heliton Posted August 30, 2018 ID:1266496 Share Posted August 30, 2018 Boa Tarde, O Malwarebytes identifica ameaça, como Trojan.Agent.BTMGen localizado no Windows/Temp/Conhost.exe Envia o arquivo para quarentena, e pede para reiniciar o computador para excluir o arquivo. Após a reinicialização, o arquivo reaparece..... Pode me ajudar a excluir definitivamente esse arquivo? Link to post Share on other sites More sharing options...
nasdaq Posted August 30, 2018 ID:1266505 Share Posted August 30, 2018 Hello, Welcome to Malwarebytes. I'm nasdaq and will be helping you. If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed. === Download the version of this tool for your operating system.Farbar Recovery Scan Tool (64 bit)Farbar Recovery Scan Tool (32 bit) and save it to a folder on your computer's Desktop. Double-click to run it. When the tool opens click Yes to disclaimer. Press Scan button. It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply. How to attach a file to your reply: In the Reply section in the bottom of the topic Click the "more reply Options" button. Attach the file. Select the "Choose a File" navigate to the location of the File.Click the file you wish to Attach.Click Attach this file.Click the Add reply button. === Please post the logs for my review. Wait for further instructions Link to post Share on other sites More sharing options...
heliton Posted August 30, 2018 Author ID:1266510 Share Posted August 30, 2018 FRST.txt Addition.txt Link to post Share on other sites More sharing options...
nasdaq Posted August 31, 2018 ID:1266687 Share Posted August 31, 2018 Hi, Remove these programs in bold via the Control Panel > Programs > Programs and Features. CCleaner (HKLM\...\CCleaner) (Version: 5.45 - Piriform) Version 5.45 is compromised. Delete it and get the previous version.https://www.bleepingcomputer.com/news/software/ccleaner-v545-pulled-due-to-anger-over-usage-data-collection/ === Java 8 Update 151 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F32180151F0}) (Version: 8.0.1510.12 - Oracle Corporation) Just delete this OLD version. === Yahoo Search Set (HKLM\...\Yahoo! SearchSet) (Version: - Yahoo Inc.) Adware. === Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the FRST.txt log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. === Please let me lknow if the problem persists. fixlist.txt Link to post Share on other sites More sharing options...
heliton Posted August 31, 2018 Author ID:1266691 Share Posted August 31, 2018 Fixlog.txt Link to post Share on other sites More sharing options...
heliton Posted August 31, 2018 Author ID:1266692 Share Posted August 31, 2018 Link to post Share on other sites More sharing options...
nasdaq Posted August 31, 2018 ID:1266734 Share Posted August 31, 2018 Why the MBAM image? Is the issue solved? Link to post Share on other sites More sharing options...
heliton Posted August 31, 2018 Author ID:1266735 Share Posted August 31, 2018 Boa Tarde, Infelizmente, o problema persiste. O arquivo contaminado reaparece toda vez que reinicia o windows. A imagem é somente para demonstrar o que acontece após a reinicialização; Aguardo orientação Link to post Share on other sites More sharing options...
nasdaq Posted September 1, 2018 ID:1266942 Share Posted September 1, 2018 Hi, It's probably a Sync issue with Crome. Execute this.https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/ Keep me posted Link to post Share on other sites More sharing options...
nasdaq Posted September 8, 2018 ID:1268396 Share Posted September 8, 2018 Are you still with me? Link to post Share on other sites More sharing options...
heliton Posted September 10, 2018 Author ID:1268634 Share Posted September 10, 2018 Bom Dia, Problema foi resolvido com a execução da ultima orientação. Muito obrigado. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 10, 2018 Root Admin ID:1268720 Share Posted September 10, 2018 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted September 15, 2018 Root Admin ID:1269726 Share Posted September 15, 2018 Topic has been reopened per request. Thanks Link to post Share on other sites More sharing options...
nasdaq Posted September 16, 2018 ID:1269809 Share Posted September 16, 2018 heliton I'm listening Link to post Share on other sites More sharing options...
heliton Posted September 17, 2018 Author ID:1269937 Share Posted September 17, 2018 Bom Dia, O arquivo conhost.exe reapareceu, aparece como ameaça quando se faz analise do sistema, é excluindo com reinicialização do sistema e reaparece após iniciar o windows. como devo proceder? Link to post Share on other sites More sharing options...
nasdaq Posted September 17, 2018 ID:1269959 Share Posted September 17, 2018 Hi, We will check your BIOS and Master boot record. Read carefully and follow these steps.TDSS Download TDSSKiller and save it to your Desktop. Doubleclick on TDSSKiller.exe to run the application. Then click on Start Scan. If a suspicious file is detected, the default action will be Skip, click on Continue. If an infected file is detected, the default action will be Cure, click on Continue. Important: Do NOT change the default action on your own unless instructed by a malware Helper! Doing so may render your computer unbootable. It may ask you to reboot the computer to complete the process. Click on Reboot Now. If no reboot is required, click on Report. A log file should appear. Please copy and paste the contents of that file here. If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here. === Download http://public.avast.com/~gmerek/aswMBR.exe (aswMBR.exe) to your desktop. Double click the aswMBR.exe to run it. Click the "Scan" button to start scan. Upon completion of the scan, click Save log, and save it to your desktop. (Note - do not select any Fix at this time) <- IMPORTANT Please paste the contents of that log in your next reply. There shall also be a file on your desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) folder. Please attach that zipped file in your next reply. === Wait for further instructions. Link to post Share on other sites More sharing options...
heliton Posted September 17, 2018 Author ID:1269977 Share Posted September 17, 2018 Boa Tarde, O scan do TDSSkiler acusou arquivo suspeito, mas não consegui copiar o arquivo O arquivo do avast segue anexo. aswMBR.txt Link to post Share on other sites More sharing options...
nasdaq Posted September 17, 2018 ID:1269996 Share Posted September 17, 2018 Hi, Were you not able to save the log generated by the TDSSKiller program. It would list all the entries. Link to post Share on other sites More sharing options...
heliton Posted September 17, 2018 Author ID:1269999 Share Posted September 17, 2018 Após fazer o scan pelo programa TDSSKiller, gera a tela da imagem abaixo: Como faço para conseguir e te enviar o arquivo? Link to post Share on other sites More sharing options...
heliton Posted September 18, 2018 Author ID:1270111 Share Posted September 18, 2018 Bom Dia, Encontrei o arquivo TDSSKiller.2.8.16.0_17.09.2018_15.13.49_log.txt Link to post Share on other sites More sharing options...
nasdaq Posted September 18, 2018 ID:1270137 Share Posted September 18, 2018 Hi, No problems with the RogueKiller logs. The file is protected by the program. Is the conhost.exe in the \temp folder such as C:\Windows\Temp\conhost.exe Or in C:|Wndows\System32 folder? Link to post Share on other sites More sharing options...
heliton Posted September 18, 2018 Author ID:1270140 Share Posted September 18, 2018 É o conhost.exe na pasta \ temp, como ? \ Windows \ Temp \ conhost.exe Esse arquivo que o antivirus identifica e não consegue excluir Link to post Share on other sites More sharing options...
nasdaq Posted September 18, 2018 ID:1270145 Share Posted September 18, 2018 Hi, Restart the computer in Safe Mode and delete the file in the \Temp folder. Restart the computer normally. If it's return please run the Farbar program and post a fresh FRST.TXT log for my review. Link to post Share on other sites More sharing options...
heliton Posted September 18, 2018 Author ID:1270162 Share Posted September 18, 2018 Boa Tarde, Reiniciei em modo de segurança e exclui o arquivo. Quando reiniciei em modo normal, o arquivo retornou. Executei o FRST.TXT que segue anexo. FRST.txt Addition.txt Link to post Share on other sites More sharing options...
nasdaq Posted September 18, 2018 ID:1270178 Share Posted September 18, 2018 (edited) Hi, Press the Windows key + r on your keyboard at the same time. This will open the RUN BOX. Type Notepad and and click the OK key. Please copy the entire contents of the code box below to a new file. Start CreateRestorePoint: CloseProcesses: (TODO: <???>) C:\Windows\Temp\conhost.exe () C:\Windows\Help\lsmosee.exe HKU\S-1-5-21-99009950-3056784836-314409812-1000\...\MountPoints2: I - I:\AutoRun.exe HKU\S-1-5-21-99009950-3056784836-314409812-1000\...\MountPoints2: {0b6ec889-ecf5-11e5-9c4c-60a44cdedf45} - I:\AutoRun.exe HKU\S-1-5-21-99009950-3056784836-314409812-1000\...\MountPoints2: {0b6ec893-ecf5-11e5-9c4c-60a44cdedf45} - I:\AutoRun.exe HKU\S-1-5-21-99009950-3056784836-314409812-1000\...\MountPoints2: {21242d6c-2c2f-11e8-8fb8-60a44cdedf45} - I:\AutoRun.exe HKU\S-1-5-21-99009950-3056784836-314409812-1000\...\MountPoints2: {4503059d-2779-11e8-b9be-60a44cdedf45} - I:\AutoRun.exe HKU\S-1-5-18\...\Run: [] => [X] CHR HKLM\SOFTWARE\Policies\Google: Restrição <==== ATENÇÃO S2 Windows Audio Control; C:\Program Files\Common Files\conime.exe -s [X] AlternateDataStreams: C:\Program Files\GbPlugin:IncompleteStartProcessProtection.cnt [8] AlternateDataStreams: C:\Windows\system32\drivers:GbpKmAp.lst [212] AlternateDataStreams: C:\Windows\system32\Drivers\wsddfac.sys:X5ZN8aGXs4 [2174] C:\Windows\Temp\conhost.exe C:\Windows\Help\lsmosee.exe File: C:\Program Files\mozilla firefox\defaults\pref\autoconf_warsaw.js Reboot: End Save the file as fixlist.txt in the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the Farbar log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. Please let me know what problem persists with this computer. fixlist.txt Edited September 18, 2018 by nasdaq Link to post Share on other sites More sharing options...
Recommended Posts