heliton Posted September 18, 2018 Author ID:1270183 Share Posted September 18, 2018 Boa tarde Executei todas as orientações. Abaixo o arquivo fixlog gerado, O arquivo contaminado permanece. Fixlog.txt Link to post Share on other sites More sharing options...
nasdaq Posted September 19, 2018 ID:1270295 Share Posted September 19, 2018 Hi, My fix failed. Please download and use the Fixlist.txt I have attached to my previous post. Delete the one you created before move the attached file to the Farbar folder. Run Farbar and click the Fix button when done. Post the fixlog.txt and let me know if the problem persists. Link to post Share on other sites More sharing options...
heliton Posted September 19, 2018 Author ID:1270305 Share Posted September 19, 2018 Boa tarde Segue o novo arquivo fixlog. Foi reiniciado o windows após a correação. O arquivo contaminado permanece. Fixlog.txt Link to post Share on other sites More sharing options...
nasdaq Posted September 19, 2018 ID:1270319 Share Posted September 19, 2018 Boot to safe mode and run Farbar and hit the fix button. Post the log for my review. Link to post Share on other sites More sharing options...
heliton Posted September 19, 2018 Author ID:1270326 Share Posted September 19, 2018 Boa tarde Segue o novo arquivo fixlog gerado após execução do programa em modo de segurança. Fixlog.txt Link to post Share on other sites More sharing options...
nasdaq Posted September 20, 2018 ID:1270555 Share Posted September 20, 2018 Hi, Are these files still on the hard drive. C:\Windows\Temp\conhost.exe => movido com sucesso C:\Windows\Help\lsmosee.exe => movido com sucesso If yes please run the Farbar program and post a fresh FRST.TXT log for my review. This time I would like to also see a fresh Addition.txt log. You will need to make sure that the box to create an Addition.txt is check Link to post Share on other sites More sharing options...
heliton Posted September 20, 2018 Author ID:1270560 Share Posted September 20, 2018 Bom Dia, Os dois arquivos permanecem no disco rigido. Segue log e addition FRST.txt Addition.txt Link to post Share on other sites More sharing options...
nasdaq Posted September 20, 2018 ID:1270625 Share Posted September 20, 2018 (edited) Hi, === Please download the attached Fixlist.txt file to the same folder where the Farbar tool is running from. The location is listed in the 3rd line of the FRST.txt log you have submitted. Run FRST and click Fix only once and wait. The tool will create a log (Fixlog.txt) please post it to your reply. === Let me know if the problem persists. fixlist.txt If the problem persists: Lets see what we can find in the Registry. Run the Farbar program .exe as an Administrator. In the Search text area, copy and paste the following:conhost.exe Once done, click on the Search Registry button and wait for FRST to finish the search On completion, a log will open in Notepad. Copy and paste its content in your next reply ==== Edited September 20, 2018 by nasdaq Link to post Share on other sites More sharing options...
heliton Posted September 20, 2018 Author ID:1270634 Share Posted September 20, 2018 Bom Dia, segue o log fixlist após a correçao do primeiro procedimento. A CPU foi reiniciada e o problema persiste. Vou executar o segundo procedimento. Fixlog.txt Link to post Share on other sites More sharing options...
heliton Posted September 20, 2018 Author ID:1270635 Share Posted September 20, 2018 segue arquivo da busca registro SearchReg.txt Link to post Share on other sites More sharing options...
nasdaq Posted September 21, 2018 ID:1270780 Share Posted September 21, 2018 Reset your router. It may be infected. How to Reset a Router Back to the Factory Default Settingshttp://www.ehow.com/how_2110924_reset-back-factory-default-settings.html Then, please reconfigure it back to your preferred setting.. Below is the list of default username and password, should you don't know it http://www.routerpasswords.com/http://www.phenoelit-us.org/dpl/dpl.html === Reset for Linksys, Netgear, D-Link and Belkin Routershttp://www.techsupportforum.com/2763-reset-for-linksys-netgear-d-link-and-belkin-routers/ ==== How to tell if my Wireless is secure.http://www.ehow.com/how_6775466_tell-wireless-secure_.html Restart the computer normally. How is it now? Link to post Share on other sites More sharing options...
heliton Posted September 21, 2018 Author ID:1270795 Share Posted September 21, 2018 Bom Dia, O roteador de internet está instalado em rede, diretamente em um servidor. Não tem nenhuma outra alternativa antes dessa opção? Pois vou precisar de auxilio técnico externo para reconfigurar depois.... Link to post Share on other sites More sharing options...
nasdaq Posted September 21, 2018 ID:1270807 Share Posted September 21, 2018 Any one else compromised on that Server? Can you contact the Administrator? === Run these two cleaning tool. Temporarily disable your AV program so it does not interfere. Info on how to disable your security applications How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - Security Mini-Guides. Download Zoek tool from here When the download appears, save to the Desktop. On the Desktop, right-click the Zoek.exe file and select: Run as Administrator (Give it a few seconds to appear.) Next, copy/paste the entire script inside the code box below to the input field of Zoek: createsrpoint; autoclean; emptyalltemp; ipconfig /flushdns;b Now...Close any open Browsers. Click the Run script button, and wait. It takes a few minutes to run all the script. When the tool finishes, the zoek-results.log is opened in Notepad. The log is also found on the systemdrive, normally C:\ If a reboot is needed, the log is opened after the reboot. Please attach the zoek-results.log in your reply. Also, please provide an update on how the computer is behaving after running the above script. Link to post Share on other sites More sharing options...
heliton Posted September 21, 2018 Author ID:1270833 Share Posted September 21, 2018 Não consegui desativar o antivirus. Não encontrei as instrução no link.... Link to post Share on other sites More sharing options...
heliton Posted September 21, 2018 Author ID:1270875 Share Posted September 21, 2018 O malwarebytes não permite executar o zoek. Envia ele para quarentena Link to post Share on other sites More sharing options...
nasdaq Posted September 22, 2018 ID:1271023 Share Posted September 22, 2018 Hi, De-quarantine the program is you can. Run it and tell any program that blocks it to ignore or allow. It IS SAFE. Or download the program again and mark it as SAFE. Link to post Share on other sites More sharing options...
heliton Posted September 26, 2018 Author ID:1271607 Share Posted September 26, 2018 Bom Dia, Executei o programa, segue o result.log O arquivo conhost continua presente no sistema. zoek-results.log Link to post Share on other sites More sharing options...
nasdaq Posted September 26, 2018 ID:1271654 Share Posted September 26, 2018 Hi, Lets find out what these run keys will show. Download the Sustemlook appropriate for you system. SystemLook (32-Bit Version) or SystemLook (64-Bit Version) Double-click SystemLook.exe/SystemLook_x64.exe to run it. Copy and paste the content of the following bold text into the main textfield::reg HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run /sub HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /sub Click the Look button to start the scan. When finished, a notepad window will open with the results of the scan. Please post this log in your next reply. Note: The log can also be found on your Desktop entitled SystemLook.txt. === Link to post Share on other sites More sharing options...
heliton Posted September 26, 2018 Author ID:1271661 Share Posted September 26, 2018 Segue resultado SystemLook.txt Link to post Share on other sites More sharing options...
nasdaq Posted September 26, 2018 ID:1271702 Share Posted September 26, 2018 Hi, Strange. From the Start > Run box. Type Regedit.exe in the box, click the OK button. This will open the Registry. Navigate to this key.HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run Highlight the key and on the Menu click the File Menu Select Export. Save the file as My_Run.reg Attach the file for my review. Link to post Share on other sites More sharing options...
heliton Posted September 26, 2018 Author ID:1271704 Share Posted September 26, 2018 Não permite anexar o arquivo. Dá a seguinte mensagem Link to post Share on other sites More sharing options...
nasdaq Posted September 27, 2018 ID:1271913 Share Posted September 27, 2018 Hi, Rename the file My_Run.txt I should be accepted. Link to post Share on other sites More sharing options...
heliton Posted September 27, 2018 Author ID:1271915 Share Posted September 27, 2018 Mesmo renomeando o nome do arquivo, deu a mesma mensagem.... Link to post Share on other sites More sharing options...
nasdaq Posted September 27, 2018 ID:1271925 Share Posted September 27, 2018 Can you Copy and paste the results. In this topic or in a personal message. Link to post Share on other sites More sharing options...
heliton Posted September 27, 2018 Author ID:1271938 Share Posted September 27, 2018 Consegui converter o arquivo para txt. Mas excede o tamanho de 58,59MB. Link to post Share on other sites More sharing options...
Recommended Posts