Esta tarde ao ligar o computador notei que este estava muito lento e decidi ver os processos no gestor de tarefas. Notei em varios processos que nao fazem parte (ou pelo menos eu penso que nao) das funçoes pincipais do computador. O nome destes programas sao: -Adlock (localizado na pasta Appdata\Roaming) -IntelDev (localizado na pasta Appdata\Local\Temp) -2026459690(parece algo conectado com o inteldev, localiza-se na mesma pasta) Todos eles sao executaveis(exe), notei que o Adlock tem como descriçao 'notepad' e abre automaticamente o cmd e conhost ambos exe. Eles estao a "consumir" muito Cpu principalmente o adlock, mas o computador esta estranhamente estavel. A ajuda é agradecida.

Virus?! - Microsoft Q&A

Anônima

O problema parece estar resolvido, visto que ja nao encontro nenhum processo, nao posto o log.txt do Nod32 visto que nao o consigo encontrar.

Agradeço assim a ajuda que me foi dada.

Muito obrigado, comprimentos.

0 comentários

Anônima

* Siga, por gentileza, as dicas deste tutorial para fazer um escaneamento de seu PC pelo Nod32 Online:

Tutorial do antivirus Nod32 Online

Após o término do escaneamento será gerado um relatório (log) que estará no seguinte local do seu computador:

C:\Arquivos de programas\Eset\Eset Online Scanner*log.txt*

Na sua próxima resposta poste este log do Nod32 Online.

Ficamos no aguardo de sua resposta.

0 comentários

Anônima

infelizmente da mesma maneira, continuam os processos que referi anteriormente

0 comentários

Anônima

Como está o PC após este procedimento?

0 comentários

Anônima

Primeiro de tudo gostaria de desculpar a minha ausencia nos ultimos 2 dias devido a problemas de hardware no computador. Entretando aqui posto o Fixlog.txt

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 04-03-2014 02

Ran by Nanda at 2014-03-07 22:17:02 Run:1

Running from C:\Users\Nanda\Desktop\Downloads

Boot Mode: Normal

==============================================

Content of fixlist:

*****************

start

() C:\Users\Nanda\AppData\Roaming\f4061\e83a1.exe

(Ballistics Networking Pty Ltd.) C:\Users\Nanda\AppData\Local\Temp\1505850852.exe

Startup: C:\Users\Nanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1636746858.exe ()

Startup: C:\Users\Nanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026459690.exe ()

URLSearchHook: HKLM - (No Name) - {e7cb019e-bf3b-4c48-9673-48c323b18e31} - No File

URLSearchHook: ATTENTION ==> Default URLSearchHook is missing.

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKCU - ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}

FF Plugin: @microsoft.com/GENUINE - disabled No File

CHR HomePage: hxxp://home.sweetim.com/?crg=3.26010003&st=12&barid={5EBD3937-061E-4EFA-B3D9-57140C357286}

2014-03-04 14:01 - 2014-03-04 10:21 - 02435072 _____ (Microsoft Corporation) C:\Users\Nanda\AppData\Roaming\Adlock.exe

C:\Users\Nanda\1.dat

Task: {323C12B6-C7D5-42D7-B721-7ECA325F9B4B} - \YourFile DownloaderUpdate No Task File

Task: {A9A3CFAF-6927-4BA7-94E8-325318CDF285} - \AdobeFlashPlayerUpdate 2 No Task File

Task: {EE5A8FC9-41F8-4028-98AC-EBE5F1631CE7} - \AdobeFlashPlayerUpdate No Task File

2014-03-04 20:50 - 2014-03-04 20:50 - 00004608 _____ () C:\Users\Nanda\AppData\Roaming\f4061\e83a1.exe

AlternateDataStreams: C:\ProgramData\TEMP:373E1720

end

*****************

C:\Users\Nanda\AppData\Roaming\f4061\e83a1.exe => No running process found

C:\Users\Nanda\AppData\Local\Temp\1505850852.exe => No running process found

C:\Users\Nanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1636746858.exe => Moved successfully.

C:\Users\Nanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026459690.exe => Moved successfully.

HKLM\Software\Microsoft\Internet Explorer\URLSearchHooks\{e7cb019e-bf3b-4c48-9673-48c323b18e31} => Value deleted successfully.

Default URLSearchHook was restored successfully .

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope => Value was restored successfully.

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\ToolbarSearchProviderProgress => Value deleted successfully.

HKLM\Software\MozillaPlugins\FF Plugin: @microsoft.com/GENUINE - disabled No File => Key not found.

FF Plugin: @microsoft.com/GENUINE - disabled No File not found.

CHR HomePage: hxxp://home.sweetim.com/?crg=3.26010003&st=12&barid={5EBD3937-061E-4EFA-B3D9-57140C357286} ==> The Chrome "Settings" can be used to fix the entry.

C:\Users\Nanda\AppData\Roaming\Adlock.exe => Moved successfully.

C:\Users\Nanda\1.dat => Moved successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon{323C12B6-C7D5-42D7-B721-7ECA325F9B4B} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{323C12B6-C7D5-42D7-B721-7ECA325F9B4B} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\YourFile DownloaderUpdate => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot{A9A3CFAF-6927-4BA7-94E8-325318CDF285} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{A9A3CFAF-6927-4BA7-94E8-325318CDF285} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdobeFlashPlayerUpdate 2 => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain{EE5A8FC9-41F8-4028-98AC-EBE5F1631CE7} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{EE5A8FC9-41F8-4028-98AC-EBE5F1631CE7} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AdobeFlashPlayerUpdate => Key deleted successfully.

C:\Users\Nanda\AppData\Roaming\f4061\e83a1.exe => Moved successfully.

C:\ProgramData\TEMP => ":373E1720" ADS removed successfully.

==== End of Fixlog ====

0 comentários

Virus?!

37 respostas