\system32\DRIVERS\gzflt.sys (BitDefender Gonzales FileSystem Driver)</strong>

011 * C:\Windows\system32\DRIVERS\gbpndisrdn.sys (GAS Tecnologia - LWF Helper Driver)

011 * C:\Windows\system32\drivers\gbpkm.sys (GbPlugin Device Driver)

011 * C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus32_80128.sys (RapportCerberus)

011 * C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys (RapportEI)

011 * C:\Windows\System32\Drivers\RapportKELL.sys (RapportKE)

011 * C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG)

011 * C:\Windows\system32\DRIVERS\Rt86win7.sys (Realtek 8101E/8168/8169 NDIS 6.20 32-bit Driver  )

<strong>011 * C:\Windows\system32\DRIVERS\trufos.sys (Trufos Kernel Module)</strong>

011 * C:\Windows\system32\drivers\uxpatch.sys (uxpatch)

034  C:\Windows\Explorer.exe (Microsoft Corporation)

034  C:\Windows\Explorer.exe (Microsoft Corporation)

035 * C:\Program Files\Google\Chrome\Application\40.0.2214.115\Installer\chrmstp.exe (Google Inc.) {8A69D345-D564-463c-AFF1-A69D9E530F96}

047  Zone: seg.bb.com.br : <a href="https://seg.bb.com.br" target="_blank">https://seg.bb.com.br</a>

047  Zone: <a href="'http://www.bancobrasil.com.br'" target="_blank">www.bancobrasil.com.br</a> : *.<a href="'http://www.bancobrasil.com.br'" target="_blank">www.bancobrasil.com.br</a>

047  Zone: <a href="'http://www.bb.com.br'" target="_blank">www.bb.com.br</a> : *.<a href="'http://www.bb.com.br'" target="_blank">www.bb.com.br</a>

047  Zone: <a href="'http://www.bb.com.br'" target="_blank">www.bb.com.br</a> : <a href="http://www.bb.com.br" target="_blank">http://www.bb.com.br</a>

047  Zone: www14.bancobrasil.com.br : *.www14.bancobrasil.com.br

047  Zone: www14.bancobrasil.com.br : <a href="https://www14.bancobrasil.com.br" target="_blank">https://www14.bancobrasil.com.br</a>

047  Zone: www2.bancobrasil.com.br : <a href="https://www2.bancobrasil.com.br" target="_blank">https://www2.bancobrasil.com.br</a>

047  Zone: www2.bancobrasil.com.br : *.www2.bancobrasil.com.br

050 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {E37CB5F0-51F5-4395-A808-5FA49E399F83}

052 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {C41A1C0E-EA6C-11D4-B1B8-444553540000}

052 * C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation) {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}

052 * C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation) {DBC80044-A445-435b-BC74-9C25C1C588A9}

061 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {E37CB5F0-51F5-4395-A808-5FA49E399F83}

062 * C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll (Adobe Systems, Inc.) {F9DB5320-233E-11D1-9F84-707F02C10627}

067 * C:\Program Files\GbPlugin\gbieh.dll (Banco do Brasil)

073  Adobe Flash Player Updater.job : C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)

073  GoogleUpdateTaskMachineCore.job : C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)

073  GoogleUpdateTaskMachineUA.job : C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)

100  Start Page HKCU : <a href="'http://www.google.com'" target="_blank">www.google.com</a>

100  Start Page HKLM : <a href="'http://www.google.com'" target="_blank">www.google.com</a>

231 * C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll (Adobe Systems, Inc.) PDF Column Info

254 * C:\PROGRAM FILES\GBPLUGIN\gbieh.dll (Banco do Brasil) {98C11555-BC81-40aa-A053-DAADC5630000}



Missing files

-------------

<strong>010 C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe</strong>

032 rdpclip



>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>





# AdwCleaner v4.111 - Logfile created 28/02/2015 at 09:54:21

# Updated 18/02/2015 by Xplode

# Database : 2015-02-18.3 [Server]

# Operating system : Windows 7 Ultimate  (x86)

# Username : EDSON - EDSON-PC

# Running from : C:\Users\EDSON\Downloads\AdwCleaner.exe

# Option : Cleaning



***** [ Services ] *****





***** [ Files / Folders ] *****





***** [ Scheduled tasks ] *****





***** [ Shortcuts ] *****





***** [ Registry ] *****





***** [ Web browsers ] *****



-\\ Internet Explorer v11.0.9600.17631





-\\ Mozilla Firefox v





-\\ Google Chrome v40.0.2214.115



[C:\Users\EDSON\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://br.ask.com/web?q={searchTerms}



-\\ Opera v27.0.1689.76



[C:\Users\EDSON\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://br.ask.com/web?q={searchTerms}



*************************



AdwCleaner[R0].txt - [923 bytes] - [28/02/2015 09:29:54]

AdwCleaner[S0].txt - [994 bytes] - [28/02/2015 09:54:21]



########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1052  bytes] ##########





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.4.2 (02.02.2015:1)

OS: Windows 7 Home Basic x86

Ran by EDSON on 28/02/2015 at 14:05:56,65

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~









~~~ Services







~~~ Registry Values







~~~ Registry Keys







~~~ Files







~~~ Folders







~~~ Event Viewer Logs were cleared











~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 28/02/2015 at 14:12:42,87

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



<a href="https://www.hardware.com.br/comunidade/baidu-troca/1362318/1.html#post7098288" target="_blank">https://www.hardware.com.br/comunidade/baidu-troca/1362318/1.html#post7098288</a>







Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 21:22:18, on 03/03/2015

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v11.0 (11.00.9600.17631)

Boot mode: Normal



Running processes:

C:\Windows\System32\smss.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\wininit.exe

C:\Windows\system32\csrss.exe

C:\Windows\system32\winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\PROGRA~1\GbPlugin\GbpSv.exe

C:\Windows\system32\svchost.exe

c:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Program Files\Trusteer\Rapport\bin\RapportService.exe

c:\Program Files\Microsoft Security Client\NisSrv.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\UX Pack\UserTile\UserTile.exe

C:\Program Files\UX Pack\WinMetro\MetroBar.exe

C:\Program Files\UX Pack\WinMetro\MetroStart.exe

C:\Program Files\UX Pack\Aura\Aura.exe

C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

C:\Program Files\Firefox Developer Edition\firefox.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Windows\system32\DllHost.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Program Files\Google\Update\GoogleUpdate.exe

C:\Program Files\Google\Update\Install\{258F6E25-CE14-4DF8-8071-751CE4A648EE}\41.0.2272.76_40.0.2214.115_chrome_updater.exe

C:\Users\EDSON\AppData\Local\Temp\CR_D2862.tmp\setup.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\svchost.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

C:\Windows\system32\wbem\wmiprvse.exe



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = <a href="'http://www.google.com'" target="_blank">www.google.com</a>

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = <a href="http://go.microsoft.com/fwlink/?LinkId=69157" target="_blank">http://go.microsoft.com/fwlink/?LinkId=69157</a>

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = <a href="http://go.microsoft.com/fwlink/?LinkId=54896" target="_blank">http://go.microsoft.com/fwlink/?LinkId=54896</a>

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = <a href="http://go.microsoft.com/fwlink/?LinkId=54896" target="_blank">http://go.microsoft.com/fwlink/?LinkId=54896</a>

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = <a href="'http://www.google.com'" target="_blank">www.google.com</a>

<strong>R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = </strong>

O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\PROGRAM FILES\GBPLUGIN\gbieh.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll

O4 - HKLM\..\Run: [UX Launcher] C:\Program Files\UX Pack\uxlaunch.exe

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O15 - Trusted Zone: <a href="'http://www.bancobrasil.com.br'" target="_blank">www.bancobrasil.com.br</a>

O15 - Trusted Zone: www14.bancobrasil.com.br

O15 - Trusted Zone: www2.bancobrasil.com.br

O15 - Trusted Zone: <a href="'http://www.bb.com.br'" target="_blank">www.bb.com.br</a>

O15 - Trusted Zone: <a href="http://www.bb.com.br" target="_blank">http://www.bb.com.br</a>

O20 - Winlogon Notify:  GbPluginBb - C:\Program Files\GbPlugin\gbieh.dll

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Gbp Service (GbpSv) - GAS Tecnologia - C:\PROGRA~1\GbPlugin\GbpSv.exe

O23 - Service: WinMetro Service (MetroServ) - IObit - C:\Program Files\IObit\WinMetro\MetroSvc.exe

O23 - Service: Rapport Management Service (RapportMgmtService) - IBM Corp. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe



--

End of file - 4131 bytes



E este limpador; o diskmax :



<a href="http://www.koshyjohn.com/software/diskmax/" target="_blank">http://www.koshyjohn.com/software/diskmax/</a>



Sistema operativo otimizado;  com poucos programas instalados :

<a href="'http://s1062.photobucket.com/user/Edson_Melo/media/Screen%20Shot%2003-09-15%20at%2009.24%20PM%20001.png.html?sort=3&o=0'" target="_blank">http://s1062.photobucket.com/user/Edson_Melo/media/Screen Shot 03-09-15 at 09.24 PM 001.png.html?sort=3&o=0</a>

<a href="'http://s1062.photobucket.com/user/Edson_Melo/media/Screen%20Shot%2003-09-15%20at%2009.24%20PM.png.html?sort=3&o=0'" target="_blank">http://s1062.photobucket.com/user/Edson_Melo/media/Screen Shot 03-09-15 at 09.24 PM.png.html?sort=3&o=0</a>