Tentando remover Awesomehp

Eu li os outros tópicos, instalei o programa ZHPDiag, fui em pesquisar e abriu a mensagem no bloco de notas..
Só que quando eu fui abrir o "ZHPFix", apertei em "GO" e apareceu a seguinte mensagem:

"Avertissement:
Exemplos: Script ZHPFix (Ligne obligatoire) C:\Program Files\MagniPic
[HKEY_CURRENT_USER\Software\MagniPic]
[HKEY_USERS\S-1-5-18\Control MagniPic]
[HKCU\Software\MagniPic]"


O que significa?
Meu antvirus é o Microsoft Security e pra fazer isso eu não desinstalei..

Me ajudem!!!

~ Relatório do ZHPDiag v2014.2.23.20 - Nicolas Coolman (23/02/2014)
~ Iniciado por Anne Caroline (24/02/2014 12:10:15)
~ Endereço do Website : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Fóruns de suporte gratuito para desinfecção : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Tradução pelo utilizador
~ Estatuto da versão :
~ Lista Branca : Ativado pelo programa
~ Elevação dos Privilégios : OK
~ Controle de Conta de Utilizador : Deactivate by user


---\\ Navegadores Internet
MSIE: Internet Explorer v11.0.9600.16518
MFIE: Mozilla Firefox 27.0.1
GCIE: Google Chrome v32.0.1700.107 (Defaut)

---\\ Informações sobre os produtos Windows
~ Langage: Portugais
Windows 7 Professional, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK

---\\ Softwares de proteçao do sistema
Microsoft Security Client v4.4.0304.0
Windows Defender W7

---\\ Softwares d'optimização do sistema

---\\ Softwares de partilha do PeerToPeer (P2P)

---\\ Monitoramento dos softwares
Adobe Flash Player 11 Plugin
Java 7 Update 45

---\\ Informações sobre o sistema
~ Processor: Intel64 Family 6 Model 15 Stepping 13, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 2039 MB (21% free)
System Restore: Activé (Enable)
System drive C: has 52 GB (51%) free of 101 GB

---\\ Modo de conexão ao sistema
~ Computer Name: ANNECAROLINE-PC
~ User Name: Anne Caroline
~ All Users Names: Convidado, Anne Caroline, Administrador,
~ Unselected Option: 045,061,O62,065,066,080,O82,089
Logged in as Administrator

---\\ As variáveis de ambiente
~ System Unit : C:\
~ %AppZHP% : C:\Users\Anne Caroline\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Anne Caroline\AppData\Roaming\
~ %Desktop% : D:\Users\Anne Caroline\Desktop\
~ %Favorites% : D:\Users\Anne Caroline\Favorites\
~ %LocalAppData% : C:\Users\Anne Caroline\AppData\Local\
~ %StartMenu% : C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumeração das unidades dos discos
A: Floppy drive, Flash card reader, USB Key (Not Inserted)
C: Hard drive, Flash drive, Thumb drive (Free 52 Go of 101 Go)
D: Hard drive, Flash drive, Thumb drive (Free 79 Go of 132 Go)
E: CD-ROM drive (Not Inserted)



---\\ Estado do Centro de Segurança do Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowMyGames: Modified
~ Security Center: 46 Legitimates Filtered in 00mn 00s



---\\ Pesquisa particular de ficheiros genéricos
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Windows Explorer.) (.25/02/2011 - 03:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Aplicativo de Inicialização do Windows.) (.13/07/2009 - 22:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.263B6E451526A90FF8B1CEC759F22956] - (.Microsoft Corporation - Internet Extensions para Win32.) (.06/02/2014 - 06:24:52.) -- C:\Windows\System32\wininet.dll [2334208]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Aplicativo de Logon do Windows.) (.21/11/2010 - 00:24:29.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Biblioteca de Licenciamento de Software.) (.21/11/2010 - 00:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.27/09/2013 - 22:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.13/07/2009 - 22:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 20:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 00:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Driver de porta i8042.) (.13/07/2009 - 20:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.13/07/2009 - 21:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.26/04/2011 - 23:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 00:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Driver do Sistema de Arquivos NT.) (.12/04/2013 - 11:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Driver de porta paralela.) (.13/07/2009 - 21:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 00:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.1B6163C503398B23FF8B939C67747683] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.21/11/2010 - 00:25:07.) -- C:\Windows\system32\Drivers\rdpdr.sys [165888]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.13/07/2009 - 21:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 00:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s



---\\ Estatuto dos ficheiros ocultos (Oculto/Total)
~ Mes images (My Pictures) : 2/216
~ Mes musiques (My Musics) : 3/1458
~ Mes Videos (My Videos) : 1/26
~ Mes Favoris (My Favorites) : 1/44
~ Mes Documents (My Documents) : 3/60444
~ Mon Bureau (My Desktop) : 1/372
~ Menu demarrer (Programs) : 1/80
~ Hidden Files: Scanned in 00mn 11s



---\\ Processos lançados
[MD5.BD490E84729F67ED40B216E9DF68A09A] - (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Anne Caroline\AppData\Roaming\BitTorrent\BitTorrent.exe [900696] [PID.1424] =>P2P.BitTorrent
[MD5.6DEE6998782DA6D47769EF2033DBD278] - (.Analog Devices, Inc. - SMax4PNP.) -- C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1302528] [PID.2292]
[MD5.499FFEFFE26AB9AC26BE4E55B9CB8DC4] - (.Analog Devices, Inc. - SoundMAX Audio Settings (32-bit).) -- C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe [3637248] [PID.868]
[MD5.D5CA1D97E67216774B916179BE3C2C21] - (.Adobe Systems Incorporated - Adobe Creative Cloud.) -- C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2237328] [PID.880]
[MD5.FB1A303207C1124C2B61A50E5A32AC21] - (.No owner - DivX Update.) -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968] [PID.1248]
[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336] [PID.2608]
[MD5.D3242FF9E28EAFC77EACB2B8956724C3] - (.Adobe Systems Incorporated - Adobe CEP Service Manager.) -- C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe [1039240] [PID.3080]
[MD5.BBC8D35DEF9F3EEC3FCCB7A27613265F] - (...) -- C:\Users\Anne Caroline\AppData\Local\Temp\UsageTemp.exe [1274592] [PID.3472]
[MD5.3B9DFE92CAEF65BBA864470065F8FFEE] - (...) -- C:\Program Files (x86)\VLC Player GPU+\UsageLog.exe [1330400] [PID.3916]
[MD5.4F3511A08B99567964152364932783B8] - (.Ufasoft - coin-miner.) -- C:\Program Files (x86)\VLC Player GPU+\UsageMonitor.exe [828640] [PID.2304]
[MD5.148E6593136BA6CF2BF264FF22EBB817] - (.No owner - Core Sync.) -- C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe [4579696] [PID.4588]
[MD5.BDC1CCF8458A1FD4615C52D5555112F3] - (.Adobe Systems Incorporated - Adobe CEF Helper.) -- C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe [395120] [PID.3856]
[MD5.5640B4C10682FBC39C86C8C7A8392B5E] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [866632] [PID.3840]
[MD5.9A2347903D6EDB84C10F288BC0578C1C] - (.Trend Micro Inc. - HijackThis.) -- D:\Users\Anne Caroline\Downloads\HijackThis.exe [388608] [PID.5664]
[MD5.42FEDBCB3ED926F6F529E0FDDF750BE0] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8339968] [PID.5324]
~ Processes Running: Scanned in 00mn 01s



---\\ Google Chrome, Arranque,Pesquisa,Extensões (G0,G1,G2)
C:\Users\Anne Caroline\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [ahfgeienlihckogmohjhadlkjgocpleb] Loja v.0.2 (Activé)
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [pelmeidfhdlhlbjimpabfcbnnojbboma] Quick Start v.3.1.2, (Désactivé)
~ Google Browser: 30 Legitimates Filtered in 00mn 03s



---\\ Internet Explorer, Arranque, Pesquisa, URLSearchHook( gancho de URL), Phishing (R0,R1,R3,R4)
R0 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = preserve
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
~ IE Browser: 17 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Gestão do Proxy (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
~ Proxy management: Scanned in 00mn 00s



---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Redireção do ficheiro Hosts (01)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 36



---\\ Browser Helper Objects do navegador (02)
O2 - BHO: SaveSense [64Bits] - {0f21b1e5-5afc-43c9-9c66-515046e92ec2} . (.SaveSense - SaveSense for IE.) -- C:\Program Files (x86)\SaveSense\SaveSenseIE.dll =>PUP.SaveSense
O2 - BHO: InjectScript [64Bits] - {F6C07882-D703-4DD5-905A-2C4E815A5066} . (.WW3, LLC - Shopping Suggestion..) -- C:\Users\Anne Caroline\AppData\Roaming\D394D188-BAC7-4e03-8FAF-389A4D7EC6F4\Shopping Suggestion.dll
~ BHO: 16 Legitimates Filtered in 00mn 00s



---\\ Outras conexões do utilizador (04)
O4 - GS\Desktop [Public]: aTube Catcher.lnk . (.DsNET - aTube Catcher to download and convert video.) -- C:\Program Files (x86)\DsNET Corp\aTube Catcher 2.0\yct.exe
O4 - GS\Desktop [Public]: Autodesk DWF Viewer.lnk . (.Autodesk, Inc. - Autodesk DWF Viewer.) -- C:\Program Files (x86)\Autodesk\Autodesk DWF Viewer\DWFViewer.exe
O4 - GS\Desktop [Public]: Counter-Strike 1.6.lnk . (.DigitalZone - Counter-Strike Launcher.) -- C:\Program Files (x86)\Counter-Strike 1.6\cstrike.exe
O4 - GS\Desktop [Public]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
O4 - GS\Desktop [Public]: Half-Life.lnk . (.Valve - Half-Life Launcher.) -- C:\Program Files (x86)\Counter-Strike 1.6\hl.exe
O4 - GS\Desktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
O4 - GS\QuickLaunch [Anne Caroline]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
O4 - GS\QuickLaunch [Anne Caroline]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
O4 - GS\QuickLaunch [Anne Caroline]: PhotoScape.lnk . (...) -- C:\Program Files (x86)\PhotoScape\PhotoScape.exe
O4 - GS\TaskBar [Anne Caroline]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
O4 - GS\TaskBar [Anne Caroline]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
O4 - GS\TaskBar [Anne Caroline]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
O4 - GS\Program [Anne Caroline]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
O4 - GS\SystemTools [Anne Caroline]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
O4 - GS\SendTo [Anne Caroline]: AnySend.lnk . (...) -- C:\Program Files (x86)\AnySend\AnySendUI.exe (.not file.)
O4 - GS\Desktop [Anne Caroline]: C-D.lnk . (...) -- C:\Program Files (x86)\Cheating-Death\cdeath.exe (.not file.)
O4 - GS\Desktop [Anne Caroline]: Condition Zero Deleted Scenes.lnk . (...) -- C:\Valve\Condition Zero\czero.exe (.not file.)
O4 - GS\Desktop [Anne Caroline]: Condition Zero.lnk . (...) -- C:\Valve\Condition Zero\czero.exe (.not file.)
O4 - GS\Desktop [Anne Caroline]: Counter-Strike Source.lnk . (...) -- C:\Program Files (x86)\Counter-Strike Source\hl2.exe (.not file.)
O4 - GS\Desktop [Anne Caroline]: Dedicated Server.lnk . (...) -- C:\Program Files (x86)\Counter-Strike 1.6 2\hlds.exe (.not file.)
O4 - GS\Desktop [Anne Caroline]: EVEREST Home Edition.lnk . (...) -- C:\Program Files (x86)\Lavalys\EVEREST Home Edition\everest.exe (.not file.)
~ Global Startup: 74 Legitimates Filtered in 00mn 02s



---\\ Aplicações iniciadas por registo & pastas (04)
O4 - GS\Startup [Anne Caroline]: Microsoft SharePoint Workspace.lnk . (...) -- C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.exe (.not file.)
O4 - HKLM\..\Run: [BCSSync] . (.Microsoft Corporation - Microsoft Office 2010 component.) -- C:\Program Files\Microsoft Office\Office14\BCSSync.exe =>.Microsoft Corporation
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] . (.Adobe Systems Incorporated - Adobe Updater Startup Utility.) -- C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- C:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [OfficeSyncProcess] . (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files\Microsoft Office\Office14\MSOSYNC.exe
O4 - HKCU\..\Run: [NextLive] . (.NewNextDotMe - NewNext Helper Engine.) -- C:\Users\Anne Caroline\AppData\Roaming\newnext.me\nengine.dll =>PUP.NextLive
O4 - HKCU\..\Run: [iLivid] C:\Users\Anne Caroline\AppData\Local\iLivid\iLivid.exe (.not file.) =>Adware.Bandoo
O4 - HKCU\..\Run: [Akamai NetSession Interface] C:\Users\Anne Caroline\AppData\Local\Akamai\netsession_win.exe (.not file.)
O4 - HKCU\..\Run: [BitTorrent] . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Anne Caroline\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent
O4 - HKLM\..\Wow6432Node\Run: [SoundMAXPnP] . (.Analog Devices, Inc. - SMax4PNP.) -- C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Wow6432Node\Run: [SoundMAX] . (.Analog Devices, Inc. - SoundMAX Audio Settings (32-bit).) -- C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
O4 - HKLM\..\Wow6432Node\Run: [AdobeCS5ServiceManager] . (.Adobe Systems Incorporated - Adobe CS5 Service Manager.) -- C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe Creative Cloud] . (.Adobe Systems Incorporated - Adobe Creative Cloud.) -- C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
O4 - HKLM\..\Wow6432Node\Run: [DivXMediaServer] . (.DivX, LLC - DivX DLNA Media Server.) -- C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
O4 - HKLM\..\Wow6432Node\Run: [DivXUpdate] . (.No owner - DivX Update.) -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKLM\..\Wow6432Node\Run: [mobilegeni daemon] C:\Program Files (x86)\Mobogenie\DaemonProcess.exe (.not file.) =>PUP.Mobogenie
O4 - HKLM\..\Wow6432Node\Run: [UsageTemp] . (...) -- C:\Users\Anne Caroline\AppData\Local\Temp\UsageTemp.exe
O4 - HKLM\..\Wow6432Node\Run: [UsageLoader] . (...) -- C:\Program Files (x86)\VLC Player GPU+\UsageLog.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-1054709842-3106569860-2955332437-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKUS\S-1-5-21-1054709842-3106569860-2955332437-1000\..\Run: [OfficeSyncProcess] . (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files\Microsoft Office\Office14\MSOSYNC.exe
O4 - HKUS\S-1-5-21-1054709842-3106569860-2955332437-1000\..\Run: [NextLive] . (.NewNextDotMe - NewNext Helper Engine.) -- C:\Users\Anne Caroline\AppData\Roaming\newnext.me\nengine.dll =>PUP.NextLive
O4 - HKUS\S-1-5-21-1054709842-3106569860-2955332437-1000\..\Run: [iLivid] C:\Users\Anne Caroline\AppData\Local\iLivid\iLivid.exe (.not file.) =>Adware.Bandoo
O4 - HKUS\S-1-5-21-1054709842-3106569860-2955332437-1000\..\Run: [Akamai NetSession Interface] C:\Users\Anne Caroline\AppData\Local\Akamai\netsession_win.exe (.not file.)
O4 - HKUS\S-1-5-21-1054709842-3106569860-2955332437-1000\..\Run: [BitTorrent] . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Anne Caroline\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent
~ Application: Scanned in 00mn 00s



---\\ Boutões da barra de ferramentas principal do Internet Explorer (09)
O9 - Extra button: &Enviar para o OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\MICROS~1\Office14\ONBttnIE.dll =>.Microsoft Corporation
O9 - Extra button: &Anotações Vinculadas do OneNote [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\MICROS~1\Office14\ONBTTN~1.dll =>.Microsoft Corporation
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Alteração Dominio/Clientes DNS (017)
O17 - HKLM\System\CCS\Services\Tcpip\..\{760FC29A-F301-4DDD-B640-B33C62CEE3FE}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{760FC29A-F301-4DDD-B640-B33C62CEE3FE}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{760FC29A-F301-4DDD-B640-B33C62CEE3FE}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s



---\\ Protocolo adicional (018)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visualizador de HTML da Microsoft (R).) -- C:\Windows\System32\mshtml.dll
O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s



---\\ Lista dos serviços NT não Microsoft e não desativados (023)
O23 - Service: AnySend (AnySendService) . (...) - C:\Program Files (x86)\AnySend\AnySendSVC.exe (.not file.)
O23 - Service: Baidu AntiVirus Service (bavsvc) . (...) - C:\Program Files (x86)\Baidu Security\Baidu Antivirus\bavsvc.exe (.not file.) =>Adware.BDSearch
O23 - Service: Baidu Hips Service (bhipssvc) . (...) - C:\Program Files (x86)\Baidu Security\Baidu Antivirus\bhipssvc.exe (.not file.) =>Adware.BDSearch
O23 - Service: SaveSenseLive Service (savesenselive) (savesenselive) . (.SaveSense - SaveSenseLive Update.) - C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe =>PUP.SaveSense
O23 - Service: Update EnhanceTronic (Update EnhanceTronic) . (...) - C:\Program Files (x86)\EnhanceTronic\updateEnhanceTronic.exe (.not file.)
O23 - Service: Update FindRight (Update FindRight) . (...) - C:\Program Files (x86)\FindRight\updateFindRight.exe (.not file.) =>Hijacker.FindrToolbar
~ Services: 5 Legitimates Filtered in 00mn 08s



---\\ Tarefas planificadas automaticamente (039)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\Funmoods.job [314] =>Hijacker.iHaveNet
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job [942] =>PUP.SaveSense
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job [946] =>PUP.SaveSense
[MD5.00000000000000000000000000000000] [APT] [Desk 365 RunAsStdUser] (...) -- C:\Program Files (x86)\Desk 365\desk365.exe (.not file.) [0] =>Hijacker.22Find
[MD5.00000000000000000000000000000000] [APT] [Funmoods] (...) -- C:\Users\Anne Caroline\AppData\Roaming\Funmoods\UPDATE~1\UPDATE~1.exe (.not file.) [0] =>PUP.Funmoods
[MD5.C495D8665A32539660625182D23D5C59] [APT] [SaveSenseLiveUpdateTaskMachineCore] (.SaveSense.) -- C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [146920] =>PUP.SaveSense
[MD5.C495D8665A32539660625182D23D5C59] [APT] [SaveSenseLiveUpdateTaskMachineUA] (.SaveSense.) -- C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [146920] =>PUP.SaveSense
[MD5.00000000000000000000000000000000] [APT] [{005D94AD-1F10-4BCD-92BF-05340C872545}] (...) -- E:\setup.exe (.not file.) [0]
[MD5.3A22895F1893A6E218F516FD7DEA87CD] [APT] [{6F5D1072-A951-4B1E-A9D2-01C6F7AD9DE5}] (...) -- D:\Users\Anne Caroline\Downloads\Counter-Strike 1.6 No Steam\Counter-Strike 1.6 No Steam\Counter-Strike_1.6_v28.exe [321562153]
[MD5.429F53ABFBC1D36DAE1D3137EC448183] [APT] [{B3E18EE0-8C0C-4ADD-BEC6-33DF59753BE1}] (...) -- C:\Users\Anne Caroline\AppData\Roaming\awesomehp\UninstallManager.exe [1746944] =>PUP.Awesomehp
~ Scheduled Task: 36 Legitimates Filtered in 00mn 12s



---\\ Drivers lançados ao arranque do sistema (041)
O41 - Driver: (Bfilter) . (.Baidu, Inc. - Baidu Antivirus Minifilter Driver.) - C:\Windows\system32\drivers\Bfilter.sys =>Adware.BDSearch
O41 - Driver: (Bfmon) . (.Baidu, Inc. - Baidu FS Monitor Driver.) - C:\Windows\system32\drivers\Bfmon.sys =>Adware.BDSearch
O41 - Driver: (Bprotect) . (.Baidu, Inc. - Baidu Antivirus Selfprotect Driver.) - C:\Windows\system32\drivers\Bprotect.sys =>Adware.BDSearch
~ Drivers: 72 Legitimates Filtered in 00mn 01s



---\\ Software instalados (042)
O42 - Logiciel: Patch v23 versão 2013 - (.SiteCS.) [HKLM][64Bits] -- {C1C3140D-730D-4176-94EC-F1706A929776}_is1
O42 - Logiciel: sXe Injected - (.Alejandro Cortés.) [HKLM][64Bits] -- sXe Injected
~ Logic: 23 Legitimates Filtered in 00mn 01s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\41133InstEnd]
[HKCU\Software\Baidu Security] =>Adware.BDSearch
[HKCU\Software\Baidu] =>Adware.BDSearch
[HKCU\Software\BonanzaDealsLive] =>Adware.BonanzaDeals
[HKCU\Software\HiSoft]
[HKCU\Software\InstallCore] =>Adware.InstallCore
[HKCU\Software\InstalledThirdPartyPrograms]
[HKCU\Software\SaveSenseLive] =>PUP.SaveSense
[HKCU\Software\SaveSense] =>PUP.SaveSense
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKCU\Software\Unitech LLC]
[HKCU\Software\iLivid] =>Adware.Bandoo
[HKCU\Software\iVIDI Plugin] =>PUP.Ividi
[HKCU\Software\lollipop] =>Adware.Lollipop
[HKCU\Software\sXe Injected]
[HKLM\Software\HKBS]
[HKLM\Software\InstalledThirdPartyPrograms]
[HKLM\Software\Wow6432Node\Baidu Security] =>Adware.BDSearch
[HKLM\Software\Wow6432Node\Baidu_Drp_pos] =>Adware.BDSearch
[HKLM\Software\Wow6432Node\BonanzaDealsLive] =>Adware.BonanzaDeals
[HKLM\Software\Wow6432Node\DealPlyLive] =>PUP.DealPly
[HKLM\Software\Wow6432Node\Iminent] =>Adware.IMBooster
[HKLM\Software\Wow6432Node\SaveSenseLive] =>PUP.SaveSense
[HKLM\Software\Wow6432Node\SaveSense] =>PUP.SaveSense
[HKLM\Software\Wow6432Node\Unitech LLC]
[HKLM\Software\Wow6432Node\UnitedAdmins]
[HKLM\Software\Wow6432Node\V9]
[HKLM\Software\Wow6432Node\Wpm] =>PUP.WpManager
[HKLM\Software\Wow6432Node\baidu] =>Adware.BDSearch
[HKLM\Software\Wow6432Node\deskSvc]
[HKLM\Software\Wow6432Node\hosts]
[HKLM\Software\Wow6432Node\sXe_Injected]
[HKLM\Software\Wow6432Node\supTab] =>PUP.SupTab
[HKLM\Software\Wow6432Node\supWPM] =>PUP.WpManager
~ Key Software: 266 Legitimates Filtered in 00mn 01s



---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 24/09/2013 - 12:25:09 - [102,436] ----D C:\Program Files (x86)\Baidu Security =>Adware.BDSearch
O43 - CFD: 07/10/2013 - 14:04:11 - [0,851] ----D C:\Program Files (x86)\BonanzaDeals =>Adware.BonanzaDeals
O43 - CFD: 07/10/2013 - 14:07:31 - [0] ----D C:\Program Files (x86)\BonanzaDealsLive =>Adware.BonanzaDeals
O43 - CFD: 30/10/2013 - 19:04:03 - [1,133] ----D C:\Program Files (x86)\Descrypt
O43 - CFD: 22/02/2014 - 10:27:34 - [0] ----D C:\Program Files (x86)\RBM
O43 - CFD: 21/02/2014 - 14:23:41 - [1,262] ----D C:\Program Files (x86)\SaveSense =>PUP.SaveSense
O43 - CFD: 21/02/2014 - 14:24:09 - [3,431] ----D C:\Program Files (x86)\SaveSenseLive =>PUP.SaveSense
O43 - CFD: 22/02/2014 - 10:33:22 - [0,489] ----D C:\Program Files (x86)\SupTab =>PUP.SupTab
O43 - CFD: 08/10/2013 - 11:54:14 - [10,077] ----D C:\Program Files (x86)\sXe Injected
O43 - CFD: 22/02/2014 - 10:24:34 - [33,331] ----D C:\Program Files (x86)\Common Files\337
O43 - CFD: 12/02/2014 - 10:56:27 - [0,160] ----D C:\ProgramData\Baidu =>Adware.BDSearch
O43 - CFD: 09/09/2013 - 11:37:38 - [103,014] ----D C:\ProgramData\Baidu Security =>Adware.BDSearch
O43 - CFD: 09/09/2013 - 11:37:37 - [0,279] ----D C:\ProgramData\BonanzaDealsLive =>Adware.BonanzaDeals
O43 - CFD: 22/02/2014 - 10:27:18 - [0] ----D C:\ProgramData\IePluginService =>Trojan.Trojan.SProtector
O43 - CFD: 24/12/2013 - 14:49:55 - [0,238] ----D C:\ProgramData\SaveSenseLive =>PUP.SaveSense
O43 - CFD: 22/02/2014 - 10:34:38 - [0] ----D C:\ProgramData\WPM =>PUP.WpManager
O43 - CFD: 22/02/2014 - 10:26:44 - [0] ----D C:\Users\Anne Caroline\AppData\Roaming\Baidu =>Adware.BDSearch
O43 - CFD: 09/09/2013 - 11:37:49 - [5,594] ----D C:\Users\Anne Caroline\AppData\Roaming\Baidu Security =>Adware.BDSearch
O43 - CFD: 13/01/2014 - 20:14:42 - [0,132] ----D C:\Users\Anne Caroline\AppData\Roaming\D394D188-BAC7-4e03-8FAF-389A4D7EC6F4
O43 - CFD: 22/02/2014 - 10:25:06 - [0,758] ----D C:\Users\Anne Caroline\AppData\Roaming\Desk 365 =>Hijacker.22Find
O43 - CFD: 24/12/2013 - 14:50:11 - [0] ----D C:\Users\Anne Caroline\AppData\Roaming\Funmoods =>PUP.Funmoods
O43 - CFD: 24/02/2014 - 09:44:37 - [1,228] ----D C:\Users\Anne Caroline\AppData\Roaming\newnext.me =>PUP.NextLive
O43 - CFD: 10/09/2013 - 00:05:11 - [2,387] ----D C:\Users\Anne Caroline\AppData\Roaming\OpenCandy =>Adware.OpenCandy
O43 - CFD: 24/12/2013 - 14:49:43 - [0] ----D C:\Users\Anne Caroline\AppData\Roaming\SaveSense =>PUP.SaveSense
O43 - CFD: 21/02/2014 - 14:26:36 - [0,489] ----D C:\Users\Anne Caroline\AppData\Roaming\SupTab =>PUP.SupTab
O43 - CFD: 09/09/2013 - 11:37:37 - [0] ----D C:\Users\Anne Caroline\AppData\Local\BonanzaDealsLive =>Adware.BonanzaDeals
O43 - CFD: 21/02/2014 - 14:40:49 - [1,224] ----D C:\Users\Anne Caroline\AppData\Local\genienext
O43 - CFD: 11/01/2014 - 17:17:00 - [0] ----D C:\Users\Anne Caroline\AppData\Local\Lollipop =>Adware.Lollipop
O43 - CFD: 24/12/2013 - 14:49:55 - [0] ----D C:\Users\Anne Caroline\AppData\Local\SaveSenseLive =>PUP.SaveSense
O43 - CFD: 21/02/2014 - 14:23:42 - [0,001] ----D C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense =>PUP.SaveSense
O43 - CFD: 04/01/2014 - 14:39:38 - [0,002] ----D C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop =>Adware.Lollipop
O43 - CFD: 07/10/2013 - 15:12:49 - [0,002] ----D C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\sXe Injected
~ Program Folder: 164 Legitimates Filtered in 00mn 25s



---\\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044)
O44 - LFC:[MD5.2465EBC8CD6E412CDC1AB9FEF40BCAE6] - 18/02/2014 - 12:03:08 ---A- . (...) -- C:\Windows\win.ini [478]
O44 - LFC:[MD5.13014E17D8DB6432FAB9BB94E01BDBF2] - 21/02/2014 - 13:49:35 ---A- . (.System Speedup - System Speedup.) -- C:\Windows\System32\roboot64.exe [19544] =>PUP.SystemSpeedup
O44 - LFC:[MD5.BF5BFBDB23149D82B9845CB4113C89E5] - 21/02/2014 - 15:22:19 ---A- . (...) -- C:\Windows\DirectX.log [196071]
O44 - LFC:[MD5.1639FB3BC6971821A75D8E7835109DEB] - 21/02/2014 - 16:45:31 ---A- . (...) -- C:\Windows\System32\prfc0416.dat [168208]
O44 - LFC:[MD5.9068C8FA7187D2B84F2051BCF9B30FD3] - 21/02/2014 - 16:45:31 ---A- . (...) -- C:\Windows\System32\prfh0416.dat [767222]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 22/02/2014 - 10:27:32 ---A- . (...) -- C:\END [0]
O44 - LFC:[MD5.B993247DC1E9465076AC8AD0A2DA7DBA] - 22/02/2014 - 19:28:34 ---A- . (...) -- C:\Windows\iis7.log [24488]
~ Files: 62 Legitimates Filtered in 00mn 04s



---\\ Operações e funções ao arranque do Windows Explorer (046)
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook [64Bits] - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
~ ShellExecuteHooks: Scanned in 00mn 00s



---\\ Chave do registo Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{ec94d6ae-837b-11e3-9da9-001bfcd9b5ad}\AutoRun\command. (...) -- F:\SISetup.exe (.not file.)
~ Keys: Scanned in 00mn 00s



---\\ Enumeração das chaves do registo PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 16 Legitimates Filtered in 00mn 00s



---\\ Enumeração das chaves do registo PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 8 Legitimates Filtered in 00mn 00s



---\\ Lista dos drivers do sistema (SDL) (O58)
O58 - SDL:[MD5.96B79B8DDCD2963691186DCDD46C134B] - 03/01/2008 - 09:57:40 ---A- . (.Analog Devices, Inc. - High Definition Audio Function Driver.) -- C:\Windows\System32\Drivers\ADIHdAud.sys [463360]
O58 - SDL:[MD5.03B7145C889603537E9FFEABB1AD1089] - 29/03/2005 - 01:30:38 ---A- . (.No owner - ATK0110 ACPI Utility.) -- C:\Windows\System32\Drivers\ASACPI.sys [8192]
O58 - SDL:[MD5.37F5CDA64FC515B3072531C1187EDCCA] - 21/01/2014 - 11:14:40 ---A- . (.Baidu, Inc. - Baidu Antivirus Minifilter Driver.) -- C:\Windows\System32\Drivers\Bfilter.sys [52032] =>Adware.BDSearch
O58 - SDL:[MD5.DFC1681F6645CB2AEA83897588F05362] - 21/01/2014 - 11:14:50 ---A- . (.Baidu, Inc. - Baidu FS Monitor Driver.) -- C:\Windows\System32\Drivers\Bfmon.sys [34624] =>Adware.BDSearch
O58 - SDL:[MD5.F4C1984178175ACE4A75BE23059C3E0A] - 21/01/2014 - 07:01:36 ---A- . (.Baidu, Inc. - Baidu Antivirus Selfprotect Driver.) -- C:\Windows\System32\Drivers\Bprotect.sys [128992] =>Adware.BDSearch
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 13/07/2009 - 22:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 17:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 13/07/2009 - 22:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
~ Drivers: 16 Legitimates Filtered in 00mn 03s



---\\ Lista das ferramentas de remoção de vírus (LAT) (063)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Lista dos serviços Legacy du registo (064)
O64 - Services: CurCS - 21/01/2014 - C:\Windows\system32\drivers\Bfilter.sys (Bfilter) .(.Baidu, Inc. - Baidu Antivirus Minifilter Driver.) - LEGACY_BFILTER =>Adware.BDSearch
O64 - Services: CurCS - 21/01/2014 - C:\Windows\system32\drivers\Bfmon.sys (Bfmon) .(.Baidu, Inc. - Baidu FS Monitor Driver.) - LEGACY_BFMON =>Adware.BDSearch
O64 - Services: CurCS - 21/01/2014 - C:\Windows\system32\drivers\Bprotect.sys (Bprotect) .(.Baidu, Inc. - Baidu Antivirus Selfprotect Driver.) - LEGACY_BPROTECT =>Adware.BDSearch
O64 - Services: CurCS - 10/06/2009 - C:\Windows\System32\Drivers\secdrv.sys (secdrv) .(.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) - LEGACY_SECDRV
~ Legacy: 119 Legitimates Filtered in 00mn 00s



---\\ Associações Shell Spawning (O67)
O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 12 Legitimates Filtered in 00mn 00s



---\\ Menu de inicialização Internet (068)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe" [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- C:\Program Files\Internet Explorer\iexplore.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.AArtemis
~ Keys: Scanned in 00mn 00s



---\\ Pesquisa adicional à raiz do sistema (radicular) (SPRF) (O84)
[MD5.8DDB84FB5FD7958654F23ECE6EA14D0F] [SPRF][15/01/2014] (.Baidu, Inc. - Baidu Antivirus FileSplitUpLoad Library.) -- C:\ProgramData\FileSplitUpLoad.dll [167784] =>Adware.BDSearch
[MD5.D41D8CD98F00B204E9800998ECF8427E] [SPRF][24/09/2013] (...) -- D:\Users\Anne Caroline\Desktop\CoD4MWDemoSetup.exe [1473748992]
[MD5.412E0A70AB92DDB10A8F8EEEBA386C26] [SPRF][12/02/2014] (...) -- D:\Users\Anne Caroline\Desktop\installer.exe [363080]
~ Files: 4 Legitimates Filtered in 00mn 00s



---\\ Lista das exceções do FireWall (FirewallRules) (O87)
O87 - FAEL: "{3C69B815-311E-41C1-A540-02896FD4301B}" |In - None - P17 - TRUE | .(...) -- C:\Program Files (x86)\WinZip Driver Updater\winzipdu.exe (.not file.)
O87 - FAEL: "TCP Query User{EC411A2C-9E13-4A61-AE50-32BE6A74F462}C:\users\anne caroline\appdata\local\akamai\netsession_win.exe" |In - Private - P6 - TRUE | .(...) -- C:\users\anne caroline\appdata\local\akamai\netsession_win.exe (.not file.)
O87 - FAEL: "UDP Query User{A0F8112E-ECBC-4A53-A006-E3C7CC346F0A}C:\users\anne caroline\appdata\local\akamai\netsession_win.exe" |In - Private - P17 - TRUE | .(...) -- C:\users\anne caroline\appdata\local\akamai\netsession_win.exe (.not file.)
~ Firewall: 209 Legitimates Filtered in 00mn 01s



---\\ Estado general dos serviços não Microsoft (EGS) (SR=Executados, SS=Parados)
SS - | Auto 10/07/1658 0 | (AnySendService) . (...) - C:\Program Files (x86)\AnySend\AnySendSVC.exe
SS - | Auto 10/07/1658 0 | (bavsvc) . (...) - C:\Program Files (x86)\Baidu Security\Baidu Antivirus\bavsvc.exe =>Adware.BDSearch
SS - | Auto 10/07/1658 0 | (bhipssvc) . (...) - C:\Program Files (x86)\Baidu Security\Baidu Antivirus\bhipssvc.exe =>Adware.BDSearch
SS - | Demand 21/02/2014 1431888 | (FLEXnet Licensing Service 64) . (.Flexera Software, Inc..) - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
SS - | Demand 16/02/2014 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 18/02/2014 118896 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Auto 21/02/2014 146920 | (savesenselive) . (.SaveSense.) - C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe =>PUP.SaveSense
SS - | Demand 21/02/2014 146920 | (savesenselivem) . (.SaveSense.) - C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe =>PUP.SaveSense
SS - | Auto 10/07/1658 0 | (Update EnhanceTronic) . (...) - C:\Program Files (x86)\EnhanceTronic\updateEnhanceTronic.exe
SS - | Auto 10/07/1658 0 | (Update FindRight) . (...) - C:\Program Files (x86)\FindRight\updateFindRight.exe =>Hijacker.FindrToolbar
SS - | Demand 13/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

SR - | Auto 19/10/2007 89600 | (AEADIFilters) . (.Andrea Electronics Corporation.) - C:\Windows\System32\AEADISRV.exe
SR - | Auto 02/02/2011 18656 | (Autodesk Content Service) . (...) - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
SR - | Auto 16/02/2014 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SR - | Auto 07/04/2010 127800 | (HPSIService) . (.HP.) - C:\Windows\system32\HPSIsvc.exe
SR - | Auto 23/10/2013 23808 | (MsMpSvc) . (.Microsoft Corporation.) - C:\Program Files\Microsoft Security Client\MsMpEng.exe
SR - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 13/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

~ Services: Scanned in 00mn 10s



---\\ Scâner Aditional (088)
Database Version : 13031 - (23/02/2014)
Clés trouvées (Keys found) : 18
Valeurs trouvées (Values found) : 12
Dossiers trouvés (Folders found) : 29
Fichiers trouvés (Files found) : 26

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0F21B1E5-5AFC-43C9-9C66-515046E92EC2}] =>PUP.SaveSense^
[HKLM\SYSTEM\CurrentControlSet\Services\bavsvc] =>Adware.BDSearch^
[HKLM\SYSTEM\CurrentControlSet\Services\bhipssvc] =>Adware.BDSearch^
[HKLM\SYSTEM\CurrentControlSet\Services\savesenselive) (savesenselive] =>PUP.SaveSense^
[HKLM\SYSTEM\CurrentControlSet\Services\Update FindRight] =>Hijacker.FindrToolbar^
[HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}] =>PUP.V9Software
[HKLM\Software\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}] =>Toolbar.Ask
[HKCU\Software\lollipop] =>Adware.Lollipop
[HKCU\Software\ilivid] =>Adware.Bandoo
[HKLM\Software\Wow6432Node\Iminent] =>Adware.IMBooster
[HKCU\Software\AppDataLow\Software\PriceGong] =>Adware.PriceGong
[HKCU\Software\Softonic] =>Toolbar.Conduit
[HKCU\Software\InstallCore] =>Adware.InstallCore
[HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\desksvc] =>Hijacker.22find
[HKCU\Software\AppDataLow\Software\Crossrider] =>PUP.CrossRider
[HKLM\Software\Wow6432Node\Google\Chrome\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo] =>PUP.Elex
[HKLM\Software\Wow6432Node\hosts] =>PUP.CrossRider
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus] =>Adware.BDSearch
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:NextLive =>PUP.NextLive^
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:mobilegeni daemon =>PUP.Mobogenie^
C:\Program Files (x86)\Baidu Security =>Adware.BDSearch^
C:\Program Files (x86)\BonanzaDeals =>Adware.BonanzaDeals^
C:\Program Files (x86)\BonanzaDealsLive =>Adware.BonanzaDeals^
C:\Program Files (x86)\SaveSense =>PUP.SaveSense^
C:\Program Files (x86)\SaveSenseLive =>PUP.SaveSense^
C:\Program Files (x86)\SupTab =>PUP.SupTab^
C:\ProgramData\Baidu =>Adware.BDSearch^
C:\ProgramData\Baidu Security =>Adware.BDSearch^
C:\ProgramData\BonanzaDealsLive =>Adware.BonanzaDeals^
C:\ProgramData\IePluginService =>Trojan.Trojan.SProtector^
C:\ProgramData\SaveSenseLive =>PUP.SaveSense^
C:\ProgramData\WPM =>PUP.WpManager^
C:\Users\Anne Caroline\AppData\Roaming\Baidu =>Adware.BDSearch^
C:\Users\Anne Caroline\AppData\Roaming\Baidu Security =>Adware.BDSearch^
C:\Users\Anne Caroline\AppData\Roaming\Desk 365 =>Hijacker.22Find^
C:\Users\Anne Caroline\AppData\Roaming\Funmoods =>PUP.Funmoods^
C:\Users\Anne Caroline\AppData\Roaming\newnext.me =>PUP.NextLive^
C:\Users\Anne Caroline\AppData\Roaming\OpenCandy =>Adware.OpenCandy^
C:\Users\Anne Caroline\AppData\Roaming\SaveSense =>PUP.SaveSense^
C:\Users\Anne Caroline\AppData\Roaming\SupTab =>PUP.SupTab^
C:\Users\Anne Caroline\AppData\Local\BonanzaDealsLive =>Adware.BonanzaDeals^
C:\Users\Anne Caroline\AppData\Local\Lollipop =>Adware.Lollipop^
C:\Users\Anne Caroline\AppData\Local\SaveSenseLive =>PUP.SaveSense^
C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense =>PUP.SaveSense^
C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop =>Adware.Lollipop^
C:\Program Files (x86)\Common Files\337 =>Hijacker.22find
C:\Users\Anne Caroline\AppData\Local\Temp\Iminent =>Adware.IMBooster
C:\Users\Anne Caroline\AppData\Local\Temp\Desk365 =>Hijacker.22find
C:\Users\Anne Caroline\AppData\Local\Temp\eIntaller =>PUP.eSafeSecurity
C:\Users\Anne Caroline\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent^
C:\Windows\Tasks\Funmoods.job =>Hijacker.iHaveNet^
C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job =>PUP.SaveSense^
C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job =>PUP.SaveSense^
C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe =>PUP.SaveSense^
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\UninstallManager.exe =>PUP.Awesomehp^
[HKCU\Software\Baidu Security] =>Adware.BDSearch^
[HKCU\Software\Baidu] =>Adware.BDSearch^
[HKCU\Software\BonanzaDealsLive] =>Adware.BonanzaDeals^
[HKCU\Software\SaveSenseLive] =>PUP.SaveSense^
[HKCU\Software\SaveSense] =>PUP.SaveSense^
[HKCU\Software\iLivid] =>Adware.Bandoo^
[HKCU\Software\iVIDI Plugin] =>PUP.Ividi^
[HKLM\Software\Wow6432Node\Baidu Security] =>Adware.BDSearch^
[HKLM\Software\Wow6432Node\Baidu_Drp_pos] =>Adware.BDSearch^
[HKLM\Software\Wow6432Node\BonanzaDealsLive] =>Adware.BonanzaDeals^
[HKLM\Software\Wow6432Node\DealPlyLive] =>PUP.DealPly^
[HKLM\Software\Wow6432Node\SaveSenseLive] =>PUP.SaveSense^
[HKLM\Software\Wow6432Node\SaveSense] =>PUP.SaveSense^
[HKLM\Software\Wow6432Node\Wpm] =>PUP.WpManager^
[HKLM\Software\Wow6432Node\baidu] =>Adware.BDSearch^
[HKLM\Software\Wow6432Node\supTab] =>PUP.SupTab^
[HKLM\Software\Wow6432Node\supWPM] =>PUP.WpManager^
C:\ProgramData\FileSplitUpLoad.dll =>Adware.BDSearch^
C:\Users\Anne Caroline\AppData\Local\Temp\IminentSetup-1-.exe =>Adware.IMBooster
~ Additionnel Scan: 366606 Items scanned in 00mn 37s



---\\ Sumário das deteções encontradas na sua estação
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.SaveSense
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.NextLive
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Adware.Bandoo
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Mobogenie
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Adware.BDSearch
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Hijacker.FindrToolbar
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Hijacker.iHavenet
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Hijacker.22Find
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Funmoods
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Adware.BonanzaDeals
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Adware.InstallCore
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Toolbar.Conduit
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Ividi
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Adware.Lollipop
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.DealPly
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Adware.IMBooster
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.WpManager
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.SupTab
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Trojan.SProtector
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Adware.OpenCandy
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.SystemSpeedup
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.AArtemis
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.V9Software
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Toolbar.Ask
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Adware.PriceGong
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.CrossRider
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Elex
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.eSafeSecurity
~ MSI: 29 link(s) detected in 00mn 37s



~ 1163 Legitimates filtered by white list
End of the scan (645 lines in 02mn 36s)(0)

Siga, por gentileza, as dicas do tutorial abaixo:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

* Na sua próxima resposta poste, por gentileza, o log do Adwcleaner que estará em C:\AdwCleaner\AdwCleaner[S0].txt

Ficamos na espera.

# AdwCleaner v3.019 - Relatório criado 24/02/2014 às 12:38:46
# Atualizado 17/02/2014 por Xplode
# Sistema Operacional : Windows 7 Professional Service Pack 1 (64 bits)
# Usuário : Anne Caroline - ANNECAROLINE-PC
# Executando de : D:\Users\Anne Caroline\Downloads\AdwCleaner.exe
# Opção : Limpar

***** [ Serviços ] *****


***** [ Arquivos / Pastas ] *****

Pasta Deletada : C:\ProgramData\baidu
Pasta Deletada : C:\ProgramData\BonanzaDealsLive
Pasta Deletada : C:\ProgramData\IePluginService
Pasta Deletada : C:\ProgramData\SaveSenseLive
Pasta Deletada : C:\ProgramData\WPM
Pasta Deletada : C:\Program Files (x86)\BonanzaDeals
Pasta Deletada : C:\Program Files (x86)\BonanzaDealsLive
Pasta Deletada : C:\Program Files (x86)\SaveSense
Pasta Deletada : C:\Program Files (x86)\SaveSenseLive
Pasta Deletada : C:\Program Files (x86)\SupTab
Pasta Deletada : C:\Program Files (x86)\Common Files\337
Pasta Deletada : C:\Users\Anne Caroline\AppData\Local\BonanzaDealsLive
Pasta Deletada : C:\Users\Anne Caroline\AppData\Local\genienext
Pasta Deletada : C:\Users\Anne Caroline\AppData\Local\lollipop
Pasta Deletada : C:\Users\Anne Caroline\AppData\Local\Mobogenie
Pasta Deletada : C:\Users\Anne Caroline\AppData\Local\SaveSenseLive
Pasta Deletada : C:\Users\ANNECA~1\AppData\Local\Temp\Desk365
Pasta Deletada : C:\Users\ANNECA~1\AppData\Local\Temp\eIntaller
Pasta Deletada : C:\Users\ANNECA~1\AppData\Local\Temp\Iminent
Pasta Deletada : C:\Users\Anne Caroline\AppData\LocalLow\Unitech LLC
Pasta Deletada : C:\Users\Anne Caroline\AppData\Roaming\baidu
Pasta Deletada : C:\Users\Anne Caroline\AppData\Roaming\Desk 365
Pasta Deletada : C:\Users\Anne Caroline\AppData\Roaming\digitalsite
Pasta Deletada : C:\Users\Anne Caroline\AppData\Roaming\Funmoods
Pasta Deletada : C:\Users\Anne Caroline\AppData\Roaming\newnext.me
Pasta Deletada : C:\Users\Anne Caroline\AppData\Roaming\OpenCandy
Pasta Deletada : C:\Users\Anne Caroline\AppData\Roaming\SaveSense
Pasta Deletada : C:\Users\Anne Caroline\AppData\Roaming\SupTab
Pasta Deletada : C:\Users\Anne Caroline\AppData\Roaming\Systweak
Pasta Deletada : C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mobogenie
Pasta Deletada : C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense
Pasta Deletada : C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop
Pasta Deletada : D:\Users\Anne Caroline\Documents\Mobogenie
Pasta Deletada : C:\Users\Anne Caroline\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml
Arquivo Deletada : C:\END
Arquivo Deletada : C:\Windows\System32\roboot64.exe
Arquivo Deletada : C:\Windows\System32\Tasks\Desk 365 RunAsStdUser
Arquivo Deletada : C:\Windows\Tasks\Funmoods.job
Arquivo Deletada : C:\Windows\System32\Tasks\Funmoods

***** [ Atalhos ] *****

Atalho Desinfectada : C:\Users\Public\Desktop\Google Chrome.lnk
Atalho Desinfectada : C:\Users\Public\Desktop\Mozilla Firefox.lnk
Atalho Desinfectada : D:\Users\Anne Caroline\Desktop\Internet Explorer.lnk
Atalho Desinfectada : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Atalho Desinfectada : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
Atalho Desinfectada : C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Atalho Desinfectada : C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Atalho Desinfectada : C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
Atalho Desinfectada : C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Atalho Desinfectada : C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
Atalho Desinfectada : C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
Atalho Desinfectada : C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk

***** [ Registro ] *****

Chave Deletedo : HKLM\SOFTWARE\Google\Chrome\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo
Chave Deletedo : HKCU\Software\Classes\Applications\lollipop.exe
Chave Deletedo : HKCU\Software\Classes\pokki
Valor Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [iLivid]
Valor Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [NextLive]
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BonanzaDealsLive.exe
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Valor Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [mobilegeni daemon]
Chave Deletedo : HKLM\SOFTWARE\MozillaPlugins\@VideoDownloadConverter_ScriptHelper.com/Plugin
Chave Deletedo : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{0F21B1E5-5AFC-43C9-9C66-515046E92EC2}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib\{DCABB943-792E-44C4-9029-ECBEE6265AF9}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0F21B1E5-5AFC-43C9-9C66-515046E92EC2}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0F21B1E5-5AFC-43C9-9C66-515046E92EC2}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0F21B1E5-5AFC-43C9-9C66-515046E92EC2}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2D6F0AC3-0C2E-4E07-8FDA-11268AB51211}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Dados Restaurada : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
Dados Restaurada : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command
Dados Restaurada : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command
Chave Deletedo : HKCU\Software\BonanzaDealsLive
Chave Deletedo : HKCU\Software\dsiteproducts
Chave Deletedo : HKCU\Software\ilivid
Chave Deletedo : HKCU\Software\InstallCore
Chave Deletedo : HKCU\Software\InstalledThirdPartyPrograms
Chave Deletedo : HKCU\Software\lollipop
Chave Deletedo : HKCU\Software\powerpack
Chave Deletedo : HKCU\Software\SaveSenseLive
Chave Deletedo : HKCU\Software\Softonic
Chave Deletedo : HKCU\Software\systweak
Chave Deletedo : HKCU\Software\Unitech LLC
Chave Deletedo : HKCU\Software\AppDataLow\Software\Crossrider
Chave Deletedo : HKCU\Software\AppDataLow\Software\DynConIE
Chave Deletedo : HKCU\Software\AppDataLow\Software\PriceGong
Chave Deletedo : HKLM\Software\aartemisSoftware
Chave Deletedo : HKLM\Software\BonanzaDealsLive
Chave Deletedo : HKLM\Software\DealPlyLive
Chave Deletedo : HKLM\Software\Desksvc
Chave Deletedo : HKLM\Software\hdcode
Chave Deletedo : HKLM\Software\Iminent
Chave Deletedo : HKLM\Software\SaveSenseLive
Chave Deletedo : HKLM\Software\supTab
Chave Deletedo : HKLM\Software\supWPM
Chave Deletedo : HKLM\Software\systweak
Chave Deletedo : HKLM\Software\Unitech LLC
Chave Deletedo : HKLM\Software\V9
Chave Deletedo : HKLM\Software\Wpm
Chave Deletedo : [x64] HKLM\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbar
Chave Deletedo : [x64] HKLM\SOFTWARE\InstalledThirdPartyPrograms

***** [ Navegadores ] *****

-\\ Internet Explorer v11.0.9600.16518

Configurações Restauradas : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Configurações Restauradas : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Configurações Restauradas : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Configurações Restauradas : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Configurações Restauradas : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Configurações Restauradas : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

-\\ Mozilla Firefox v27.0.1 (pt-BR)

[ Arquivo : C:\Users\Anne Caroline\AppData\Roaming\Mozilla\Firefox\Profiles\r9dqlpuj.default-1393249105431\prefs.js ]


-\\ Google Chrome v33.0.1750.117

[ Arquivo : C:\Users\Anne Caroline\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [12059 octets] - [24/02/2014 12:34:55]
AdwCleaner[S0].txt - [8994 octets] - [24/02/2014 12:38:46]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [9054 octets] ##########

Siga, por gentileza, as dicas deste tutorial para fazer uma limpeza de seu PC com o Malwarebytes:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Na sua próxima resposta poste este log do Malwarebytes.

Ficamos no aguardo.

Até agora está dando certo, foram detectados 34 .. Eu deixei verificando todo o computador

Vou ter que dar uma saída, assim que voltar eu continuo e posto aqui novamente   

Desde já muito obrigado!!

Ok, fico na espera.    

Desculpe a demora ...

Fiz a verificação, quando cliquei para ver os resultados, encontrei 144 itens.. Posso remove-los?

Clique na aba Logs do Malwarebytes, abra o arquivo do relatório dele e o copie e poste aqui para podermos analisar antes de você excluir.

Ta bloqueado.. Nao consigo sair do relatorio...

Cliquei em salvar log, eh a mesma coisa?

Cliquei em Salvar Log, abriu isso no bloco de notas.. relatorio:

Malwarebytes Anti-Malware (Trial) 1.75.0.1300
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Versão da Base de Dados: v2014.02.25.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16518
Anne Caroline :: ANNECAROLINE-PC [administrador]

Proteção: Permitir

25/02/2014 10:11:27
MBAM-log-2014-02-25 (11-44-58).txt

Tipo de Verificação: Verificação Completa (C:\|D:\|)
Opções de verificações ativadas: Memória | Inicialização | Registro | Sistema de arquivos | Heurística/Extra | Heurística/Shuriken | PUP | PUM
Opções de verificação desativadas: P2P
Objetos escaneados: 430128
Tempo decorrido: 1 hora(s), 10 minuto(s), 41 segundo(s)

Processos de Memória Detectados: 1
C:\Program Files (x86)\VLC Player GPU+\UsageMonitor.exe (PUP.BitCoinMiner) -> 4028 -> Nenhuma ação foi feita.

Módulos de Memória Detectados: 3
C:\Program Files (x86)\VLC Player GPU+\miner.dll (PUP.BitCoinMiner) -> Nenhuma ação foi feita.
C:\Program Files (x86)\VLC Player GPU+\usft_ext.dll (PUP.BitCoinMiner) -> Nenhuma ação foi feita.
C:\Program Files (x86)\VLC Player GPU+\coinutil.dll (PUP.BitcoinMiner) -> Nenhuma ação foi feita.

Chaves de Registro Detectadas: 45
HKCR\AppID\{685F23D9-FCFD-475C-B56A-362645945C5A} (PUP.Optional.iVIDI.A) -> Nenhuma ação foi feita.
HKCR\AppID\{A2D3FB7A-6873-45E8-AF96-57092D721828} (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\CLSID\{A2D3FB7A-6873-45E8-AF96-57092D721828} (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.OnDemandCOMClassSvc.1.0 (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.OnDemandCOMClassSvc (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\CLSID\{E5A7A645-8318-4895-B85C-EDC606B80DB6} (PUP.Optional.DynConIE.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLive.OneClickCtrl.9 (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLive.OneClickProcessLauncherMachine (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLive.OneClickProcessLauncherMachine.1.0 (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLive.Update3WebControl.3 (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.CoCreateAsync (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.CoCreateAsync.1.0 (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.CoreClass (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.CoreClass.1 (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.CoreMachineClass (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.CoreMachineClass.1 (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.CredentialDialogMachine (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.CredentialDialogMachine.1.0 (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.OnDemandCOMClassMachine (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.OnDemandCOMClassMachine.1.0 (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.OnDemandCOMClassMachineFallback (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.OnDemandCOMClassMachineFallback.1.0 (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.ProcessLauncher (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.ProcessLauncher.1.0 (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.Update3COMClassService (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.Update3COMClassService.1.0 (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.Update3WebMachine (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.Update3WebMachine.1.0 (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.Update3WebMachineFallback (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.Update3WebMachineFallback.1.0 (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.Update3WebSvc (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\SaveSenseLiveUpdate.Update3WebSvc.1.0 (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCR\AppID\SaveSenseLive.exe (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCU\SOFTWARE\SaveSense (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKCU\SOFTWARE\HiSoft\CrackDownloader (CrackTool.Agent) -> Nenhuma ação foi feita.
HKCU\Software\iVIDI Plugin (PUP.Optional.Ividi.A) -> Nenhuma ação foi feita.
HKLM\SOFTWARE\SaveSense (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKLM\SOFTWARE\MozillaPlugins\@tools.updaterss.com/SaveSenseLive Update;version=3 (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKLM\SOFTWARE\MozillaPlugins\@tools.updaterss.com/SaveSenseLive Update;version=9 (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
HKLM\SOFTWARE\HOSTS\INSTALLER (PUP.Optional.Hosts.A) -> Nenhuma ação foi feita.
HKLM\SYSTEM\CurrentControlSet\Services\savesenselive (PUP.Optional.SaveSense) -> Nenhuma ação foi feita.
HKLM\SYSTEM\CurrentControlSet\Services\savesenselivem (PUP.Optional.SaveSense) -> Nenhuma ação foi feita.
HKLM\SYSTEM\CurrentControlSet\Services\Update EnhanceTronic (PUP.Optional.EnhanceTronic.A) -> Nenhuma ação foi feita.
HKLM\SYSTEM\CurrentControlSet\Services\Update FindRight (PUP.Optional.FindRight.A) -> Nenhuma ação foi feita.
HKLM\Software\awesomehpSoftware (PUP.Optional.Awesomehp.A) -> Nenhuma ação foi feita.

Valores de Registro Detectadas: 2
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|UsageTemp (Trojan.Agent.E) -> Data: "C:\Users\ANNECA~1\AppData\Local\Temp\UsageTemp.exe" -> Nenhuma ação foi feita.
HKLM\SOFTWARE\hosts\Installer|BundledIe (PUP.Optional.Hosts.A) -> Data: 1 -> Nenhuma ação foi feita.

Itens de Dados no Registro Detectadas: 0
(Não foram detectados ítens maliciosos)

Pastas Detectadas: 3
C:\Users\Anne Caroline\AppData\Roaming\awesomehp (PUP.Optional.Awesomehp.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\images (PUP.Optional.Awesomehp.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml (PUP.Optional.Lightning.A) -> Nenhuma ação foi feita.

Arquivos Detectados: 89
C:\Program Files (x86)\VLC Player GPU+\UsageMonitor.exe (PUP.BitCoinMiner) -> Nenhuma ação foi feita.
C:\Program Files (x86)\VLC Player GPU+\miner.dll (PUP.BitCoinMiner) -> Nenhuma ação foi feita.
C:\Program Files (x86)\VLC Player GPU+\usft_ext.dll (PUP.BitCoinMiner) -> Nenhuma ação foi feita.
C:\Program Files (x86)\VLC Player GPU+\coinutil.dll (PUP.BitcoinMiner) -> Nenhuma ação foi feita.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSense\SaveSenseUpdateVer.exe.vir (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe.vir (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdate.dll.vir (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll.vir (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\psmachine.dll.vir (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\psuser.dll.vir (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLive.exe.vir (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveBroker.exe.vir (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveHandler.exe.vir (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveOnDemand.exe.vir (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SupTab.dll.vir (PUP.Optional.SupTab.A) -> Nenhuma ação foi feita.
C:\AdwCleaner\Quarantine\C\Users\Anne Caroline\AppData\Local\genienext\nengine.dll.vir (PUP.Optional.NextLive.A) -> Nenhuma ação foi feita.
C:\AdwCleaner\Quarantine\C\Users\Anne Caroline\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie2.2.0.zip.vir (PUP.Optional.NextLive.A) -> Nenhuma ação foi feita.
C:\AdwCleaner\Quarantine\C\Users\Anne Caroline\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\nengine.dll.vir (PUP.Optional.NextLive.A) -> Nenhuma ação foi feita.
C:\AdwCleaner\Quarantine\C\Users\Anne Caroline\AppData\Local\Temp\Desk365\eInstall\eInstall.exe.vir (PUP.Optional.Desk365.A) -> Nenhuma ação foi feita.
C:\AdwCleaner\Quarantine\C\Users\Anne Caroline\AppData\Local\Temp\eIntaller\F1AA872EAE7F46e7867DF6095B25F346\eXQ.exe.vir (PUP.Optional.Wilsys.A) -> Nenhuma ação foi feita.
C:\AdwCleaner\Quarantine\C\Users\Anne Caroline\AppData\Roaming\newnext.me\nengine.dll.vir (PUP.Optional.NextLive.A) -> Nenhuma ação foi feita.
C:\AdwCleaner\Quarantine\C\Users\Anne Caroline\AppData\Roaming\SupTab\SupTab.dll.vir (PUP.Optional.SupTab.A) -> Nenhuma ação foi feita.
C:\Program Files\Update Software\Bundle.exe (PUP.Optional.Amonetize.A) -> Nenhuma ação foi feita.
C:\Program Files\Update Software\winmon.exe (Riskware.BitcoinMiner) -> Nenhuma ação foi feita.
C:\Program Files (x86)\VLC Player GPU+\namecoin-dns.exe (PUP.BitcoinMiner) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\130214_a.exe (PUP.Optional.SkyTech.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\130214_l.exe (PUP.Optional.CashBack) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\130214_p.exe (PUP.Optional.ToolBarInstaller.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\130214_y.exe (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\201213_d.exe (PUP.Optional.PCMega) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\201213_p.exe (PUP.Optional.ToolBarInstaller.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\201213_y.exe (PUP.Optional.SaveSense.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\aspcc.exe (PUP.Optional.InstallMonetizer.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\DownloadManager.exe (PUP.Optional.OutBrowse) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\ICReinstall_atube-catcher-384272-32-bits.exe (PUP.Optional.InstallCore) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\ICReinstall_revo-uninstaller-195-32-bits.exe (PUP.Optional.InstallCore) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\ICReinstall_wmv-converter-102-32-bits.exe (PUP.Optional.InstallCore) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\IminentSetup-1-.exe (PUP.Optional.Iminent.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\Mobogenie_Setup_2.1.37_505.exe (PUP.Optional.NextLive.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\presetup.exe (Trojan.BHO) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\Setup1.exe (PUP.Optional.WhiteSea) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\setupA9_.exe (PUP.Optional.NextLive.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\wupdater.exe (Trojan.BitMiner) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\fullpackage_temp1388857096\tmp\NewGdp.exe (PUP.Optional.WpManager.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\fullpackage_temp1393003403\package1.zip (PUP.Optional.SkyTech.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\fullpackage_temp1393003403\QQBrowserFrame.dll (PUP.Optional.SkyTech.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\fullpackage_temp1393003403\tmp\SupTab.exe (PUP.Optional.SupTab.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\fullpackage_temp1393075341\package1.zip (PUP.Optional.SkyTech.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\fullpackage_temp1393075341\QQBrowserFrame.dll (PUP.Optional.SkyTech.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\fullpackage_temp1393075341\tmp\desk365.exe (PUP.Optional.Desk365.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\fullpackage_temp1393075341\tmp\SupTab.exe (PUP.Optional.SupTab.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\is357113909\4326286_stp.EXE (PUP.Optional.Bundler) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\is357113909\4326234_stp\cor_ar_2013814171757_portaldosites.exe (PUP.Optional.Elex) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\is357113909\4326319_stp\bd.exe (PUP.Optional.BonanzaDeals.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\is701137889\10070696_stp.EXE (PUP.Optional.Spigot.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\is701137889\751321_stp.EXE (PUP.Optional.OpenCandy) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\is701137889\10070747_stp\bd.exe (PUP.Optional.BonanzaDeals.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\is701137889\2972417_stp\FindRightSetup.exe (PUP.Optional.FindRight.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\is701137889\633653_stp\bd.exe (PUP.Optional.BonanzaDeals.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\is701137889\751430_stp\bd.exe (PUP.Optional.BonanzaDeals.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\n3813\Launcher.exe (PUP.Optional.Amonetize) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\n3833\aartemis_1111-76a67d16.exe (PUP.Optional.Aartemis.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\n3833\Bizzybolt_2511-5ea0573c.exe (PUP.Optional.Bizzybolt.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Temp\n3833\Mobogenie_BR_1612.exe (PUP.Optional.NextLive.A) -> Nenhuma ação foi feita.
D:\$RECYCLE.BIN\S-1-5-21-1054709842-3106569860-2955332437-1000\$RQX29E5.exe (PUP.Optional.Bandoo) -> Nenhuma ação foi feita.
D:\Users\Anne Caroline\Downloads\828-aTubeCatcher.exe (PUP.Optional.Spigot.A) -> Nenhuma ação foi feita.
D:\Users\Anne Caroline\Downloads\Adobe_Photoshop_CS6.exe (PUP.Optional.OpenCandy) -> Nenhuma ação foi feita.
D:\Users\Anne Caroline\Downloads\Arquivo.exe (PUP.Optional.Midia) -> Nenhuma ação foi feita.
D:\Users\Anne Caroline\Downloads\AutoCAD 2010.exe (PUP.Optional.Solimba) -> Nenhuma ação foi feita.
D:\Users\Anne Caroline\Downloads\AutoCAD_2012_x86_(32bit)_._(Product_key_and_Xforce_Keygen).exe (PUP.Optional.OptimumInstaller.A) -> Nenhuma ação foi feita.
D:\Users\Anne Caroline\Downloads\PhotoScape_V3.6.5.exe (PUP.Optional.OpenCandy) -> Nenhuma ação foi feita.
D:\Users\Anne Caroline\Downloads\Setup (1).exe (PUP.Optional.DomalQ) -> Nenhuma ação foi feita.
D:\Users\Anne Caroline\Downloads\SoftonicDownloader_para_autocad.exe (PUP.Optional.Softonic.A) -> Nenhuma ação foi feita.
D:\Users\Anne Caroline\Downloads\UltimateCodec.exe (PUP.Optional.BundleInstaller.A) -> Nenhuma ação foi feita.
D:\Users\Anne Caroline\Downloads\VideoDownloadConvertCrxSetup.A4708625-FD58-4B40-9298-0C5A355755DB.exe (PUP.Optional.Mindspark) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\33.json (PUP.Optional.Awesomehp.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\uninstallDlg.xml (PUP.Optional.Awesomehp.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\UninstallManager.exe (PUP.Optional.Awesomehp.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\images\bg1.png (PUP.Optional.Awesomehp.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\images\button1.png (PUP.Optional.Awesomehp.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\images\checked.png (PUP.Optional.Awesomehp.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\images\close.png (PUP.Optional.Awesomehp.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\images\min.png (PUP.Optional.Awesomehp.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\images\Thumbs.db (PUP.Optional.Awesomehp.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\images\unchecked.png (PUP.Optional.Awesomehp.A) -> Nenhuma ação foi feita.
C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\awesomehp.xml (PUP.Optional.Awesomehp.A) -> Nenhuma ação foi feita.
C:\Users\Anne Caroline\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv2.crx (PUP.Optional.NewTab.A) -> Nenhuma ação foi feita.
C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job (PUP.Optional.SaveSense) -> Nenhuma ação foi feita.
C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job (PUP.Optional.SaveSense) -> Nenhuma ação foi feita.

(fim)

Pode selecionar todos estes problemas que o Malwarebytes encontrou e escolha a opção de Remover selecionados.

Depois disto poste o novo log que ele irá criar.

Reiniciei o computador

Em logs, apareceram 3 resultados:

Malwarebytes Anti-Malware (Trial) 1.75.0.1300
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Versão da Base de Dados: v2014.02.25.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16518
Anne Caroline :: ANNECAROLINE-PC [administrador]

Proteção: Permitir

25/02/2014 10:11:27
mbam-log-2014-02-25 (10-11-27).txt

Tipo de Verificação: Verificação Completa (C:\|D:\|)
Opções de verificações ativadas: Memória | Inicialização | Registro | Sistema de arquivos | Heurística/Extra | Heurística/Shuriken | PUP | PUM
Opções de verificação desativadas: P2P
Objetos escaneados: 430128
Tempo decorrido: 1 hora(s), 10 minuto(s), 41 segundo(s)

Processos de Memória Detectados: 1
C:\Program Files (x86)\VLC Player GPU+\UsageMonitor.exe (PUP.BitCoinMiner) -> 4028 -> Será deletado na próxima inicialização.

Módulos de Memória Detectados: 3
C:\Program Files (x86)\VLC Player GPU+\miner.dll (PUP.BitCoinMiner) -> Será deletado na próxima inicialização.
C:\Program Files (x86)\VLC Player GPU+\usft_ext.dll (PUP.BitCoinMiner) -> Será deletado na próxima inicialização.
C:\Program Files (x86)\VLC Player GPU+\coinutil.dll (PUP.BitcoinMiner) -> Será deletado na próxima inicialização.

Chaves de Registro Detectadas: 45
HKCR\AppID\{685F23D9-FCFD-475C-B56A-362645945C5A} (PUP.Optional.iVIDI.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\AppID\{A2D3FB7A-6873-45E8-AF96-57092D721828} (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\CLSID\{A2D3FB7A-6873-45E8-AF96-57092D721828} (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.OnDemandCOMClassSvc.1.0 (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.OnDemandCOMClassSvc (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\CLSID\{E5A7A645-8318-4895-B85C-EDC606B80DB6} (PUP.Optional.DynConIE.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLive.OneClickCtrl.9 (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLive.OneClickProcessLauncherMachine (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLive.OneClickProcessLauncherMachine.1.0 (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLive.Update3WebControl.3 (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.CoCreateAsync (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.CoCreateAsync.1.0 (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.CoreClass (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.CoreClass.1 (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.CoreMachineClass (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.CoreMachineClass.1 (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.CredentialDialogMachine (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.CredentialDialogMachine.1.0 (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.OnDemandCOMClassMachine (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.OnDemandCOMClassMachine.1.0 (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.OnDemandCOMClassMachineFallback (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.OnDemandCOMClassMachineFallback.1.0 (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.ProcessLauncher (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.ProcessLauncher.1.0 (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.Update3COMClassService (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.Update3COMClassService.1.0 (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.Update3WebMachine (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.Update3WebMachine.1.0 (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.Update3WebMachineFallback (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.Update3WebMachineFallback.1.0 (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.Update3WebSvc (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\SaveSenseLiveUpdate.Update3WebSvc.1.0 (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCR\AppID\SaveSenseLive.exe (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCU\SOFTWARE\SaveSense (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKCU\SOFTWARE\HiSoft\CrackDownloader (CrackTool.Agent) -> Enviado para a Quarentena e deletado com sucesso.
HKCU\Software\iVIDI Plugin (PUP.Optional.Ividi.A) -> Enviado para a Quarentena e deletado com sucesso.
HKLM\SOFTWARE\SaveSense (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKLM\SOFTWARE\MozillaPlugins\@tools.updaterss.com/SaveSenseLive Update;version=3 (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKLM\SOFTWARE\MozillaPlugins\@tools.updaterss.com/SaveSenseLive Update;version=9 (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
HKLM\SOFTWARE\HOSTS\INSTALLER (PUP.Optional.Hosts.A) -> Enviado para a Quarentena e deletado com sucesso.
HKLM\SYSTEM\CurrentControlSet\Services\savesenselive (PUP.Optional.SaveSense) -> Enviado para a Quarentena e deletado com sucesso.
HKLM\SYSTEM\CurrentControlSet\Services\savesenselivem (PUP.Optional.SaveSense) -> Enviado para a Quarentena e deletado com sucesso.
HKLM\SYSTEM\CurrentControlSet\Services\Update EnhanceTronic (PUP.Optional.EnhanceTronic.A) -> Enviado para a Quarentena e deletado com sucesso.
HKLM\SYSTEM\CurrentControlSet\Services\Update FindRight (PUP.Optional.FindRight.A) -> Enviado para a Quarentena e deletado com sucesso.
HKLM\Software\awesomehpSoftware (PUP.Optional.Awesomehp.A) -> Enviado para a Quarentena e deletado com sucesso.

Valores de Registro Detectadas: 2
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|UsageTemp (Trojan.Agent.E) -> Data: "C:\Users\ANNECA~1\AppData\Local\Temp\UsageTemp.exe" -> Enviado para a Quarentena e deletado com sucesso.
HKLM\SOFTWARE\hosts\Installer|BundledIe (PUP.Optional.Hosts.A) -> Data: 1 -> Enviado para a Quarentena e deletado com sucesso.

Itens de Dados no Registro Detectadas: 0
(Não foram detectados ítens maliciosos)

Pastas Detectadas: 3
C:\Users\Anne Caroline\AppData\Roaming\awesomehp (PUP.Optional.Awesomehp.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\images (PUP.Optional.Awesomehp.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml (PUP.Optional.Lightning.A) -> Enviado para a Quarentena e deletado com sucesso.

Arquivos Detectados: 89
C:\Program Files (x86)\VLC Player GPU+\UsageMonitor.exe (PUP.BitCoinMiner) -> Será deletado na próxima inicialização.
C:\Program Files (x86)\VLC Player GPU+\miner.dll (PUP.BitCoinMiner) -> Será deletado na próxima inicialização.
C:\Program Files (x86)\VLC Player GPU+\usft_ext.dll (PUP.BitCoinMiner) -> Será deletado na próxima inicialização.
C:\Program Files (x86)\VLC Player GPU+\coinutil.dll (PUP.BitcoinMiner) -> Será deletado na próxima inicialização.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSense\SaveSenseUpdateVer.exe.vir (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe.vir (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\goopdate.dll.vir (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll.vir (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\psmachine.dll.vir (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\psuser.dll.vir (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLive.exe.vir (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveBroker.exe.vir (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveHandler.exe.vir (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveOnDemand.exe.vir (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SupTab.dll.vir (PUP.Optional.SupTab.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\AdwCleaner\Quarantine\C\Users\Anne Caroline\AppData\Local\genienext\nengine.dll.vir (PUP.Optional.NextLive.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\AdwCleaner\Quarantine\C\Users\Anne Caroline\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie2.2.0.zip.vir (PUP.Optional.NextLive.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\AdwCleaner\Quarantine\C\Users\Anne Caroline\AppData\Local\Mobogenie\Version\OldVersion\Mobogenie\nengine.dll.vir (PUP.Optional.NextLive.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\AdwCleaner\Quarantine\C\Users\Anne Caroline\AppData\Local\Temp\Desk365\eInstall\eInstall.exe.vir (PUP.Optional.Desk365.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\AdwCleaner\Quarantine\C\Users\Anne Caroline\AppData\Local\Temp\eIntaller\F1AA872EAE7F46e7867DF6095B25F346\eXQ.exe.vir (PUP.Optional.Wilsys.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\AdwCleaner\Quarantine\C\Users\Anne Caroline\AppData\Roaming\newnext.me\nengine.dll.vir (PUP.Optional.NextLive.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\AdwCleaner\Quarantine\C\Users\Anne Caroline\AppData\Roaming\SupTab\SupTab.dll.vir (PUP.Optional.SupTab.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Program Files\Update Software\Bundle.exe (PUP.Optional.Amonetize.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Program Files\Update Software\winmon.exe (Riskware.BitcoinMiner) -> Enviado para a Quarentena e deletado com sucesso.
C:\Program Files (x86)\VLC Player GPU+\namecoin-dns.exe (PUP.BitcoinMiner) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\130214_a.exe (PUP.Optional.SkyTech.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\130214_l.exe (PUP.Optional.CashBack) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\130214_p.exe (PUP.Optional.ToolBarInstaller.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\130214_y.exe (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\201213_d.exe (PUP.Optional.PCMega) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\201213_p.exe (PUP.Optional.ToolBarInstaller.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\201213_y.exe (PUP.Optional.SaveSense.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\aspcc.exe (PUP.Optional.InstallMonetizer.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\DownloadManager.exe (PUP.Optional.OutBrowse) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\ICReinstall_atube-catcher-384272-32-bits.exe (PUP.Optional.InstallCore) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\ICReinstall_revo-uninstaller-195-32-bits.exe (PUP.Optional.InstallCore) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\ICReinstall_wmv-converter-102-32-bits.exe (PUP.Optional.InstallCore) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\IminentSetup-1-.exe (PUP.Optional.Iminent.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\Mobogenie_Setup_2.1.37_505.exe (PUP.Optional.NextLive.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\presetup.exe (Trojan.BHO) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\Setup1.exe (PUP.Optional.WhiteSea) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\setupA9_.exe (PUP.Optional.NextLive.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\wupdater.exe (Trojan.BitMiner) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\fullpackage_temp1388857096\tmp\NewGdp.exe (PUP.Optional.WpManager.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\fullpackage_temp1393003403\package1.zip (PUP.Optional.SkyTech.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\fullpackage_temp1393003403\QQBrowserFrame.dll (PUP.Optional.SkyTech.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\fullpackage_temp1393003403\tmp\SupTab.exe (PUP.Optional.SupTab.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\fullpackage_temp1393075341\package1.zip (PUP.Optional.SkyTech.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\fullpackage_temp1393075341\QQBrowserFrame.dll (PUP.Optional.SkyTech.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\fullpackage_temp1393075341\tmp\desk365.exe (PUP.Optional.Desk365.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\fullpackage_temp1393075341\tmp\SupTab.exe (PUP.Optional.SupTab.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\is357113909\4326286_stp.EXE (PUP.Optional.Bundler) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\is357113909\4326234_stp\cor_ar_2013814171757_portaldosites.exe (PUP.Optional.Elex) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\is357113909\4326319_stp\bd.exe (PUP.Optional.BonanzaDeals.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\is701137889\10070696_stp.EXE (PUP.Optional.Spigot.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\is701137889\751321_stp.EXE (PUP.Optional.OpenCandy) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\is701137889\10070747_stp\bd.exe (PUP.Optional.BonanzaDeals.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\is701137889\2972417_stp\FindRightSetup.exe (PUP.Optional.FindRight.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\is701137889\633653_stp\bd.exe (PUP.Optional.BonanzaDeals.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\is701137889\751430_stp\bd.exe (PUP.Optional.BonanzaDeals.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\n3813\Launcher.exe (PUP.Optional.Amonetize) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\n3833\aartemis_1111-76a67d16.exe (PUP.Optional.Aartemis.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\n3833\Bizzybolt_2511-5ea0573c.exe (PUP.Optional.Bizzybolt.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Temp\n3833\Mobogenie_BR_1612.exe (PUP.Optional.NextLive.A) -> Enviado para a Quarentena e deletado com sucesso.
D:\$RECYCLE.BIN\S-1-5-21-1054709842-3106569860-2955332437-1000\$RQX29E5.exe (PUP.Optional.Bandoo) -> Enviado para a Quarentena e deletado com sucesso.
D:\Users\Anne Caroline\Downloads\828-aTubeCatcher.exe (PUP.Optional.Spigot.A) -> Enviado para a Quarentena e deletado com sucesso.
D:\Users\Anne Caroline\Downloads\Adobe_Photoshop_CS6.exe (PUP.Optional.OpenCandy) -> Enviado para a Quarentena e deletado com sucesso.
D:\Users\Anne Caroline\Downloads\Arquivo.exe (PUP.Optional.Midia) -> Enviado para a Quarentena e deletado com sucesso.
D:\Users\Anne Caroline\Downloads\AutoCAD 2010.exe (PUP.Optional.Solimba) -> Enviado para a Quarentena e deletado com sucesso.
D:\Users\Anne Caroline\Downloads\AutoCAD_2012_x86_(32bit)_._(Product_key_and_Xforce_Keygen).exe (PUP.Optional.OptimumInstaller.A) -> Enviado para a Quarentena e deletado com sucesso.
D:\Users\Anne Caroline\Downloads\PhotoScape_V3.6.5.exe (PUP.Optional.OpenCandy) -> Enviado para a Quarentena e deletado com sucesso.
D:\Users\Anne Caroline\Downloads\Setup (1).exe (PUP.Optional.DomalQ) -> Enviado para a Quarentena e deletado com sucesso.
D:\Users\Anne Caroline\Downloads\SoftonicDownloader_para_autocad.exe (PUP.Optional.Softonic.A) -> Enviado para a Quarentena e deletado com sucesso.
D:\Users\Anne Caroline\Downloads\UltimateCodec.exe (PUP.Optional.BundleInstaller.A) -> Enviado para a Quarentena e deletado com sucesso.
D:\Users\Anne Caroline\Downloads\VideoDownloadConvertCrxSetup.A4708625-FD58-4B40-9298-0C5A355755DB.exe (PUP.Optional.Mindspark) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\33.json (PUP.Optional.Awesomehp.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\uninstallDlg.xml (PUP.Optional.Awesomehp.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\UninstallManager.exe (PUP.Optional.Awesomehp.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\images\bg1.png (PUP.Optional.Awesomehp.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\images\button1.png (PUP.Optional.Awesomehp.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\images\checked.png (PUP.Optional.Awesomehp.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\images\close.png (PUP.Optional.Awesomehp.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\images\min.png (PUP.Optional.Awesomehp.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\images\Thumbs.db (PUP.Optional.Awesomehp.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Roaming\awesomehp\images\unchecked.png (PUP.Optional.Awesomehp.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\awesomehp.xml (PUP.Optional.Awesomehp.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Anne Caroline\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv2.crx (PUP.Optional.NewTab.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job (PUP.Optional.SaveSense) -> Enviado para a Quarentena e deletado com sucesso.
C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job (PUP.Optional.SaveSense) -> Enviado para a Quarentena e deletado com sucesso.

(fim)

2014/02/24 13:03:34 -0300 ANNECAROLINE-PC Anne Caroline MESSAGE Starting protection
2014/02/24 13:03:34 -0300 ANNECAROLINE-PC Anne Caroline MESSAGE Protection started successfully
2014/02/24 13:03:34 -0300 ANNECAROLINE-PC Anne Caroline MESSAGE Starting IP protection
2014/02/24 13:04:18 -0300 ANNECAROLINE-PC Anne Caroline MESSAGE IP Protection started successfully
2014/02/24 13:04:42 -0300 ANNECAROLINE-PC Anne Caroline MESSAGE Starting database refresh
2014/02/24 13:04:42 -0300 ANNECAROLINE-PC Anne Caroline MESSAGE Stopping IP protection
2014/02/24 13:04:56 -0300 ANNECAROLINE-PC Anne Caroline MESSAGE IP Protection stopped successfully
2014/02/24 13:05:01 -0300 ANNECAROLINE-PC Anne Caroline MESSAGE Database refreshed successfully
2014/02/24 13:05:01 -0300 ANNECAROLINE-PC Anne Caroline MESSAGE Starting IP protection
2014/02/24 13:05:08 -0300 ANNECAROLINE-PC Anne Caroline MESSAGE IP Protection started successfully
2014/02/24 13:15:18 -0300 ANNECAROLINE-PC Anne Caroline MESSAGE Executing scheduled update: Daily
2014/02/24 13:15:23 -0300 ANNECAROLINE-PC Anne Caroline MESSAGE Database already up-to-date

2014/02/25 09:58:48 -0300 ANNECAROLINE-PC (null) MESSAGE Executing scheduled update: Daily
2014/02/25 09:58:50 -0300 ANNECAROLINE-PC (null) MESSAGE Starting protection
2014/02/25 09:58:50 -0300 ANNECAROLINE-PC (null) MESSAGE Protection started successfully
2014/02/25 09:58:50 -0300 ANNECAROLINE-PC (null) MESSAGE Starting IP protection
2014/02/25 09:58:57 -0300 ANNECAROLINE-PC (null) MESSAGE IP Protection started successfully
2014/02/25 09:59:20 -0300 ANNECAROLINE-PC (null) MESSAGE Scheduled update executed successfully: database updated from version v2014.02.24.05 to version v2014.02.25.05
2014/02/25 09:59:20 -0300 ANNECAROLINE-PC (null) MESSAGE Starting database refresh
2014/02/25 09:59:21 -0300 ANNECAROLINE-PC (null) MESSAGE Stopping IP protection
2014/02/25 09:59:21 -0300 ANNECAROLINE-PC (null) MESSAGE IP Protection stopped successfully
2014/02/25 09:59:24 -0300 ANNECAROLINE-PC (null) MESSAGE Database refreshed successfully
2014/02/25 09:59:24 -0300 ANNECAROLINE-PC (null) MESSAGE Starting IP protection
2014/02/25 09:59:30 -0300 ANNECAROLINE-PC (null) MESSAGE IP Protection started successfully
2014/02/25 09:59:57 -0300 ANNECAROLINE-PC Anne Caroline DETECTION C:\Users\Anne Caroline\AppData\Local\Temp\UsageTemp.exe Trojan.Agent QUARANTINE
2014/02/25 12:05:12 -0300 ANNECAROLINE-PC (null) MESSAGE Starting protection
2014/02/25 12:05:12 -0300 ANNECAROLINE-PC (null) MESSAGE Protection started successfully
2014/02/25 12:05:12 -0300 ANNECAROLINE-PC (null) MESSAGE Starting IP protection
2014/02/25 12:05:20 -0300 ANNECAROLINE-PC (null) MESSAGE IP Protection started successfully

Tem 140 itens em quarentena

Anne_10 escreveu:Tem 140 itens em quarentena

Pode deixar eles na quarentena.
___________________________________________________

 Siga, por gentileza, as dicas destes tutoriais:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Na sua próxima resposta poste o log do Junkware Removal Tool que estará salvo em sua área de trabalho com o nome de JRT.txt juntamente com o log sc-cleaner.txt do Shortcut Cleaner.

Ficamos no aguardo.

Relatório JRT

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Professional x64
Ran by Anne Caroline on 25/02/2014 at 12:29:30,74
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-1054709842-3106569860-2955332437-1000\Software\Microsoft\Internet Explorer\Main\\Start Page



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{998745A3-2AE4-488D-8092-B98FB20A00C2}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{A18D16ED-27B2-4B83-B70C-15E73F099546}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{BEE7E029-5037-4DAD-A2DB-82E397AB1A44}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{C1424421-D274-491E-9D47-11C8D8CB5F9A}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\baidu
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\baidu



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Users\Anne Caroline\AppData\Roaming\getrighttogo"



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 25/02/2014 at 12:42:09,18
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Relatório sc-cleaner

Shortcut Cleaner 1.2.8 by Lawrence Abrams (Grinler)
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Copyright 2008-2014 BleepingComputer.com
More Information about Shortcut Cleaner can be found at this link:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Windows Version: Windows 7 Professional Service Pack 1
Program started at: 02/25/2014 01:30:46 PM.

Scanning for registry hijacks:

* No issues found in the Registry.

Searching for Hijacked Shortcuts:

Searching C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Windows\Start Menu\

Searching C:\ProgramData\Microsoft\Windows\Start Menu\

Searching C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\

Searching C:\Users\Public\Desktop\

Searching D:\Users\Anne Caroline\Desktop


0 bad shortcuts found.

Program finished at: 02/25/2014 01:30:50 PM
Execution time: 0 hours(s), 0 minute(s), and 4 seconds(s)

 Desative temporariamente seu antivírus para evitar conflitos.

Acesse este link abaixo e clique no primeiro botão da esquerda que é o botão Download Zoek.exe:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

*Clique com o botão direito do mouse no Zoek.exe e selecione [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

* Copie todo este texto destacado em vermelho que te passei e cole-o no espaço em branco do Zoek:

*Clique [Run Script]

*Durante o scan uma mensagem parecida com esta abaixo mostrando o progresso do escaneamento será apresentada. Aguarde o término...pode demorar!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

*Caso a reinicialização do PC seja solicitada, clique [OK]

* Poste o log do Zoek que estará em C:\zoek-results.txt em sua próxima resposta.

Zoek.exe v5.0.0.0 Updated 19-February-2014
Tool run by Anne Caroline on 25/02/2014 at 13:39:22,87.
Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: D:\Users\Anne Caroline\Downloads\zoek (1).exe [Scan all users] [Script inserted]

==== System Restore Info ======================

25/02/2014 13:42:09 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\ANNECA~1\AppData\Roaming\Mozilla\Firefox\Profiles\r9dqlpuj.default-1393249105431\prefs.js:
user_pref("browser.startup.homepage", "[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Added to C:\Users\ANNECA~1\AppData\Roaming\Mozilla\Firefox\Profiles\r9dqlpuj.default-1393249105431\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

ProfilePath: C:\Users\ANNECA~1\AppData\Roaming\Mozilla\Firefox\Profiles\r9dqlpuj.default-1393249105431

user.js not found
---- Lines browser.startup.page removed from prefs.js ----
user_pref("browser.startup.page", 3);
---- FireFox user.js and prefs.js backups ----

prefs_022014_1356_.backup

==== Deleting Files \ Folders ======================

C:\Users\Anne Caroline\daemonprocess.txt deleted
C:\Users\Anne Caroline\.android deleted
C:\PROGRA~3\FileSplitUpLoad.dll deleted
C:\Users\Anne Caroline\AppData\Local\cache deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"quick_start@gmail.com"="C:\Users\Anne Caroline\AppData\Roaming\Mozilla\Firefox\Profiles\hfjmdxa1.default\extensions\quick_start@gmail.com" []

==== Firefox Extensions ======================

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Anne Caroline\AppData\Roaming\Mozilla\Firefox\Profiles\r9dqlpuj.default-1393249105431
E5AF72B7353FF8D431A7C463A4229524 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll - Shockwave Flash


==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
pelmeidfhdlhlbjimpabfcbnnojbboma - C:\Users\Anne Caroline\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv2.crx[]

Google Docs - Anne Caroline\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake
Google Drive - Anne Caroline\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf
YouTube - Anne Caroline\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Google Search - Anne Caroline\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
Google Wallet - Anne Caroline\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Gmail - Anne Caroline\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Reset Google Chrome ======================

C:\Users\Anne Caroline\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Anne Caroline\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================

HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\quick_start@gmail.com deleted successfully

==== shortcuts on Users Desktops ======================

C:\Users\Anne Caroline\Desktop\C-D.lnk - C:\Program Files (x86)\Cheating-Death\cdeath.exe
C:\Users\Anne Caroline\Desktop\Condition Zero Deleted Scenes.lnk - C:\Valve\Condition Zero\czero.exe -game czeror
C:\Users\Anne Caroline\Desktop\Condition Zero.lnk - C:\Valve\Condition Zero\czero.exe
C:\Users\Anne Caroline\Desktop\Counter-Strike Source.lnk - C:\Program Files (x86)\Counter-Strike Source\hl2.exe -steam -game cstrike -console
C:\Users\Anne Caroline\Desktop\Dedicated Server.lnk - C:\Program Files (x86)\Counter-Strike 1.6 2\hlds.exe -nomaster -game cstrike -insecure
C:\Users\Anne Caroline\Desktop\EVEREST Home Edition.lnk - C:\Program Files (x86)\Lavalys\EVEREST Home Edition\everest.exe
C:\Users\Anne Caroline\Desktop\Play online using Steam.lnk - C:\Valve\Condition Zero\steaminstall.exe

==== shortcuts on All Users Desktop ======================

C:\Users\Public\Desktop\Adobe Creative Cloud.lnk - C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe --appletID=HomePanel_BL --appletVersion=1.0
C:\Users\Public\Desktop\aTube Catcher.lnk - C:\Program Files (x86)\DsNET Corp\aTube Catcher 2.0\yct.exe
C:\Users\Public\Desktop\AutoCAD 2012 - English.lnk - C:\Program Files (x86)\Autodesk\AutoCAD 2012 - English\acad.exe
C:\Users\Public\Desktop\Autodesk DWF Viewer.lnk - C:\Program Files (x86)\Autodesk\Autodesk DWF Viewer\DWFViewer.exe
C:\Users\Public\Desktop\Counter-Strike 1.6.lnk - C:\Program Files (x86)\Counter-Strike 1.6\cstrike.exe
C:\Users\Public\Desktop\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Public\Desktop\Half-Life.lnk - C:\Program Files (x86)\Counter-Strike 1.6\hl.exe
C:\Users\Public\Desktop\Inventor Fusion 2012.lnk - C:\Program Files (x86)\Autodesk\Inventor Fusion 2012\Inventor Fusion.exe
C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\Users\Public\Desktop\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==== shortcuts in Users Start Menu ======================

C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk - C:\Program Files\Internet Explorer\iexplore.exe

==== shortcuts in All Users Start Menu ======================

C:\ProgramData\Microsoft\Windows\Start Menu\Autodesk DWF Viewer.lnk - C:\Program Files (x86)\Autodesk\Autodesk DWF Viewer\DWFViewer.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk\Autodesk DWF Viewer.lnk - C:\Program Files (x86)\Autodesk\Autodesk DWF Viewer\DWFViewer.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk\Inventor Fusion 2012.lnk - C:\Windows\Installer\{FFF5619F-6669-4EC5-A85E-9994F70A9E5D}\AppIcon.Exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk\AutoCAD 2012 - English\Attach Digital Signatures.lnk - C:\Program Files (x86)\Autodesk\AutoCAD 2012 - English\AcSignApply.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk\AutoCAD 2012 - English\AutoCAD 2012 - English.lnk - C:\Windows\Installer\{5783F2D7-A001-0409-0102-0060B0CE6BBA}\Acad162_icon.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk\AutoCAD 2012 - English\Batch Standards Checker.lnk - C:\Program Files (x86)\Autodesk\AutoCAD 2012 - English\DwgCheckStandards.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk\AutoCAD 2012 - English\License Transfer Utility.lnk - C:\Program Files (x86)\Common Files\Autodesk Shared\ADLM\R4\LTU.exe 001D1 2012.0.0.F -d SA -l en-US
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk\AutoCAD 2012 - English\Reference Manager.lnk - C:\Program Files (x86)\Autodesk\AutoCAD 2012 - English\AdRefMan.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk\AutoCAD 2012 - English\Reset Settings to Default.lnk - C:\Program Files (x86)\Autodesk\AutoCAD 2012 - English\AdMigrator.exe /reset
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk\AutoCAD 2012 - English\Migrate Custom Settings\Export AutoCAD 2012 Settings.lnk - C:\Program Files (x86)\Autodesk\AutoCAD 2012 - English\AdMigrator.exe /e
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk\AutoCAD 2012 - English\Migrate Custom Settings\Import AutoCAD 2012 Settings.lnk - C:\Program Files (x86)\Autodesk\AutoCAD 2012 - English\AdMigrator.exe /i
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk\AutoCAD 2012 - English\Migrate Custom Settings\Migrate From a Previous Release.lnk - C:\Program Files (x86)\Autodesk\AutoCAD 2012 - English\AdMigrator.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Desinstalar Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware Help.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.chm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\chameleon.chm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Retro PC Calculator\Retro PC Calculator.lnk - C:\Program Files\Retro PC Calculator\calc.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Update Software\Update Software.lnk - C:\Program Files\Update Software\ntvmon32.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP\ZHPDiag.lnk - C:\Program Files (x86)\ZHPDiag\ZHPhep.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP\ZHPFix.lnk - C:\Program Files (x86)\ZHPDiag\ZHPFix\ZHPhep.exe

==== shortcuts in Quick Launch ======================

C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PhotoScape.lnk - C:\Program Files (x86)\PhotoScape\PhotoScape.exe
C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk - C:\Windows\explorer.exe
C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk - C:\Program Files (x86)\Windows Media Player\wmplayer.exe /prefetch:1
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -

==== Reset IE Proxy ======================

Value(s) before fix:
"ProxyOverride"=""
"ProxyEnable"=dword:00000000

Value(s) after fix:
"ProxyEnable"=dword:00000000

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Anne Caroline\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Anne Caroline\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Anne Caroline\AppData\Local\Mozilla\Firefox\Profiles\hfjmdxa1.default\Cache emptied successfully
C:\Users\Anne Caroline\AppData\Local\Mozilla\Firefox\Profiles\r9dqlpuj.default-1393249105431\Cache emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Anne Caroline\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=45 folders=5 1405610 bytes)

==== Empty Temp Folders ======================

C:\Users\Anne Caroline\AppData\Local\Temp will be emptied at reboot
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\USURIO~1\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Reset Hosts File ======================

Hosts File Reset Successfully

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\ANNECA~1\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 25/02/2014 at 14:10:17,89 ======================

 Vá no menu: Iniciar > Todos os programas > ZHP > Abra o ZHPDiag.

|- Clique "SEARCH" ou "PESQUISAR" e aguarde a conclusão!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
 
|- Clique OK e, ao concluir, poste o relatório ZHPDiag.txt

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

~ Relatório do ZHPDiag v2014.2.23.20 - Nicolas Coolman (23/02/2014)
~ Iniciado por Anne Caroline (25/02/2014 14:17:48)
~ Endereço do Website : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Fóruns de suporte gratuito para desinfecção : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Tradução pelo utilizador
~ Estatuto da versão :
~ Lista Branca : Ativado pelo programa
~ Elevação dos Privilégios : OK
~ Controle de Conta de Utilizador : Deactivate by user


---\\ Navegadores Internet
MSIE: Internet Explorer v11.0.9600.16518
MFIE: Mozilla Firefox 27.0.1
GCIE: Google Chrome v33.0.1750.117 (Defaut)

---\\ Informações sobre os produtos Windows
~ Langage: Portugais
Windows 7 Professional, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK

---\\ Softwares de proteçao do sistema
Malwarebytes Anti-Malware versão 1.75.0.1300
Microsoft Security Client v4.4.0304.0
Windows Defender W7

---\\ Softwares d'optimização do sistema

---\\ Softwares de partilha do PeerToPeer (P2P)

---\\ Monitoramento dos softwares
Adobe Flash Player 11 Plugin
Java 7 Update 45

---\\ Informações sobre o sistema
~ Processor: Intel64 Family 6 Model 15 Stepping 13, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 2039 MB (21% free)
System Restore: Activé (Enable)
System drive C: has 54 GB (53%) free of 101 GB

---\\ Modo de conexão ao sistema
~ Computer Name: ANNECAROLINE-PC
~ User Name: Anne Caroline
~ All Users Names: Convidado, Anne Caroline, Administrador,
~ Unselected Option: 045,061,O62,065,066,080,O82,089
Logged in as Administrator

---\\ As variáveis de ambiente
~ System Unit : C:\
~ %AppZHP% : C:\Users\Anne Caroline\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Anne Caroline\AppData\Roaming\
~ %Desktop% : D:\Users\Anne Caroline\Desktop\
~ %Favorites% : D:\Users\Anne Caroline\Favorites\
~ %LocalAppData% : C:\Users\Anne Caroline\AppData\Local\
~ %StartMenu% : C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumeração das unidades dos discos
A: Floppy drive, Flash card reader, USB Key (Not Inserted)
C: Hard drive, Flash drive, Thumb drive (Free 54 Go of 101 Go)
D: Hard drive, Flash drive, Thumb drive (Free 79 Go of 132 Go)
E: CD-ROM drive (Not Inserted)



---\\ Estado do Centro de Segurança do Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowMyGames: Modified
~ Security Center: 49 Legitimates Filtered in 00mn 00s



---\\ Pesquisa particular de ficheiros genéricos
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Windows Explorer.) (.25/02/2011 - 03:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Aplicativo de Inicialização do Windows.) (.13/07/2009 - 22:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.263B6E451526A90FF8B1CEC759F22956] - (.Microsoft Corporation - Internet Extensions para Win32.) (.06/02/2014 - 06:24:52.) -- C:\Windows\System32\wininet.dll [2334208]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Aplicativo de Logon do Windows.) (.21/11/2010 - 00:24:29.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Biblioteca de Licenciamento de Software.) (.21/11/2010 - 00:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.27/09/2013 - 22:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.13/07/2009 - 22:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 20:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 00:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Driver de porta i8042.) (.13/07/2009 - 20:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.13/07/2009 - 21:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.26/04/2011 - 23:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 00:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Driver do Sistema de Arquivos NT.) (.12/04/2013 - 11:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Driver de porta paralela.) (.13/07/2009 - 21:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 00:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.1B6163C503398B23FF8B939C67747683] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.21/11/2010 - 00:25:07.) -- C:\Windows\system32\Drivers\rdpdr.sys [165888]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.13/07/2009 - 21:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 00:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 02s



---\\ Estatuto dos ficheiros ocultos (Oculto/Total)
~ Mes images (My Pictures) : 2/217
~ Mes musiques (My Musics) : 3/1458
~ Mes Videos (My Videos) : 1/13
~ Mes Favoris (My Favorites) : 1/22
~ Mes Documents (My Documents) : 3/30223
~ Mon Bureau (My Desktop) : 1/186
~ Menu demarrer (Programs) : 1/34
~ Hidden Files: Scanned in 00mn 22s



---\\ Processos lançados
[MD5.D1D5DAB39DCB4BE0359943738D87409B] - (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [532040] [PID.2420]
[MD5.BD490E84729F67ED40B216E9DF68A09A] - (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Anne Caroline\AppData\Roaming\BitTorrent\BitTorrent.exe [900696] [PID.288] =>P2P.BitTorrent
[MD5.6DEE6998782DA6D47769EF2033DBD278] - (.Analog Devices, Inc. - SMax4PNP.) -- C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe [1302528] [PID.2592]
[MD5.499FFEFFE26AB9AC26BE4E55B9CB8DC4] - (.Analog Devices, Inc. - SoundMAX Audio Settings (32-bit).) -- C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe [3637248] [PID.2108]
[MD5.D5CA1D97E67216774B916179BE3C2C21] - (.Adobe Systems Incorporated - Adobe Creative Cloud.) -- C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2237328] [PID.864]
[MD5.FB1A303207C1124C2B61A50E5A32AC21] - (.No owner - DivX Update.) -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968] [PID.2244]
[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336] [PID.2640]
[MD5.3B9DFE92CAEF65BBA864470065F8FFEE] - (...) -- C:\Program Files (x86)\VLC Player GPU+\UsageLog.exe [1330400] [PID.2740]
[MD5.D3242FF9E28EAFC77EACB2B8956724C3] - (.Adobe Systems Incorporated - Adobe CEP Service Manager.) -- C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe [1039240] [PID.3244]
[MD5.6E6656C6618C4B0B000267D9AF9EF743] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [859464] [PID.3112]
[MD5.148E6593136BA6CF2BF264FF22EBB817] - (.No owner - Core Sync.) -- C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe [4579696] [PID.3848]
[MD5.BDC1CCF8458A1FD4615C52D5555112F3] - (.Adobe Systems Incorporated - Adobe CEF Helper.) -- C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe [395120] [PID.4220]
[MD5.42FEDBCB3ED926F6F529E0FDDF750BE0] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8339968] [PID.4492]
~ Processes Running: Scanned in 00mn 02s



---\\ Google Chrome, Arranque,Pesquisa,Extensões (G0,G1,G2)
C:\Users\Anne Caroline\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [ahfgeienlihckogmohjhadlkjgocpleb] Loja v.0.2 (Activé)
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)
~ Google Browser: 15 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Arranque, Pesquisa, URLSearchHook( gancho de URL), Phishing (R0,R1,R3,R4)
R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = preserve
~ IE Browser: 18 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Gestão do Proxy (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
~ Proxy management: Scanned in 00mn 00s



---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Redireção do ficheiro Hosts (01)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 0



---\\ Browser Helper Objects do navegador (02)
O2 - BHO: InjectScript [64Bits] - {F6C07882-D703-4DD5-905A-2C4E815A5066} . (.WW3, LLC - Shopping Suggestion..) -- C:\Users\Anne Caroline\AppData\Roaming\D394D188-BAC7-4e03-8FAF-389A4D7EC6F4\Shopping Suggestion.dll
~ BHO: 7 Legitimates Filtered in 00mn 00s



---\\ Outras conexões do utilizador (04)
O4 - GS\Desktop [Public]: aTube Catcher.lnk . (.DsNET - aTube Catcher to download and convert video.) -- C:\Program Files (x86)\DsNET Corp\aTube Catcher 2.0\yct.exe
O4 - GS\Desktop [Public]: Autodesk DWF Viewer.lnk . (.Autodesk, Inc. - Autodesk DWF Viewer.) -- C:\Program Files (x86)\Autodesk\Autodesk DWF Viewer\DWFViewer.exe
O4 - GS\Desktop [Public]: Counter-Strike 1.6.lnk . (.DigitalZone - Counter-Strike Launcher.) -- C:\Program Files (x86)\Counter-Strike 1.6\cstrike.exe
O4 - GS\Desktop [Public]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [Public]: Half-Life.lnk . (.Valve - Half-Life Launcher.) -- C:\Program Files (x86)\Counter-Strike 1.6\hl.exe
O4 - GS\Desktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Program [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\QuickLaunch [Anne Caroline]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Anne Caroline]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch [Anne Caroline]: PhotoScape.lnk . (...) -- C:\Program Files (x86)\PhotoScape\PhotoScape.exe
O4 - GS\TaskBar [Anne Caroline]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O4 - GS\TaskBar [Anne Caroline]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\TaskBar [Anne Caroline]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O4 - GS\Program [Anne Caroline]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [Anne Caroline]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\SendTo [Anne Caroline]: AnySend.lnk . (...) -- C:\Program Files (x86)\AnySend\AnySendUI.exe (.not file.)
O4 - GS\Desktop [Anne Caroline]: C-D.lnk . (...) -- C:\Program Files (x86)\Cheating-Death\cdeath.exe (.not file.)
O4 - GS\Desktop [Anne Caroline]: Condition Zero Deleted Scenes.lnk . (...) -- C:\Valve\Condition Zero\czero.exe (.not file.)
O4 - GS\Desktop [Anne Caroline]: Condition Zero.lnk . (...) -- C:\Valve\Condition Zero\czero.exe (.not file.)
O4 - GS\Desktop [Anne Caroline]: Counter-Strike Source.lnk . (...) -- C:\Program Files (x86)\Counter-Strike Source\hl2.exe (.not file.)
O4 - GS\Desktop [Anne Caroline]: Dedicated Server.lnk . (...) -- C:\Program Files (x86)\Counter-Strike 1.6 2\hlds.exe (.not file.)
O4 - GS\Desktop [Anne Caroline]: EVEREST Home Edition.lnk . (...) -- C:\Program Files (x86)\Lavalys\EVEREST Home Edition\everest.exe (.not file.)
~ Global Startup: 75 Legitimates Filtered in 00mn 02s



---\\ Aplicações iniciadas por registo & pastas (04)
O4 - GS\Startup [Anne Caroline]: Microsoft SharePoint Workspace.lnk . (...) -- C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.exe (.not file.)
O4 - HKLM\..\Run: [BCSSync] . (.Microsoft Corporation - Microsoft Office 2010 component.) -- C:\Program Files\Microsoft Office\Office14\BCSSync.exe =>.Microsoft Corporation
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [AdobeAAMUpdater-1.0] . (.Adobe Systems Incorporated - Adobe Updater Startup Utility.) -- C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- C:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [OfficeSyncProcess] . (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files\Microsoft Office\Office14\MSOSYNC.exe
O4 - HKCU\..\Run: [Akamai NetSession Interface] C:\Users\Anne Caroline\AppData\Local\Akamai\netsession_win.exe (.not file.)
O4 - HKCU\..\Run: [BitTorrent] . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Anne Caroline\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent
O4 - HKLM\..\Wow6432Node\Run: [SoundMAXPnP] . (.Analog Devices, Inc. - SMax4PNP.) -- C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Wow6432Node\Run: [SoundMAX] . (.Analog Devices, Inc. - SoundMAX Audio Settings (32-bit).) -- C:\Program Files (x86)\Analog Devices\SoundMAX\SoundMAX.exe
O4 - HKLM\..\Wow6432Node\Run: [AdobeCS5ServiceManager] . (.Adobe Systems Incorporated - Adobe CS5 Service Manager.) -- C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe
O4 - HKLM\..\Wow6432Node\Run: [Adobe Creative Cloud] . (.Adobe Systems Incorporated - Adobe Creative Cloud.) -- C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
O4 - HKLM\..\Wow6432Node\Run: [DivXMediaServer] . (.DivX, LLC - DivX DLNA Media Server.) -- C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
O4 - HKLM\..\Wow6432Node\Run: [DivXUpdate] . (.No owner - DivX Update.) -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKLM\..\Wow6432Node\Run: [UsageLoader] . (...) -- C:\Program Files (x86)\VLC Player GPU+\UsageLog.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-1054709842-3106569860-2955332437-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKUS\S-1-5-21-1054709842-3106569860-2955332437-1000\..\Run: [OfficeSyncProcess] . (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files\Microsoft Office\Office14\MSOSYNC.exe
O4 - HKUS\S-1-5-21-1054709842-3106569860-2955332437-1000\..\Run: [Akamai NetSession Interface] C:\Users\Anne Caroline\AppData\Local\Akamai\netsession_win.exe (.not file.)
O4 - HKUS\S-1-5-21-1054709842-3106569860-2955332437-1000\..\Run: [BitTorrent] . (.BitTorrent Inc. - BitTorrent.) -- C:\Users\Anne Caroline\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent
~ Application: Scanned in 00mn 00s



---\\ Boutões da barra de ferramentas principal do Internet Explorer (09)
O9 - Extra button: &Enviar para o OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\MICROS~1\Office14\ONBttnIE.dll =>.Microsoft Corporation
O9 - Extra button: &Anotações Vinculadas do OneNote [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\MICROS~1\Office14\ONBTTN~1.dll =>.Microsoft Corporation
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Alteração Dominio/Clientes DNS (017)
O17 - HKLM\System\CCS\Services\Tcpip\..\{760FC29A-F301-4DDD-B640-B33C62CEE3FE}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{760FC29A-F301-4DDD-B640-B33C62CEE3FE}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{760FC29A-F301-4DDD-B640-B33C62CEE3FE}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s



---\\ Protocolo adicional (018)
O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visualizador de HTML da Microsoft (R).) -- C:\Windows\System32\mshtml.dll
O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s



---\\ Lista dos serviços NT não Microsoft e não desativados (023)
O23 - Service: AnySend (AnySendService) . (...) - C:\Program Files (x86)\AnySend\AnySendSVC.exe (.not file.)
O23 - Service: Baidu AntiVirus Service (bavsvc) . (...) - C:\Program Files (x86)\Baidu Security\Baidu Antivirus\bavsvc.exe (.not file.) =>Adware.BDSearch
O23 - Service: Baidu Hips Service (bhipssvc) . (...) - C:\Program Files (x86)\Baidu Security\Baidu Antivirus\bhipssvc.exe (.not file.) =>Adware.BDSearch
O23 - Service: (MBAMService) . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
~ Services: 6 Legitimates Filtered in 00mn 13s



---\\ Tarefas planificadas automaticamente (039)
[MD5.00000000000000000000000000000000] [APT] [{005D94AD-1F10-4BCD-92BF-05340C872545}] (...) -- E:\setup.exe (.not file.) [0]
[MD5.3A22895F1893A6E218F516FD7DEA87CD] [APT] [{6F5D1072-A951-4B1E-A9D2-01C6F7AD9DE5}] (...) -- D:\Users\Anne Caroline\Downloads\Counter-Strike 1.6 No Steam\Counter-Strike 1.6 No Steam\Counter-Strike_1.6_v28.exe [321562153]
[MD5.00000000000000000000000000000000] [APT] [{B3E18EE0-8C0C-4ADD-BEC6-33DF59753BE1}] (...) -- C:\Users\Anne Caroline\AppData\Roaming\awesomehp\UninstallManager.exe (.not file.) [0] =>PUP.Awesomehp
~ Scheduled Task: 10 Legitimates Filtered in 00mn 16s



---\\ Drivers lançados ao arranque do sistema (041)
O41 - Driver: (Bfilter) . (.Baidu, Inc. - Baidu Antivirus Minifilter Driver.) - C:\Windows\system32\drivers\Bfilter.sys =>Adware.BDSearch
O41 - Driver: (Bfmon) . (.Baidu, Inc. - Baidu FS Monitor Driver.) - C:\Windows\system32\drivers\Bfmon.sys =>Adware.BDSearch
O41 - Driver: (Bprotect) . (.Baidu, Inc. - Baidu Antivirus Selfprotect Driver.) - C:\Windows\system32\drivers\Bprotect.sys =>Adware.BDSearch
~ Drivers: 72 Legitimates Filtered in 00mn 21s



---\\ Software instalados (042)
O42 - Logiciel: Patch v23 versão 2013 - (.SiteCS.) [HKLM][64Bits] -- {C1C3140D-730D-4176-94EC-F1706A929776}_is1
O42 - Logiciel: sXe Injected - (.Alejandro Cortés.) [HKLM][64Bits] -- sXe Injected
~ Logic: 23 Legitimates Filtered in 00mn 01s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\41133InstEnd]
[HKCU\Software\Baidu Security] =>Adware.BDSearch
[HKCU\Software\HiSoft]
[HKCU\Software\sXe Injected]
[HKLM\Software\HKBS]
[HKLM\Software\Wow6432Node\Baidu Security] =>Adware.BDSearch
[HKLM\Software\Wow6432Node\Baidu_Drp_pos] =>Adware.BDSearch
[HKLM\Software\Wow6432Node\UnitedAdmins]
[HKLM\Software\Wow6432Node\hosts]
[HKLM\Software\Wow6432Node\sXe_Injected]
~ Key Software: 238 Legitimates Filtered in 00mn 01s



---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 24/09/2013 - 12:25:09 - [102,436] ----D C:\Program Files (x86)\Baidu Security =>Adware.BDSearch
O43 - CFD: 30/10/2013 - 19:04:03 - [1,133] ----D C:\Program Files (x86)\Descrypt
O43 - CFD: 22/02/2014 - 10:27:34 - [0] ----D C:\Program Files (x86)\RBM
O43 - CFD: 08/10/2013 - 11:54:14 - [10,077] ----D C:\Program Files (x86)\sXe Injected
O43 - CFD: 09/09/2013 - 11:37:38 - [103,014] ----D C:\ProgramData\Baidu Security =>Adware.BDSearch
O43 - CFD: 09/09/2013 - 11:37:49 - [5,594] ----D C:\Users\Anne Caroline\AppData\Roaming\Baidu Security =>Adware.BDSearch
O43 - CFD: 13/01/2014 - 20:14:42 - [0,132] ----D C:\Users\Anne Caroline\AppData\Roaming\D394D188-BAC7-4e03-8FAF-389A4D7EC6F4
O43 - CFD: 07/10/2013 - 15:12:49 - [0,002] ----D C:\Users\Anne Caroline\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\sXe Injected
~ Program Folder: 136 Legitimates Filtered in 00mn 36s



---\\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044)
O44 - LFC:[MD5.2465EBC8CD6E412CDC1AB9FEF40BCAE6] - 18/02/2014 - 12:03:08 ---A- . (...) -- C:\Windows\win.ini [478]
O44 - LFC:[MD5.BF5BFBDB23149D82B9845CB4113C89E5] - 21/02/2014 - 15:22:19 ---A- . (...) -- C:\Windows\DirectX.log [196071]
O44 - LFC:[MD5.1639FB3BC6971821A75D8E7835109DEB] - 21/02/2014 - 16:45:31 ---A- . (...) -- C:\Windows\System32\prfc0416.dat [168208]
O44 - LFC:[MD5.9068C8FA7187D2B84F2051BCF9B30FD3] - 21/02/2014 - 16:45:31 ---A- . (...) -- C:\Windows\System32\prfh0416.dat [767222]
O44 - LFC:[MD5.B993247DC1E9465076AC8AD0A2DA7DBA] - 22/02/2014 - 19:28:34 ---A- . (...) -- C:\Windows\iis7.log [24488]
O44 - LFC:[MD5.CC7AA7B42CF418FC3D926913490048F8] - 25/02/2014 - 13:38:57 ---A- . (...) -- C:\Windows\zoek-delete.exe [24064]
O44 - LFC:[MD5.897E9349412D79FA5BADC05185DEEB28] - 25/02/2014 - 14:10:17 ---A- . (...) -- C:\zoek-results.log [17802]
~ Files: 63 Legitimates Filtered in 00mn 08s



---\\ Operações e funções ao arranque do Windows Explorer (046)
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook [64Bits] - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~1\Office14\GROOVEEX.DLL
~ ShellExecuteHooks: Scanned in 00mn 00s



---\\ Chave do registo Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{ec94d6ae-837b-11e3-9da9-001bfcd9b5ad}\AutoRun\command. (...) -- F:\SISetup.exe (.not file.)
~ Keys: Scanned in 00mn 00s



---\\ Enumeração das chaves do registo PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 18 Legitimates Filtered in 00mn 00s



---\\ Enumeração das chaves do registo PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 4 Legitimates Filtered in 00mn 00s



---\\ Lista dos drivers do sistema (SDL) (O58)
O58 - SDL:[MD5.96B79B8DDCD2963691186DCDD46C134B] - 03/01/2008 - 09:57:40 ---A- . (.Analog Devices, Inc. - High Definition Audio Function Driver.) -- C:\Windows\System32\Drivers\ADIHdAud.sys [463360]
O58 - SDL:[MD5.03B7145C889603537E9FFEABB1AD1089] - 29/03/2005 - 01:30:38 ---A- . (.No owner - ATK0110 ACPI Utility.) -- C:\Windows\System32\Drivers\ASACPI.sys [8192]
O58 - SDL:[MD5.37F5CDA64FC515B3072531C1187EDCCA] - 21/01/2014 - 11:14:40 ---A- . (.Baidu, Inc. - Baidu Antivirus Minifilter Driver.) -- C:\Windows\System32\Drivers\Bfilter.sys [52032] =>Adware.BDSearch
O58 - SDL:[MD5.DFC1681F6645CB2AEA83897588F05362] - 21/01/2014 - 11:14:50 ---A- . (.Baidu, Inc. - Baidu FS Monitor Driver.) -- C:\Windows\System32\Drivers\Bfmon.sys [34624] =>Adware.BDSearch
O58 - SDL:[MD5.F4C1984178175ACE4A75BE23059C3E0A] - 21/01/2014 - 07:01:36 ---A- . (.Baidu, Inc. - Baidu Antivirus Selfprotect Driver.) -- C:\Windows\System32\Drivers\Bprotect.sys [128992] =>Adware.BDSearch
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 13/07/2009 - 22:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 17:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 13/07/2009 - 22:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
~ Drivers: 18 Legitimates Filtered in 00mn 05s



---\\ Lista das ferramentas de remoção de vírus (LAT) (063)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Lista dos serviços Legacy du registo (064)
O64 - Services: CurCS - 21/01/2014 - C:\Windows\system32\drivers\Bfilter.sys (Bfilter) .(.Baidu, Inc. - Baidu Antivirus Minifilter Driver.) - LEGACY_BFILTER =>Adware.BDSearch
O64 - Services: CurCS - 21/01/2014 - C:\Windows\system32\drivers\Bfmon.sys (Bfmon) .(.Baidu, Inc. - Baidu FS Monitor Driver.) - LEGACY_BFMON =>Adware.BDSearch
O64 - Services: CurCS - 21/01/2014 - C:\Windows\system32\drivers\Bprotect.sys (Bprotect) .(.Baidu, Inc. - Baidu Antivirus Selfprotect Driver.) - LEGACY_BPROTECT =>Adware.BDSearch
O64 - Services: CurCS - 04/04/2013 - C:\Windows\system32\drivers\mbam.sys (MBAMProtector) .(.Malwarebytes Corporation - Malwarebytes Anti-Malware.) - LEGACY_MBAMPROTECTOR
O64 - Services: CurCS - 10/06/2009 - C:\Windows\System32\Drivers\secdrv.sys (secdrv) .(.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) - LEGACY_SECDRV
~ Legacy: 120 Legitimates Filtered in 00mn 00s



---\\ Associações Shell Spawning (O67)
O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 12 Legitimates Filtered in 00mn 00s



---\\ Menu de inicialização Internet (068)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Mozilla Corporation - Firefox.) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s



---\\ Pesquisa de infeção nos navegadores da Internet (SBI) (069)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} [DefaultScope] - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Keys: Scanned in 00mn 00s



---\\ Pesquisa adicional à raiz do sistema (radicular) (SPRF) (O84)
[MD5.C31171147A91CE1950B0F7EFC5F5C04C] [SPRF][24/09/2013] (...) -- D:\Users\Anne Caroline\Desktop\CoD4MWDemoSetup.exe [1473748992]
[MD5.412E0A70AB92DDB10A8F8EEEBA386C26] [SPRF][12/02/2014] (...) -- D:\Users\Anne Caroline\Desktop\installer.exe [363080]
~ Files: 3 Legitimates Filtered in 00mn 48s



---\\ Lista das exceções do FireWall (FirewallRules) (O87)
O87 - FAEL: "{3C69B815-311E-41C1-A540-02896FD4301B}" |In - None - P17 - TRUE | .(...) -- C:\Program Files (x86)\WinZip Driver Updater\winzipdu.exe (.not file.)
O87 - FAEL: "TCP Query User{EC411A2C-9E13-4A61-AE50-32BE6A74F462}C:\users\anne caroline\appdata\local\akamai\netsession_win.exe" |In - Private - P6 - TRUE | .(...) -- C:\users\anne caroline\appdata\local\akamai\netsession_win.exe (.not file.)
O87 - FAEL: "UDP Query User{A0F8112E-ECBC-4A53-A006-E3C7CC346F0A}C:\users\anne caroline\appdata\local\akamai\netsession_win.exe" |In - Private - P17 - TRUE | .(...) -- C:\users\anne caroline\appdata\local\akamai\netsession_win.exe (.not file.)
~ Firewall: 209 Legitimates Filtered in 00mn 02s



---\\ Estado general dos serviços não Microsoft (EGS) (SR=Executados, SS=Parados)
SS - | Auto 10/07/1658 0 | (AnySendService) . (...) - C:\Program Files (x86)\AnySend\AnySendSVC.exe
SS - | Auto 10/07/1658 0 | (bavsvc) . (...) - C:\Program Files (x86)\Baidu Security\Baidu Antivirus\bavsvc.exe =>Adware.BDSearch
SS - | Auto 10/07/1658 0 | (bhipssvc) . (...) - C:\Program Files (x86)\Baidu Security\Baidu Antivirus\bhipssvc.exe =>Adware.BDSearch
SS - | Demand 21/02/2014 1431888 | (FLEXnet Licensing Service 64) . (.Flexera Software, Inc..) - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
SS - | Auto 16/02/2014 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 16/02/2014 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 18/02/2014 118896 | (MozillaMaintenance) . (.Mozilla Foundation.) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
SS - | Demand 13/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

SR - | Auto 19/10/2007 89600 | (AEADIFilters) . (.Andrea Electronics Corporation.) - C:\Windows\System32\AEADISRV.exe
SR - | Auto 02/02/2011 18656 | (Autodesk Content Service) . (...) - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
SR - | Auto 07/04/2010 127800 | (HPSIService) . (.HP.) - C:\Windows\system32\HPSIsvc.exe
SR - | Auto 04/04/2013 418376 | (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
SR - | Auto 04/04/2013 701512 | (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
SR - | Auto 23/10/2013 23808 | (MsMpSvc) . (.Microsoft Corporation.) - C:\Program Files\Microsoft Security Client\MsMpEng.exe
SR - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 13/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

~ Services: Scanned in 00mn 18s



---\\ Scâner Aditional (088)
Database Version : 13031 - (23/02/2014)
Clés trouvées (Keys found) : 4
Valeurs trouvées (Values found) : 1
Dossiers trouvés (Folders found) : 3
Fichiers trouvés (Files found) : 4

[HKLM\SYSTEM\CurrentControlSet\Services\bavsvc] =>Adware.BDSearch^
[HKLM\SYSTEM\CurrentControlSet\Services\bhipssvc] =>Adware.BDSearch^
[HKLM\Software\Wow6432Node\hosts] =>PUP.CrossRider
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus] =>Adware.BDSearch
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:BitTorrent =>P2P.BitTorrent^
C:\Program Files (x86)\Baidu Security =>Adware.BDSearch^
C:\ProgramData\Baidu Security =>Adware.BDSearch^
C:\Users\Anne Caroline\AppData\Roaming\Baidu Security =>Adware.BDSearch^
C:\Users\Anne Caroline\AppData\Roaming\BitTorrent\BitTorrent.exe =>P2P.BitTorrent^
[HKCU\Software\Baidu Security] =>Adware.BDSearch^
[HKLM\Software\Wow6432Node\Baidu Security] =>Adware.BDSearch^
[HKLM\Software\Wow6432Node\Baidu_Drp_pos] =>Adware.BDSearch^
~ Additionnel Scan: 347577 Items scanned in 01mn 14s



---\\ Sumário das deteções encontradas na sua estação
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Adware.BDSearch
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Awesomehp
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.CrossRider
~ MSI: 3 link(s) detected in 01mn 14s



~ 1076 Legitimates filtered by white list
End of the scan (490 lines in 05mn 04s)(0)

O Awesomehp sumiu dos navegadores   

Mas to vendo que existem muitos malwares...
Existe algum ant virus que detecta malware e outros "virus" piores?
Posso manter o malwarebytes no meu pc?

 Copie todo o texto destacado em vermelho que te passei (começando em script zhpfix e indo até SysRestore)
_____________________________________________________________________________________________________________

 Vá no menu: Iniciar > Todos os programas > ZHP > Abra o Zhpfix > Clique em Importação > Clique no botão GO > Clique em Oui > Caso queira que os arquivos da lixeira sejam excluídos clique em Oui novamente > Um relatório aparecerá no bloco de notas.

Copie este relatório e poste em sua próxima resposta.