baidu antivirus

ola, gostaria de saber como remover baidu antivirus do  meu pc , já tentei varios programas, pelo computador,pela pasta do programa, tudo desinstala , mas quando reinicio meu computador ele reinstála sozinho, tem algum jeito de remover ele completamente para não voltar mais?

  Olá betao. Seja bem vindo ao Fórum PC Brasil.

Siga, por gentileza, as dicas do tutorial abaixo para fazer uma limpeza com o AdwCleaner:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

* Na sua próxima resposta poste o log do Adwcleaner que estará em C:\AdwCleaner\AdwCleaner[S0].txt

Ficamos na espera.

ola , boa noite,fiz oque você disse, entrei na pasta e achei isso aqui 



# AdwCleaner v3.022 - Relatório criado 14/03/2014 às 18:50:02
# Atualizado 13/03/2014 por Xplode
# Sistema Operacional : Windows 7 Ultimate Service Pack 1 (64 bits)
# Usuário : Betao - BETAO-PC
# Executando de : C:\Users\Betao\Desktop\AdwCleaner.exe
# Opção : Limpar

***** [ Serviços ] *****

[#] Serviço Deletada : hlnfd
Serviço Deletada : SafetyNutManager
Serviço Deletada : winzipersvc

***** [ Arquivos / Pastas ] *****

Pasta Deletada : C:\BywifiSave
Pasta Deletada : C:\BywifiShare
Pasta Deletada : C:\ProgramData\apn
Pasta Deletada : C:\ProgramData\Ask
Pasta Deletada : C:\ProgramData\Babylon
Pasta Deletada : C:\ProgramData\baidu
Pasta Deletada : C:\ProgramData\boost_interprocess
Pasta Deletada : C:\ProgramData\Browser Manager
Pasta Deletada : C:\ProgramData\BrowserProtect
Pasta Deletada : C:\ProgramData\Conduit
Pasta Deletada : C:\ProgramData\DealPlyLive
Pasta Deletada : C:\ProgramData\eSafe
Pasta Deletada : C:\ProgramData\IePluginService
Pasta Deletada : C:\ProgramData\SafetyNut
Pasta Deletada : C:\ProgramData\SaveSenseLive
Pasta Deletada : C:\ProgramData\StarApp
Pasta Deletada : C:\ProgramData\Tarma Installer
Pasta Deletada : C:\ProgramData\wincert
Pasta Deletada : C:\ProgramData\WPM
Pasta Deletada : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bywifi
Pasta Deletada : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZipper
Pasta Deletada : C:\Program Files (x86)\Bywifi
Pasta Deletada : C:\Program Files (x86)\Conduit
Pasta Deletada : C:\Program Files (x86)\Movies Toolbar
Pasta Deletada : C:\Program Files (x86)\Optimizer Pro
Pasta Deletada : C:\Program Files (x86)\WinZipper
Pasta Deletada : C:\Program Files (x86)\Common Files\337
Pasta Deletada : C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}
Pasta Deletada : C:\Users\Betao\AppData\Local\apn
Pasta Deletada : C:\Users\Betao\AppData\Local\Conduit
Pasta Deletada : C:\Users\Betao\AppData\Local\DealPlyLive
Pasta Deletada : C:\Users\Betao\AppData\Local\EoRezo
Pasta Deletada : C:\Users\Betao\AppData\Local\genienext
Pasta Deletada : C:\Users\Betao\AppData\Local\lollipop
Pasta Deletada : C:\Users\Betao\AppData\Local\Mobogenie
Pasta Deletada : C:\Users\Betao\AppData\Local\SaveSenseLive
Pasta Deletada : C:\Users\Betao\AppData\Local\somotomoviestoolbar1
Pasta Deletada : C:\Users\Betao\AppData\Local\SwvUpdater
Pasta Deletada : C:\Users\Betao\AppData\Local\TempDir
Pasta Deletada : C:\Users\Betao\AppData\Local\torch
Pasta Deletada : C:\Users\Betao\AppData\LocalLow\BabylonToolbar
Pasta Deletada : C:\Users\Betao\AppData\LocalLow\Conduit
Pasta Deletada : C:\Users\Betao\AppData\LocalLow\Plus-HD-1.6
Pasta Deletada : C:\Users\Betao\AppData\LocalLow\searchresultstb
Pasta Deletada : C:\Users\Betao\AppData\LocalLow\Softonic
Pasta Deletada : C:\Users\Betao\AppData\LocalLow\somotomoviestoolbar1
Pasta Deletada : C:\Users\Betao\AppData\Roaming\awesomehp
Pasta Deletada : C:\Users\Betao\AppData\Roaming\Babylon
Pasta Deletada : C:\Users\Betao\AppData\Roaming\baidu
Pasta Deletada : C:\Users\Betao\AppData\Roaming\DealPly
Pasta Deletada : C:\Users\Betao\AppData\Roaming\DefaultTab
Pasta Deletada : C:\Users\Betao\AppData\Roaming\eCyber
Pasta Deletada : C:\Users\Betao\AppData\Roaming\eDownload
Pasta Deletada : C:\Users\Betao\AppData\Roaming\eIntaller
Pasta Deletada : C:\Users\Betao\AppData\Roaming\file scout
Pasta Deletada : C:\Users\Betao\AppData\Roaming\Funmoods
Pasta Deletada : C:\Users\Betao\AppData\Roaming\iSafe
Pasta Deletada : C:\Users\Betao\AppData\Roaming\newnext.me
Pasta Deletada : C:\Users\Betao\AppData\Roaming\OpenCandy
Pasta Deletada : C:\Users\Betao\AppData\Roaming\pccustubinstaller
Pasta Deletada : C:\Users\Betao\AppData\Roaming\SaveSense
Pasta Deletada : C:\Users\Betao\AppData\Roaming\SupTab
Pasta Deletada : C:\Users\Betao\AppData\Roaming\Systweak
Pasta Deletada : C:\Users\Betao\AppData\Roaming\UpdaterEX
Pasta Deletada : C:\Users\Betao\AppData\Roaming\WinZipper
Pasta Deletada : C:\Users\Betao\AppData\Roaming\yourfiledownloader
Pasta Deletada : C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bywifi
Pasta Deletada : C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly
Pasta Deletada : C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SaveSense
Pasta Deletada : C:\Users\Betao\Documents\Mobogenie
Pasta Deletada : C:\Users\Betao\Documents\Optimizer Pro
Arquivo Deletada : C:\END
Arquivo Deletada : C:\Windows\System32\roboot64.exe
Arquivo Deletada : C:\Users\Betao\Desktop\Bywifi FLV Merger.lnk
Arquivo Deletada : C:\Program Files (x86)\Mozilla Firefox\searchplugins\delta-homes.xml
Arquivo Deletada : C:\Program Files (x86)\Mozilla Firefox\searchplugins\v9.xml
Arquivo Deletada : C:\Program Files (x86)\Mozilla Firefox\user.js
Arquivo Deletada : C:\Users\Betao\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx
Arquivo Deletada : C:\Users\Betao\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
Arquivo Deletada : C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job
Arquivo Deletada : C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineCore
Arquivo Deletada : C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
Arquivo Deletada : C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineUA
Arquivo Deletada : C:\Windows\System32\Tasks\DealPlyUpdate
Arquivo Deletada : C:\Windows\System32\Tasks\Desk 365 RunAsStdUser
Arquivo Deletada : C:\Windows\System32\Tasks\RunAsStdUser
Arquivo Deletada : C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job
Arquivo Deletada : C:\Windows\System32\Tasks\SaveSenseLiveUpdateTaskMachineCore
Arquivo Deletada : C:\Windows\System32\Tasks\Your File Updater

***** [ Atalhos ] *****


***** [ Registro ] *****

Valor Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [bywifi]
Chave Deletedo : HKLM\SOFTWARE\Classes\*\shell\filescout
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\dealplylive.exe
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Chave Deletedo : HKLM\SOFTWARE\Classes\dealplyliveupdate.coreclass
Chave Deletedo : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreClass.1
Chave Deletedo : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassSvc
Chave Deletedo : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclasssvc.1.0
Chave Deletedo : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService
Chave Deletedo : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService.1.0
Chave Deletedo : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3websvc
Chave Deletedo : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3websvc.1.0
Chave Deletedo : HKLM\SOFTWARE\Classes\MoviesToolbarHelper.DNSGuard
Chave Deletedo : HKLM\SOFTWARE\Classes\MoviesToolbarHelper.DNSGuard.1
Chave Deletedo : HKLM\SOFTWARE\Classes\Prod.cap
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASAPI32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASMANCS
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\desk365_RASAPI32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\desk365_RASMANCS
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASAPI32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASMANCS
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASAPI32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASMANCS
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\YourFile_RASAPI32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\YourFile_RASMANCS
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\YourFileUpdater_RASAPI32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\YourFileUpdater_RASMANCS
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsemngr.exe
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsermngr.exe
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bundlesweetimsetup.exe
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cltmngsvc.exe
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dealplylive.exe
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta babylon.exe
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta tb.exe
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta2.exe
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltainstaller.exe
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltasetup.exe
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltatb.exe
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltatb_2501-c733154b.exe
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iminentsetup.exe
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweetimsetup.exe
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbdelta.exetoolbar783881609.exe
Valor Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [bywifi]
Chave Deletedo : HKLM\SOFTWARE\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=3
Chave Deletedo : HKLM\SOFTWARE\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=9
Chave Deletedo : HKLM\SOFTWARE\MozillaPlugins\@tools.updaterss.com/SaveSenseLive Update;version=3
Chave Deletedo : HKLM\SOFTWARE\MozillaPlugins\@tools.updaterss.com/SaveSenseLive Update;version=9
Valor Deletedo : HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls [x64]
Valor Deletedo : HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDlls [x86]
Valor Deletedo : HKLM\SYSTEM\ControlSet002\Control\Session Manager\AppCertDlls [x64]
Valor Deletedo : HKLM\SYSTEM\ControlSet002\Control\Session Manager\AppCertDlls [x86]
Chave Deletedo : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc
Chave Deletedo : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Chave Deletedo : HKCU\Software\5a6d7dab735ee45
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{72D89EBF-0C5D-4190-91FD-398E45F1D007}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{80FABB17-63AF-4655-9F07-B6509EE37AF2}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{F48FC5B2-094A-44C7-B48C-289738C9582D}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{80FABB17-63AF-4655-9F07-B6509EE37AF2}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{9BDB5E09-4BBA-4422-8C2B-529B281C32B8}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{C4743D3E-20D7-4B52-84F2-5E4E277B2D82}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{CA5D945F-E738-4D0B-A0B5-25AC51C64659}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{F48FC5B2-094A-44C7-B48C-289738C9582D}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{F7698761-4ABA-45C2-A5BB-D2163922C725}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0F21B1E5-5AFC-43C9-9C66-515046E92EC2}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3728BA43-F94F-42A4-9E8D-00B930D1DB28}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE48ED75-5A56-4C5F-BBCE-6F1AC3875F66}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C4743D3E-20D7-4B52-84F2-5E4E277B2D82}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF7BD87A-8024-11E2-F316-F3E56188709B}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7854F00C-DC77-477E-A10E-603F48442D3B}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1E28287-1A31-4B0F-8D05-AA8C465D3C5A}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{09E90109-A9AA-4980-BCEF-76F8D924E902}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3444C3C5-6C56-4A16-A453-832B05BF6EA4}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4250488A-CB24-0893-C066-B1AEA57BCFF2}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C536F080-57B7-46D6-8894-C647553F2889}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Chave Deletedo : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Chave Deletedo : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4B71-B0A3-3D82E62A6909}
Chave Deletedo : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458E-AE16-1C1D8255C28A}
Chave Deletedo : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{96BD48DD-741B-41AE-AC4A-AFF96BA00F7E}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458E-AE16-1C1D8255C28A}
Valor Deletedo : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Valor Deletedo : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{06E50566-0AB7-431C-841D-62794727DAF9}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{1231839B-064E-4788-B865-465A1B5266FD}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{1F8EDE97-36D5-422A-B8F0-9406E2D87C60}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{26E7211D-0650-43CF-8498-4C81E83AEAAA}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Valor Deletedo : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Chave Deletedo : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Chave Deletedo : HKCU\Software\APN DTX
Chave Deletedo : HKCU\Software\APN PIP
Chave Deletedo : HKCU\Software\APN
Chave Deletedo : HKCU\Software\BI
Chave Deletedo : HKCU\Software\Conduit
Chave Deletedo : HKCU\Software\DataMngr
Chave Deletedo : HKCU\Software\DealPly
Chave Deletedo : HKCU\Software\DealPlyLive
Chave Deletedo : HKCU\Software\filescout
Chave Deletedo : HKCU\Software\Headlight
Chave Deletedo : HKCU\Software\IM
Chave Deletedo : HKCU\Software\Iminent
Chave Deletedo : HKCU\Software\ImInstaller
Chave Deletedo : HKCU\Software\InstallCore
Chave Deletedo : HKCU\Software\lollipop
Chave Deletedo : HKCU\Software\ParetoLogic
Chave Deletedo : HKCU\Software\SafetyNut
Chave Deletedo : HKCU\Software\SaveSenseLive
Chave Deletedo : HKCU\Software\SmartBar
Chave Deletedo : HKCU\Software\Softonic
Chave Deletedo : HKCU\Software\systweak
Chave Deletedo : HKCU\Software\Tuto4PC
Chave Deletedo : HKCU\Software\Tutorials
Chave Deletedo : HKCU\Software\TutoTag
Chave Deletedo : HKCU\Software\UpdaterEX
Chave Deletedo : HKCU\Software\WEDLMNGR
Chave Deletedo : HKCU\Software\YourFileDownloader
Chave Deletedo : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Chave Deletedo : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Chave Deletedo : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Chave Deletedo : HKCU\Software\AppDataLow\Software\Crossrider
Chave Deletedo : HKCU\Software\AppDataLow\Software\findlyrics
Chave Deletedo : HKCU\Software\AppDataLow\Software\SmartBar
Chave Deletedo : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Chave Deletedo : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Chave Deletedo : HKLM\Software\APN
Chave Deletedo : HKLM\Software\Babylon
Chave Deletedo : HKLM\Software\Conduit
Chave Deletedo : HKLM\Software\DataMngr
Chave Deletedo : HKLM\Software\DealPly
Chave Deletedo : HKLM\Software\DealPlyLive
Chave Deletedo : HKLM\Software\delta-homesSoftware
Chave Deletedo : HKLM\Software\Desksvc
Chave Deletedo : HKLM\Software\hdcode
Chave Deletedo : HKLM\Software\Iminent
Chave Deletedo : HKLM\Software\ParetoLogic
Chave Deletedo : HKLM\Software\PIP
Chave Deletedo : HKLM\Software\portaldositesSoftware
Chave Deletedo : HKLM\Software\SafetyNut
Chave Deletedo : HKLM\Software\SaveSenseLive
Chave Deletedo : HKLM\Software\supTab
Chave Deletedo : HKLM\Software\supWPM
Chave Deletedo : HKLM\Software\V9
Chave Deletedo : HKLM\Software\V9Software
Chave Deletedo : HKLM\Software\winzipersvc
Chave Deletedo : HKLM\Software\YourFileDownloader
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\winzipper
Chave Deletedo : [x64] HKLM\SOFTWARE\Tarma Installer
Chave Deletedo : [x64] HKLM\SOFTWARE\V9Software
Dados Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\progra~3\wincert\win32c~1.dll
Dados Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\progra~2\movies~1\safety~1\safety~2.dll
Dados Deletedo : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~3\Wincert\WIN64C~1.DLL
Dados Deletedo : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\MOVIES~1\SAFETY~1\x64\SAFETY~2.DLL

***** [ Navegadores ] *****

-\\ Internet Explorer v11.0.9600.16521

Configurações Restauradas : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Configurações Restauradas : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Configurações Restauradas : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Configurações Restauradas : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs]
Configurações Restauradas : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Configurações Restauradas : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

-\\ Google Chrome v

[ Arquivo : C:\Users\Betao\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deletedo : homepage
Deletedo : urls_to_restore_on_startup

*************************

AdwCleaner[R0].txt - [36969 octets] - [14/03/2014 18:48:46]
AdwCleaner[S0].txt - [33268 octets] - [14/03/2014 18:50:02]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [33329 octets] ##########

olá quando eu fiz a limpeza pelo adwcleaner, depois que o meu computador foi 
reiniciado o baidu antivirus não foii reinstalado novamente

 Siga, por gentileza, as dicas deste tutorial para fazer uma limpeza de seu PC com o Malwarebytes:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Na sua próxima resposta poste este log do Malwarebytes.

Ficamos no aguardo.

bom dia, fiz oque você disse , mas na hora de postar os log pra você estava dando erro,mostrava uma mensagem aqui no forum
dizendo que tinha ultrapassado o limite de largura,tentei varias vezes ,ate formatei pra ver se cabia mas nao deu, era muito grande.

olá , achei um topico aqui no forum continuei a limpza



Zoek.exe v5.0.0.0 Updated 07-March-2014
Tool run by Betao on 15/03/2014 at 9:51:53,71.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Betao\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

15/03/2014 09:53:23 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} deleted successfully
HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Microsoft\Internet Explorer\SearchScopes\{52db1893-8a90-4192-aede-08e00b8f8473} deleted successfully
HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Microsoft\Internet Explorer\SearchScopes\{86c83f9e-48a4-4cd2-a763-64fea5df35f7} deleted successfully
HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E627DC4B-8C04-4234-A2D4-1D634EE01C41} deleted successfully

==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== Deleting Files \ Folders ======================

C:\Users\Betao\daemonprocess.txt deleted
C:\Users\Betao\.android deleted
C:\PROGRA~2\Mozilla Firefox\defaults\preferences\autoconfig.js deleted
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\22find.lnk deleted
C:\Users\Betao\AppData\Roaming\GetRightToGo deleted
C:\PROGRA~3\FileSplitUpLoad.dll deleted
C:\PROGRA~3\SpeedBit deleted
C:\PROGRA~3\InstallMate deleted
C:\Users\Betao\AppData\Local\avgchrome deleted
C:\Users\Betao\AppData\Local\cache deleted
C:\Users\Betao\AppData\Local\Google\Chrome\User Data\Default\Extensions\ep.crx deleted
C:\Users\Betao\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx deleted
C:\Users\Public\sdelevURL.tmp deleted
C:\Users\Betao\Downloads\iSafedl (1).exe deleted
C:\Users\Betao\Downloads\iSafedl.exe deleted
C:\Users\Betao\AppData\LocalLow\DataMngr deleted
C:\windows\SysNative\tasks\RunAsStdUser Task deleted
C:\windows\SysNative\tasks\DTReg deleted
C:\Windows\Syswow64\InstallUtil.InstallLog deleted
C:\Windows\SysWow64\searchplugins deleted
C:\Windows\SysWow64\Extensions deleted
C:\Users\Betao\AppData\Roaming\unins000.exe deleted
"C:\Users\Betao\AppData\Local\{7BD52815-5D83-4470-886B-06672CEAD4EA}" deleted
"C:\Users\Betao\AppData\Local\{CFDEA09A-93FC-4DCD-AE05-7E9499A7708A}" deleted
"C:\PROGRA~3\9325af5a03eabd89\{476D78C4-1DB0-2D88-7FCC-AA6559F59A8D}" deleted
"C:\Program Files\Common Files\SpeedBit\SBUpdate\sbu.exe" deleted
"C:\PROGRA~3\9325af5a03eabd89" deleted
"C:\Users\Betao\AppData\Roaming\Nokia" deleted
"C:\Users\Betao\AppData\Roaming\GrabPro" deleted
"C:\Program Files\Common Files\SpeedBit" not deleted
"C:\Program Files\Common Files\SpeedBit\SBUpdate" not deleted

==== Folders Found ======================

2014-03-14 21:50:15 2014-03-14 21:50:15 -------- d-----w- C:\AdwCleaner\Quarantine\C\ProgramData\baidu
2014-03-14 16:09:23 2014-03-14 16:09:23 -------- d-----w- C:\Program Files (x86)\Baidu Security
2014-03-14 16:09:23 2014-03-14 21:52:05 -------- d-----w- C:\Program Files (x86)\Baidu Security\Baidu Antivirus
2014-03-14 15:21:58 2014-03-14 15:21:58 -------- d-----w- C:\ProgramData\Baidu Security
2014-03-14 15:21:58 2014-03-14 15:21:58 -------- d-----w- C:\Users\All Users\Baidu Security
2014-03-14 16:07:21 2014-03-14 16:07:21 -------- d-----w- C:\Users\Betao\AppData\Local\Temp\baidu_secure
2014-03-11 00:42:38 2014-03-11 00:42:39 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Antivirus-10032014-214238
2014-03-11 15:58:48 2014-03-11 15:58:48 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Antivirus-11032014-125848
2014-03-14 14:51:00 2014-03-14 14:51:00 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Antivirus-14032014-115100
2014-03-11 16:34:32 2014-03-11 16:34:32 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-11032014-133432
2014-03-11 16:49:06 2014-03-11 16:49:06 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-11032014-134906
2014-03-11 18:38:26 2014-03-11 18:38:26 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-11032014-153826
2014-03-12 16:30:39 2014-03-12 16:30:39 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-12032014-133039
2014-03-13 13:36:54 2014-03-13 13:36:54 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-13032014-103654
2013-03-20 23:06:56 2013-03-21 00:25:38 -------- d-----w- C:\Users\Betao\AppData\Roaming\BaiduPcFaster
2013-10-28 12:51:36 2014-01-29 19:51:34 -------- d-----w- C:\Users\Public\Documents\Baidu Security

==== Files Found ======================


==== Registry Search Results for "Baidu" ======================


[HKEY_LOCAL_MACHINE\SOFTWARE\baidu]

[HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll]

[HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll\Splitupload]

[HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll\Splitupload\bav]

[HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll\Splitupload\bav]
"DllVersion_2.0"="C:\\ProgramData\\baidu\\commondll\\splitupload\\DllVersion_2.0\\FileSplitUpLoad.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\Antivirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\PC Faster]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP\Processing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP\Temp]

"C:\\ProgramData\\Baidu Security\\RpData\\rpFile-PCFasterSvc-2014-03-09 03-22-22-0161-[8099].tmp"=""

"C:\\ProgramData\\Baidu Security\\RpData\\rpFile-Updater-2014-03-09 03-22-22-0286-[8099].tmp"=""

"C:\\ProgramData\\Baidu Security\\RpData\\rpFile-Pcftray-2014-03-09 03-22-36-0348-[8145].tmp"=""

"C:\\ProgramData\\Baidu Security\\RpData\\rpFile-PCFaster-2014-03-09 03-34-30-0622-[10477].tmp"=""

"C:\\ProgramData\\Baidu Security\\RpData\\rpFile-NSISInstall-2014-03-09 03-34-39-0110-[10506].tmp"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{77FEF28E-EB96-44FF-B511-3185DEA48697}]
"DllName"="baidubar.dll;BaiduBarX.dll;BaiduBarX.dll;BaiduBarX.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{B580CF65-E151-49C3-B73F-70B13FCA8E86}]
"DllName"="baidubar.dll;BaiduBarX.dll;BaiduBarX.dll;BaiduBarX.dll"

"BAV mini setup"="\"C:\\ProgramData\\Baidu\\Antivirus\\BavPro_Setup_Mini_051[1].exe\" /S /NOTRAY partner=RebootRun"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BFILTER\0000]
"DeviceDesc"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BFMON\0000]
"DeviceDesc"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BPROTECT\0000]
"DeviceDesc"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BdApiUtil]
"ImagePath"="\\??\\C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus\\BdApiUtil64.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BdCameraProtect]
"ImagePath"="\\??\\C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus\\BdCameraProtect64.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Bfilter]
"DisplayName"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Bfmon]
"DisplayName"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Bprotect]
"DisplayName"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Bprotect]
"InstPath"="C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BFILTER\0000]
"DeviceDesc"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BFMON\0000]
"DeviceDesc"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BPROTECT\0000]
"DeviceDesc"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\BdApiUtil]
"ImagePath"="\\??\\C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus\\BdApiUtil64.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\BdCameraProtect]
"ImagePath"="\\??\\C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus\\BdCameraProtect64.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Bfilter]
"DisplayName"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Bfmon]
"DisplayName"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Bprotect]
"DisplayName"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Bprotect]
"InstPath"="C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BFILTER\0000]
"DeviceDesc"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BFMON\0000]
"DeviceDesc"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BPROTECT\0000]
"DeviceDesc"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BdApiUtil]
"ImagePath"="\\??\\C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus\\BdApiUtil64.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BdCameraProtect]
"ImagePath"="\\??\\C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus\\BdCameraProtect64.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Bfilter]
"DisplayName"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Bfmon]
"DisplayName"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Bprotect]
"DisplayName"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Bprotect]
"InstPath"="C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus"

[HKEY_USERS\.DEFAULT\Software\Baidu]

[HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug]

[HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug\Bav]

[HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug\Bav\log]

[HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug\Bav\log\BavSvc.exe]

[HKEY_USERS\.DEFAULT\Software\Baidu Security]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus\bug]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus\bug\driver]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus\bug\driver\010814-15522-01.dmp]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus\web]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus\web]
"ucloud"="u.br.bav.baidu.com"

[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus\web]
"dcloud"="http://up.br.bav.baidu.com/cgi-bin/url_warnning/url_warnning.cgi"

[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus\web]
"rcloud"="http://up.br.bav.baidu.com/cgi-bin/url_visit_action.cgi"

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\bug]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\bug\driver]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\bug\driver\010814-15522-01.dmp]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\DataReport]

[HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Avast Software\WRC\RatingStorage\pcfaster.baidu.com]

[HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Baidu]

[HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Baidu\Hao123-international]

[HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Baidu\Hao123-international\hao123desk]

[HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Baidu Security]

[HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Baidu Security\Antivirus]

[HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Baidu Security\Antivirus\web]

[HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Baidu Security\Antivirus\web]
"ucloud"="u.br.bav.baidu.com"

[HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Baidu Security\Antivirus\web]
"dcloud"="http://up.br.bav.baidu.com/cgi-bin/url_warnning/url_warnning.cgi"

[HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Baidu Security\Antivirus\web]
"rcloud"="http://up.br.bav.baidu.com/cgi-bin/url_visit_action.cgi"

[HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Baidu Security\PC Faster]

[HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6E71E502-B218-4259-86C5-CED6E6306E6C}]
"url"="http://www.baidu.com/baidu?cl=3&tn=firefoxcn_dg&word={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}"

[HKEY_USERS\S-1-5-18\Software\Baidu]

[HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug]

[HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug\Bav]

[HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug\Bav\log]

[HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug\Bav\log\BavSvc.exe]

[HKEY_USERS\S-1-5-18\Software\Baidu Security]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus\bug]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus\bug\driver]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus\bug\driver\010814-15522-01.dmp]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus\web]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus\web]
"ucloud"="u.br.bav.baidu.com"

[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus\web]
"dcloud"="http://up.br.bav.baidu.com/cgi-bin/url_warnning/url_warnning.cgi"

[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus\web]
"rcloud"="http://up.br.bav.baidu.com/cgi-bin/url_visit_action.cgi"

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\bug]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\bug\driver]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\bug\driver\010814-15522-01.dmp]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\DataReport]

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"wrc@avast.com"="C:\Program Files\AVAST Software\Avast\WebRep\FF" [06/03/2014 17:57]
[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]
"{87F8774F-B485-47E2-A755-A40A8A5E886D}"="C:\Users\Betao\AppData\Local\GAS Tecnologia\GBBD\cef\xpi" [04/11/2013 10:31]

==== Chrome Look ======================

websoave - Administrador\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk
websoave - Administrador\AppData\Local\Google\Chrome\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk
websoave - Administrador\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk
websoave - Administrador\AppData\Local\Torch\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk
websoave - Betao\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk
Last updated at time on date - Betao\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb
Google Wallet - Betao\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
websoave - Betao\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk
websoave - Convidado\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk
websoave - Convidado\AppData\Local\Google\Chrome\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk
websoave - Convidado\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk
websoave - Convidado\AppData\Local\Torch\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk

==== Chrome Fix ======================

C:\Users\Administrador\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk deleted successfully
C:\Users\Administrador\AppData\Local\Google\Chrome\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk deleted successfully
C:\Users\Administrador\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk deleted successfully
C:\Users\Administrador\AppData\Local\Torch\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk deleted successfully
C:\Users\Betao\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk deleted successfully
C:\Users\Betao\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk deleted successfully
C:\Users\Convidado\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk deleted successfully
C:\Users\Convidado\AppData\Local\Google\Chrome\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk deleted successfully
C:\Users\Convidado\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk deleted successfully
C:\Users\Convidado\AppData\Local\Torch\User Data\Default\Extensions\efcaeadhfgcmblkjpghgkmecahglpfmk deleted successfully
C:\Users\Betao\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_efcaeadhfgcmblkjpghgkmecahglpfmk_0.localstorage deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
"Search Bar"="http://www.bing.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.google.com"
"Search Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.google.com"
"Search Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="http://www.google.com"
"oldTabs"="http://br.hao123.com/?tn=incore_pay_hp_01_hao123_br"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="http://www.google.com"
"oldTabs"="http://br.hao123.com/?tn=incore_pay_hp_01_hao123_br"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Bar"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0191A6B0-1154-4C22-9182-23A95BBE92D9} Google Url="http://www.google.com/search?q={searchTerms}"
{05046B93-CC41-4CF5-84CF-3AC3004B22A7} Google Url="http://www.google.cn/cse?cx=partner-pub-0166105436203332:pzdukf-nfb1&cr=&ie=UTF-8&hl=zh-CN&sa=%E6%90%9C%E5%B0%8B&q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{5FE67395-2944-4724-8C8F-9F17F3F1B57E} Unknown Url="Not_Found"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"
{6E71E502-B218-4259-86C5-CED6E6306E6C} øëôÔ Url="http://www.baidu.com/baidu?cl=3&tn=firefoxcn_dg&word={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}"

==== Reset Google Chrome ======================

C:\Users\Betao\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Betao\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Microsoft\Internet Explorer\SearchScopes\{5FE67395-2944-4724-8C8F-9F17F3F1B57E} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{338A754C-B46E-4BF2-8AC8-23DE36862AD3} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{338A754C-B46E-4BF2-8AC8-23DE36862AD3} deleted successfully

==== Deleting CLSID Registry Values ======================


==== shortcuts on Users Desktops ======================

C:\Users\Betao\Desktop\Acelerador de Vídeo Bywifi.lnk -
C:\Users\Betao\Desktop\Format Factory.lnk - C:\Program Files (x86)\FreeTime\FormatFactory\FormatFactory.exe
C:\Users\Betao\Desktop\PhotoScape.lnk - C:\Program Files (x86)\PhotoScape\PhotoScape.exe
C:\Users\Betao\Desktop\Transcodificador de Mídia Bywifi.lnk -
C:\Users\Betao\Desktop\programas\Win Loader v2.0.0 - blogdorai.lnk - C:\Users\Betao\Downloads\Win Loader v2.0.0 - blogdorai.rar
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (1).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\akumasfa.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (10).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\mdcastle.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (11).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\ramenbg.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (12).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\ryubg.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (13).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\ryuji.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (14).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\terryrbs.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (15).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\title.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (16).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\tungffs.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (17).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\vegasfa3.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (18).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\andy.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (19).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\BGM_BasementTX.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (2).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\alice.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (20).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\c62.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (21).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\chonshu.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (22).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\BGM_OmegaStreetTX.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (3).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\8.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (4).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\danbg.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (5).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\duckrb.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (6).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\genbg.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (7).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\guybg.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (.lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\kensfa.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (9).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\kimrbs.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX.lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\garden.mp3

==== shortcuts on All Users Desktop ======================

C:\Users\Public\Desktop\Adobe Reader XI.lnk - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
C:\Users\Public\Desktop\Ashampoo Burning Studio 6 FREE.lnk - C:\Program Files (x86)\Ashampoo\Ashampoo Burning Studio 6 FREE\burningstudio.exe
C:\Users\Public\Desktop\avast Free Antivirus.lnk -
C:\Users\Public\Desktop\DAEMON Tools Pro.lnk - C:\Program Files (x86)\DAEMON Tools Pro\DTPro.exe
C:\Users\Public\Desktop\EPSON Scan.lnk - C:\Windows\twain_32\escndv\escndv.exe
C:\Users\Public\Desktop\Game option.lnk - C:\Windows\USB Vibration\dr100&110\GameControler.exe
C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\Users\Public\Desktop\MPC-HC.lnk - C:\Program Files (x86)\MPC-HC\mpc-hc.exe
C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk - C:\Program Files (x86)\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
C:\Users\Public\Desktop\VDownloader.lnk - C:\Program Files\VDownloader\VDownloader.exe
C:\Users\Public\Desktop\VLC media player.lnk - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe

==== shortcuts in Users Start Menu ======================

C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk - C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games\Mortal Kombat 4.lnk -
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk - C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Ajuda do WinRAR.lnk - C:\Program Files (x86)\WinRAR\WinRAR.chm
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Manual do Console RAR.lnk - C:\Program Files (x86)\WinRAR\Rar.txt
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\O que há de novo na última versão.lnk -
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk - C:\Program Files (x86)\WinRAR\WinRAR.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZBOT\Desinstalando o ZBOT.lnk - C:\Program Files (x86)\Valve\cstrike\Desinstalar ZBOT.exe

==== shortcuts in All Users Start Menu ======================

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk - C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast\avast Free Antivirus.lnk -
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX\Registrar.lnk - C:\Program Files (x86)\DivX\DivX Control Panel\DivXControlPanelLauncher.exe /start=registration
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX\Verificar atualizações.lnk -
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Cyclone\Internet Cyclone Help.lnk - C:\Program Files (x86)\Internet Cyclone\Internet Cyclone.chm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Cyclone\Internet Cyclone on the Web.lnk - C:\Program Files (x86)\Internet Cyclone\Internet Cyclone.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Cyclone\Internet Cyclone.lnk - C:\Program Files (x86)\Internet Cyclone\Internet Cyclone.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Cyclone\License.lnk - C:\Program Files (x86)\Internet Cyclone\license.txt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Cyclone\Uninstall Internet Cyclone.lnk - C:\Program Files (x86)\Internet Cyclone\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Desinstalar Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware Help.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.chm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\chameleon.chm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight\Microsoft Silverlight.lnk - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\Silverlight.Configuration.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oasis Games Limited\Uninstall.lnk - C:\Program Files (x86)\Oasis Games Limited\Legend online\uninstaller.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro\Desinstalar Revo Uninstaller Pro.lnk - C:\Program Files\VS Revo Group\Revo Uninstaller Pro\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro Help.lnk - C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Revo Uninstaller Pro Help.pdf
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro.lnk - C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Documentation.lnk - C:\Program Files (x86)\VideoLAN\VLC\Documentation.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Release Notes.lnk - C:\Program Files (x86)\VideoLAN\VLC\NEWS.txt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VideoLAN Website.lnk - C:\Program Files (x86)\VideoLAN\VLC\VideoLAN Website.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player - reset preferences and cache files.lnk - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe --reset-config --reset-plugins-cache [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player skinned.lnk - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe -Iskins
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player.lnk - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Configure Decoder.lnk - C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\xvid.ax,Configure
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Configure Encoder.lnk - C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\xvidvfw.dll,Configure
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Nic's FourCC Changer.lnk - C:\Program Files (x86)\Xvid\AviC.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Quantization Matrices.lnk - C:\Program Files (x86)\Xvid\Quantization Matrices
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Release Notes.lnk - C:\Program Files (x86)\Xvid\releasenotes.txt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\StatsReader 2.1.lnk - C:\Program Files (x86)\Xvid\StatsReader.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\StatsReader Notes.lnk - C:\Program Files (x86)\Xvid\statsreader.txt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Uninstall Xvid.lnk - C:\Program Files (x86)\Xvid\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\VIDC Cleaner.lnk - C:\Program Files (x86)\Xvid\vidccleaner.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Web Links\Doom10.lnk - C:\Program Files (x86)\Xvid\Links\doom10.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Web Links\Doom9.lnk - C:\Program Files (x86)\Xvid\Links\doom9.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Web Links\ffdshow Homepage.lnk - C:\Program Files (x86)\Xvid\Links\ffdshowhomepage.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Web Links\Jawor's Homepage.lnk - C:\Program Files (x86)\Xvid\Links\jaworshomepage.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Web Links\VideoAudio.PL.lnk - C:\Program Files (x86)\Xvid\Links\videoaudiopl.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Web Links\Xvid Homepage.lnk - C:\Program Files (x86)\Xvid\Links\xvidhomepage.url

==== shortcuts in Quick Launch ======================

C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Acelerador de Vídeo Bywifi.lnk -
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PhotoScape.lnk - C:\Program Files (x86)\PhotoScape\PhotoScape.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Transcodificador de Mídia Bywifi.lnk -
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk -
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk - C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Counter-Strike 1.6.lnk - C:\Program Files (x86)\Valve\hl.exe -nomaster -game cstrike fullscreen -w 1024 -h 768 -d3d
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk - C:\Windows\explorer.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk - C:\Program Files (x86)\Windows Media Player\wmplayer.exe /prefetch:1
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -

==== Reset IE Proxy ======================

Value(s) before fix:
"ProxyOverride"="local"
"ProxyEnable"=dword:00000000

Value(s) after fix:
"ProxyEnable"=dword:00000000

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\dad3fe0b-3e82-446e-9f70-6b4e5299bc4e deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E8764568-C455-10C3-83EB-B0B4999A45DB} deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Betao\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\Betao\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=555 folders=56 26813695 bytes)

==== Empty Temp Folders ======================

C:\Users\Betao\AppData\Local\Temp will be emptied at reboot
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\DefaultAppPool\AppData\Local\Temp emptied successfully
C:\Users\USURIO~1\AppData\Local\Temp emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Betao\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Program Files\Common Files\SpeedBit" not found

==== EOF on 15/03/2014 at 10:10:00,06 ======================

bom dia, fiz oque você disse , mas na hora de postar os log pra você estava dando erro,mostrava uma mensagem aqui no forum
dizendo que tinha ultrapassado o limite de largura,tentei varias vezes ,ate formatei pra ver se cabia mas nao deu, era muito grande.

Neste caso é só você anexar o relatório aqui no seu tópico como mostra este tutorial abaixo:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Siga, por gentileza, as dicas do tutorial abaixo:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

* Na sua próxima resposta poste o log do Junkware Removal Tool que estará salvo em sua área de trabalho com o nome de JRT.txt

Ficamos na espera.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Ultimate x64
Ran by Betao on 15/03/2014 at 12:17:53,85
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\baidu
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\baidu
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6E71E502-B218-4259-86C5-CED6E6306E6C}
Successfully deleted: [Registry Key] "hkey_current_user\software\microsoft\internet explorer\low rights\elevationpolicy\{a5aa24ea-11b8-4113-95ae-9ed71deaf12a}"



~~~ Files



~~~ Folders



~~~ Chrome

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Policies\Google [Blacklisted Policy]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 15/03/2014 at 12:25:28,64
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 Desative temporariamente seu antivírus para evitar conflitos.

*Clique com o botão direito do mouse no Zoek.exe e selecione [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

* Copie todo este texto destacado em vermelho que te passei e cole-o no espaço em branco do Zoek

*Clique [Run Script]

*Durante o scan uma mensagem parecida com esta abaixo mostrando o progresso do escaneamento será apresentada. Aguarde o término...pode demorar!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

*Caso a reinicialização do PC seja solicitada, clique [OK]

* Poste o log do Zoek que estará em C:\zoek-results.txt em sua próxima resposta.

Zoek.exe v5.0.0.0 Updated 07-March-2014
Tool run by Betao on 15/03/2014 at 14:28:15,88.
Microsoft Windows 7 Ultimate  6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Betao\Downloads\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2014-03-15-131000.log 43171 bytes

==== System Restore Info ======================

15/03/2014 14:30:06 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BdApiUtil deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BdApiUtil deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BdCameraProtect deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BdCameraProtect deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bfilter deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Bfilter deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bfmon deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Bfmon deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bprotect deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Bprotect deleted successfully

==== Deleting Files \ Folders ======================

C:\Users\Betao\AppData\Local\Temp\baidu_secure not found
C:\Program Files (x86)\Baidu Security deleted
C:\ProgramData\Baidu Security deleted
C:\Users\Betao\AppData\Roaming\BaiduPcFaster deleted
C:\Users\Public\Documents\Baidu Security deleted
C:\PROGRA~3\InstallMate deleted

==== Folders Found ======================

2014-03-14 21:50:15 2014-03-14 21:50:15 -------- d-----w- C:\AdwCleaner\Quarantine\C\ProgramData\baidu
2014-03-11 00:42:38 2014-03-11 00:42:39 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Antivirus-10032014-214238
2014-03-11 15:58:48 2014-03-11 15:58:48 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Antivirus-11032014-125848
2014-03-14 14:51:00 2014-03-14 14:51:00 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Antivirus-14032014-115100
2014-03-11 16:34:32 2014-03-11 16:34:32 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-11032014-133432
2014-03-11 16:49:06 2014-03-11 16:49:06 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-11032014-134906
2014-03-11 18:38:26 2014-03-11 18:38:26 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-11032014-153826
2014-03-12 16:30:39 2014-03-12 16:30:39 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-12032014-133039
2014-03-13 13:36:54 2014-03-13 13:36:54 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-13032014-103654
2014-03-15 17:40:17 2014-03-15 17:40:17 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security
2014-03-15 17:40:17 2014-03-14 21:52:05 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_Baidu Antivirus
2014-03-15 17:40:17 2014-03-15 17:40:17 -------- d---a-w- C:\zoek_backup\C_ProgramData_Baidu Security
2014-03-15 17:40:17 2014-03-15 17:40:17 -------- d---a-w- C:\zoek_backup\C_Users_All Users_Baidu Security
2014-03-15 17:40:17 2014-03-15 17:40:17 -------- d---a-w- C:\zoek_backup\C_Users_Betao_AppData_Roaming_BaiduPcFaster
2014-03-15 17:40:18 2014-03-15 17:40:18 -------- d---a-w- C:\zoek_backup\C_Users_Public_Documents_Baidu Security
2014-03-15 17:40:17 2014-03-14 21:52:05 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\Baidu Antivirus

==== Files Found ======================


==== Registry Search Results for "Baidu" ======================


[HKEY_LOCAL_MACHINE\SOFTWARE\baidu]

[HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll]

[HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll\Splitupload]

[HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll\Splitupload\bav]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP\Temp]

"BAV mini setup"="\"C:\\ProgramData\\Baidu\\Antivirus\\BavPro_Setup_Mini_051[1].exe\" /S /NOTRAY partner=RebootRun"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"="Baidu ProtectEx"

[HKEY_USERS\.DEFAULT\Software\Baidu Security]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus\web]

[HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Baidu Security]

[HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Baidu Security\Antivirus]

[HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Baidu Security\Antivirus\web]

[HKEY_USERS\S-1-5-18\Software\Baidu Security]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus\web]

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"wrc@avast.com"="C:\Program Files\AVAST Software\Avast\WebRep\FF" [06/03/2014 17:57]
[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]
"{87F8774F-B485-47E2-A755-A40A8A5E886D}"="C:\Users\Betao\AppData\Local\GAS Tecnologia\GBBD\cef\xpi" [04/11/2013 10:31]

==== Chrome Look ======================


==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"
{0191A6B0-1154-4C22-9182-23A95BBE92D9} Google  Url="http://www.google.com/search?q={searchTerms}"
{05046B93-CC41-4CF5-84CF-3AC3004B22A7} Google  Url="http://www.google.cn/cse?cx=partner-pub-0166105436203332:pzdukf-nfb1&cr=&ie=UTF-8&hl=zh-CN&sa=%E6%90%9C%E5%B0%8B&q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google  Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"
{6E71E502-B218-4259-86C5-CED6E6306E6C} Unknown  Url="Not_Found"

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-2032486206-3458049535-1664191965-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6E71E502-B218-4259-86C5-CED6E6306E6C} deleted successfully

==== Deleting CLSID Registry Values ======================


==== shortcuts on Users Desktops ======================

C:\Users\Betao\Desktop\Acelerador de Vídeo Bywifi.lnk -  
C:\Users\Betao\Desktop\Format Factory.lnk - C:\Program Files (x86)\FreeTime\FormatFactory\FormatFactory.exe
C:\Users\Betao\Desktop\PhotoScape.lnk - C:\Program Files (x86)\PhotoScape\PhotoScape.exe
C:\Users\Betao\Desktop\Transcodificador de Mídia Bywifi.lnk -  
C:\Users\Betao\Desktop\ZHPDiag.lnk - C:\Program Files (x86)\ZHPDiag\ZHPhep.exe
C:\Users\Betao\Desktop\programas\Win Loader v2.0.0 - blogdorai.lnk - C:\Users\Betao\Downloads\Win Loader v2.0.0 - blogdorai.rar
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (1).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\akumasfa.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (10).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\mdcastle.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (11).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\ramenbg.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (12).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\ryubg.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (13).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\ryuji.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (14).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\terryrbs.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (15).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\title.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (16).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\tungffs.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (17).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\vegasfa3.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (18).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\andy.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (19).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\BGM_BasementTX.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (2).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\alice.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (20).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\c62.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (21).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\chonshu.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (22).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\BGM_OmegaStreetTX.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (3).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\8.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (4).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\danbg.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (5).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\duckrb.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (6).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\genbg.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (7).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\guybg.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (.lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\kensfa.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX (9).lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\kimrbs.mp3
C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\SOUNDTRAX\TRAX.lnk - C:\Users\Betao\Desktop\Street Fighter Vs Fatal Fury R.B.Z\sound\garden.mp3

==== shortcuts on All Users Desktop ======================

C:\Users\Public\Desktop\Adobe Reader XI.lnk - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
C:\Users\Public\Desktop\Ashampoo Burning Studio 6 FREE.lnk - C:\Program Files (x86)\Ashampoo\Ashampoo Burning Studio 6 FREE\burningstudio.exe
C:\Users\Public\Desktop\avast Free Antivirus.lnk -  
C:\Users\Public\Desktop\DAEMON Tools Pro.lnk - C:\Program Files (x86)\DAEMON Tools Pro\DTPro.exe
C:\Users\Public\Desktop\EPSON Scan.lnk - C:\Windows\twain_32\escndv\escndv.exe
C:\Users\Public\Desktop\Game option.lnk - C:\Windows\USB Vibration\dr100&110\GameControler.exe
C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\Users\Public\Desktop\MPC-HC.lnk - C:\Program Files (x86)\MPC-HC\mpc-hc.exe
C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk - C:\Program Files (x86)\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
C:\Users\Public\Desktop\VDownloader.lnk - C:\Program Files\VDownloader\VDownloader.exe
C:\Users\Public\Desktop\VLC media player.lnk - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe

==== shortcuts in Users Start Menu ======================

C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk - C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games\Mortal Kombat 4.lnk -  
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk - C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Ajuda do WinRAR.lnk - C:\Program Files (x86)\WinRAR\WinRAR.chm
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Manual do Console RAR.lnk - C:\Program Files (x86)\WinRAR\Rar.txt
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\O que há de novo na última versão.lnk -  
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk - C:\Program Files (x86)\WinRAR\WinRAR.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZBOT\Desinstalando o ZBOT.lnk - C:\Program Files (x86)\Valve\cstrike\Desinstalar  ZBOT.exe

==== shortcuts in All Users Start Menu ======================

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk - C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast\avast Free Antivirus.lnk -  
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX\Registrar.lnk - C:\Program Files (x86)\DivX\DivX Control Panel\DivXControlPanelLauncher.exe /start=registration
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DivX\Verificar atualizações.lnk -  
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Cyclone\Internet Cyclone Help.lnk - C:\Program Files (x86)\Internet Cyclone\Internet Cyclone.chm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Cyclone\Internet Cyclone on the Web.lnk - C:\Program Files (x86)\Internet Cyclone\Internet Cyclone.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Cyclone\Internet Cyclone.lnk - C:\Program Files (x86)\Internet Cyclone\Internet Cyclone.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Cyclone\License.lnk - C:\Program Files (x86)\Internet Cyclone\license.txt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Cyclone\Uninstall Internet Cyclone.lnk - C:\Program Files (x86)\Internet Cyclone\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Desinstalar Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware Help.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.chm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\chameleon.chm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight\Microsoft Silverlight.lnk - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\Silverlight.Configuration.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oasis Games Limited\Uninstall.lnk - C:\Program Files (x86)\Oasis Games Limited\Legend online\uninstaller.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro\Desinstalar Revo Uninstaller Pro.lnk - C:\Program Files\VS Revo Group\Revo Uninstaller Pro\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro Help.lnk - C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Revo Uninstaller Pro Help.pdf
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro.lnk - C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Documentation.lnk - C:\Program Files (x86)\VideoLAN\VLC\Documentation.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Release Notes.lnk - C:\Program Files (x86)\VideoLAN\VLC\NEWS.txt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VideoLAN Website.lnk - C:\Program Files (x86)\VideoLAN\VLC\VideoLAN Website.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player - reset preferences and cache files.lnk - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe --reset-config --reset-plugins-cache [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player skinned.lnk - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe -Iskins
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player.lnk - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Configure Decoder.lnk - C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\xvid.ax,Configure
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Configure Encoder.lnk - C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\xvidvfw.dll,Configure
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Nic's FourCC Changer.lnk - C:\Program Files (x86)\Xvid\AviC.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Quantization Matrices.lnk - C:\Program Files (x86)\Xvid\Quantization Matrices
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Release Notes.lnk - C:\Program Files (x86)\Xvid\releasenotes.txt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\StatsReader 2.1.lnk - C:\Program Files (x86)\Xvid\StatsReader.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\StatsReader Notes.lnk - C:\Program Files (x86)\Xvid\statsreader.txt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Uninstall Xvid.lnk - C:\Program Files (x86)\Xvid\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\VIDC Cleaner.lnk - C:\Program Files (x86)\Xvid\vidccleaner.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Web Links\Doom10.lnk - C:\Program Files (x86)\Xvid\Links\doom10.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Web Links\Doom9.lnk - C:\Program Files (x86)\Xvid\Links\doom9.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Web Links\ffdshow Homepage.lnk - C:\Program Files (x86)\Xvid\Links\ffdshowhomepage.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Web Links\Jawor's Homepage.lnk - C:\Program Files (x86)\Xvid\Links\jaworshomepage.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Web Links\VideoAudio.PL.lnk - C:\Program Files (x86)\Xvid\Links\videoaudiopl.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid\Web Links\Xvid Homepage.lnk - C:\Program Files (x86)\Xvid\Links\xvidhomepage.url
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP\ZHPDiag.lnk - C:\Program Files (x86)\ZHPDiag\ZHPhep.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP\ZHPFix.lnk - C:\Program Files (x86)\ZHPDiag\ZHPFix\ZHPhep.exe

==== shortcuts in Quick Launch ======================

C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Acelerador de Vídeo Bywifi.lnk -  
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PhotoScape.lnk - C:\Program Files (x86)\PhotoScape\PhotoScape.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -  
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Transcodificador de Mídia Bywifi.lnk -  
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -  
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk -  
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk - C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Counter-Strike 1.6.lnk - C:\Program Files (x86)\Valve\hl.exe -nomaster -game cstrike fullscreen -w 1024 -h 768 -d3d
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk - C:\Windows\explorer.exe
C:\Users\Betao\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk - C:\Program Files (x86)\Windows Media Player\wmplayer.exe /prefetch:1
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -  
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -  
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -  
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -  
C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -  
C:\Users\DefaultAppPool\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -  
C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -  
C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -  

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Betao\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\Betao\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=559 folders=69 27111455 bytes)

==== Empty Temp Folders ======================

C:\Users\Betao\AppData\Local\Temp will be emptied at reboot
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\DefaultAppPool\AppData\Local\Temp emptied successfully
C:\Users\USURIO~1\AppData\Local\Temp emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Betao\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 15/03/2014 at 14:46:59,97 ======================

 Desative temporariamente seu antivírus para evitar conflitos.

Acesse este link abaixo e clique no primeiro botão da esquerda que é o botão Download Zoek.exe:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

*Clique com o botão direito do mouse no Zoek.exe e selecione [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

* Copie todo este texto destacado em vermelho que te passei e cole-o no espaço em branco do Zoek

*Clique [Run Script]

*Durante o scan uma mensagem parecida com esta abaixo mostrando o progresso do escaneamento será apresentada. Aguarde o término...pode demorar!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

*Caso a reinicialização do PC seja solicitada, clique [OK]

* Poste o log do Zoek que estará em C:\zoek-results.txt em sua próxima resposta.

Zoek.exe v5.0.0.0 Updated 07-March-2014
Tool run by Betao on 15/03/2014 at 15:04:23,77.
Microsoft Windows 7 Ultimate  6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Betao\Downloads\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2014-03-15-131000.log 43171 bytes
C:\zoek-results2014-03-15-174659.log 35293 bytes

==== System Restore Info ======================

15/03/2014 15:05:47 Zoek.exe System Restore Point Created Succesfully.

==== Folders Found ======================

2014-03-14 21:50:15 2014-03-14 21:50:15 -------- d-----w- C:\AdwCleaner\Quarantine\C\ProgramData\baidu
2014-03-11 00:42:38 2014-03-11 00:42:39 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Antivirus-10032014-214238
2014-03-11 15:58:48 2014-03-11 15:58:48 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Antivirus-11032014-125848
2014-03-14 14:51:00 2014-03-14 14:51:00 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Antivirus-14032014-115100
2014-03-11 16:34:32 2014-03-11 16:34:32 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-11032014-133432
2014-03-11 16:49:06 2014-03-11 16:49:06 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-11032014-134906
2014-03-11 18:38:26 2014-03-11 18:38:26 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-11032014-153826
2014-03-12 16:30:39 2014-03-12 16:30:39 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-12032014-133039
2014-03-13 13:36:54 2014-03-13 13:36:54 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-13032014-103654
2014-03-15 17:40:17 2014-03-15 17:40:17 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security
2014-03-15 17:40:17 2014-03-14 21:52:05 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_Baidu Antivirus
2014-03-15 17:40:17 2014-03-15 17:40:17 -------- d---a-w- C:\zoek_backup\C_ProgramData_Baidu Security
2014-03-15 17:40:17 2014-03-15 17:40:17 -------- d---a-w- C:\zoek_backup\C_Users_All Users_Baidu Security
2014-03-15 17:40:17 2014-03-15 17:40:17 -------- d---a-w- C:\zoek_backup\C_Users_Betao_AppData_Roaming_BaiduPcFaster
2014-03-15 17:40:18 2014-03-15 17:40:18 -------- d---a-w- C:\zoek_backup\C_Users_Public_Documents_Baidu Security
2014-03-15 17:40:17 2014-03-14 21:52:05 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\Baidu Antivirus

==== Files Found ======================


==== Registry Search Results for "Baidu" ======================


[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP\Temp]

"BAV mini setup"="\"C:\\ProgramData\\Baidu\\Antivirus\\BavPro_Setup_Mini_051[1].exe\" /S /NOTRAY partner=RebootRun"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"="Baidu ProtectEx"

==== C:\zoek_backup content ======================

C:\zoek_backup (files=559 folders=69 27111455 bytes)

==== EOF on 15/03/2014 at 15:08:25,85 ======================

 Desative temporariamente seu antivírus para evitar conflitos.

*Clique com o botão direito do mouse no Zoek.exe e selecione [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

* Copie todo este texto destacado em vermelho que te passei e cole-o no espaço em branco do Zoek

*Clique [Run Script]

*Durante o scan uma mensagem parecida com esta abaixo mostrando o progresso do escaneamento será apresentada. Aguarde o término...pode demorar!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

*Caso a reinicialização do PC seja solicitada, clique [OK]

* Poste o log do Zoek que estará em C:\zoek-results.txt em sua próxima resposta.

Zoek.exe v5.0.0.0 Updated 07-March-2014
Tool run by Betao on 15/03/2014 at 15:38:09,41.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Betao\Downloads\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2014-03-15-131000.log 43171 bytes
C:\zoek-results2014-03-15-174659.log 35293 bytes
C:\zoek-results2014-03-15-180825.log 5127 bytes

==== System Restore Info ======================

15/03/2014 15:38:36 Zoek.exe System Restore Point Created Succesfully.

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP]
[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP\Temp]
"BAV mini setup"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"=-

==== Folders Found ======================

2014-03-14 21:50:15 2014-03-14 21:50:15 -------- d-----w- C:\AdwCleaner\Quarantine\C\ProgramData\baidu
2014-03-11 00:42:38 2014-03-11 00:42:39 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Antivirus-10032014-214238
2014-03-11 15:58:48 2014-03-11 15:58:48 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Antivirus-11032014-125848
2014-03-14 14:51:00 2014-03-14 14:51:00 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Antivirus-14032014-115100
2014-03-11 16:34:32 2014-03-11 16:34:32 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-11032014-133432
2014-03-11 16:49:06 2014-03-11 16:49:06 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-11032014-134906
2014-03-11 18:38:26 2014-03-11 18:38:26 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-11032014-153826
2014-03-12 16:30:39 2014-03-12 16:30:39 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-12032014-133039
2014-03-13 13:36:54 2014-03-13 13:36:54 -------- d-----w- C:\Users\Betao\AppData\Local\VS Revo Group\Revo Uninstaller Pro\BackUpsData\Baidu Security-13032014-103654
2014-03-15 17:40:17 2014-03-15 17:40:17 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security
2014-03-15 17:40:17 2014-03-14 21:52:05 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_Baidu Antivirus
2014-03-15 17:40:17 2014-03-15 17:40:17 -------- d---a-w- C:\zoek_backup\C_ProgramData_Baidu Security
2014-03-15 17:40:17 2014-03-15 17:40:17 -------- d---a-w- C:\zoek_backup\C_Users_All Users_Baidu Security
2014-03-15 17:40:17 2014-03-15 17:40:17 -------- d---a-w- C:\zoek_backup\C_Users_Betao_AppData_Roaming_BaiduPcFaster
2014-03-15 17:40:18 2014-03-15 17:40:18 -------- d---a-w- C:\zoek_backup\C_Users_Public_Documents_Baidu Security
2014-03-15 17:40:17 2014-03-14 21:52:05 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\Baidu Antivirus

==== Files Found ======================


==== Registry Search Results for "Baidu" ======================


[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP\Temp]

"BAV mini setup"="\"C:\\ProgramData\\Baidu\\Antivirus\\BavPro_Setup_Mini_051[1].exe\" /S /NOTRAY partner=RebootRun"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"="Baidu ProtectEx"

==== C:\zoek_backup content ======================

C:\zoek_backup (files=559 folders=69 27111455 bytes)

==== EOF on 15/03/2014 at 15:39:33,09 ======================

|- Desabilite temporariamente seu antivírus para evitar conflitos
 
* Vá no menu: Iniciar > Todos os programas > ZHP > Execute o ZHPDiag

|- Clique "SEARCH" ou "PESQUISAR" e aguarde a conclusão!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
 
|- Clique OK e, ao concluir, poste o relatório ZHPDiag.txt

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

~ Relatório do ZHPDiag v2014.3.12.13 - Nicolas Coolman (12/03/2014)
~ Iniciado por Betao (15/03/2014 15:57:14)
~ Endereço do Website : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Fóruns de suporte gratuito para desinfecção : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Tradução pelo utilizador
~ Estatuto da versão :
~ Lista Branca : Ativado pelo programa
~ Elevação dos Privilégios : OK
~ Controle de Conta de Utilizador : Deactivate by user


---\\ Navegadores Internet
MSIE: Internet Explorer v11.0.9600.16521

---\\ Informações sobre os produtos Windows
~ Langage: Portugais
Windows 7 Ultimate, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ Softwares de proteçao do sistema
avast! Free Antivirus v9.0.2006
Malwarebytes Anti-Malware versão 1.75.0.1300
Windows Defender W7

---\\ Softwares d'optimização do sistema

---\\ Softwares de partilha do PeerToPeer (P2P)

---\\ Monitoramento dos softwares
Adobe Flash Player 12 Plugin
Adobe Reader XI
Java 7 Update 51

---\\ Informações sobre o sistema
~ Processor: Intel64 Family 6 Model 23 Stepping 10, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 2038 MB (44% free)
System Restore: Activé (Enable)
System drive C: has 177 GB (59%) free of 298 GB

---\\ Modo de conexão ao sistema
~ Computer Name: BETAO-PC
~ User Name: Betao
~ All Users Names: Convidado, Betao, Administrador,
~ Unselected Option: 045,061,O62,065,066,080,O82,089
Logged in as Administrator

---\\ As variáveis de ambiente
~ System Unit : C:\
~ %AppZHP% : C:\Users\Betao\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Betao\AppData\Roaming\
~ %Desktop% : C:\Users\Betao\Desktop\
~ %Favorites% : C:\Users\Betao\Favorites\
~ %LocalAppData% : C:\Users\Betao\AppData\Local\
~ %StartMenu% : C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumeração das unidades dos discos
C: Hard drive, Flash drive, Thumb drive (Free 177 Go of 298 Go)
D: CD-ROM drive (Not Inserted)
G: CD-ROM drive (Free 0 Go of 1 Go)



---\\ Estado do Centro de Segurança do Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
~ Security Center: 48 Legitimates Filtered in 00mn 00s



---\\ Pesquisa particular de ficheiros genéricos
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Windows Explorer.) (.25/02/2011 - 03:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Aplicativo de Inicialização do Windows.) (.13/07/2009 - 22:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.DF79CE9B950C62677D232154E93A81C7] - (.Microsoft Corporation - Internet Extensions para Win32.) (.01/03/2014 - 00:10:28.) -- C:\Windows\System32\wininet.dll [2334208]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Aplicativo de Logon do Windows.) (.20/11/2010 - 10:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Biblioteca de Licenciamento de Software.) (.20/11/2010 - 10:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.27/09/2013 - 22:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.13/07/2009 - 22:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 20:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 06:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 06:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 07:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Driver de porta i8042.) (.13/07/2009 - 20:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.13/07/2009 - 21:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.26/04/2011 - 23:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 06:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Driver do Sistema de Arquivos NT.) (.12/04/2013 - 11:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Driver de porta paralela.) (.13/07/2009 - 21:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 07:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.1B6163C503398B23FF8B939C67747683] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.20/11/2010 - 08:06:41.) -- C:\Windows\system32\Drivers\rdpdr.sys [165888]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.13/07/2009 - 21:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 06:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.20/11/2010 - 10:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s



---\\ Estatuto dos ficheiros ocultos (Oculto/Total)
~ Mes images (My Pictures) : 17/294
~ Mes musiques (My Musics) : 1/3
~ Mes Videos (My Videos) : 1/51
~ Mes Favoris (My Favorites) : 1/18
~ Mes Documents (My Documents) : 1/203
~ Mon Bureau (My Desktop) : 2/6870
~ Menu demarrer (Programs) : 1/43
~ Hidden Files: Scanned in 00mn 03s



---\\ Processos lançados
[MD5.4C944FC01424E8B14F979AE6011413A2] - (.Disc Soft Ltd - DAEMON Tools Shell Extensions Helper.) -- C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe [2748448] [PID.2668]
[MD5.7C0704D4523BA671AFE6D028399942D3] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastui.exe [3567800] [PID.2180]
[MD5.16AFB34618E1286FF856DC600AC49C79] - (.No owner - DivX Update.) -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968] [PID.2200]
[MD5.026C4CA19FAE1F84894A99735B15AACA] - (.Google Inc. - Google Chrome.) -- C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe [859464] [PID.2392]
[MD5.64A2A75D8F4BD07BD0A0029AA8825BBF] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8353792] [PID.332]
[MD5.4BE7EC02133544CDE7A580875E130208] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344] [PID.1056]
[MD5.B362181ED3771DC03B4141927C80F801] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65432] [PID.1764]
[MD5.A6CCD2E757C35B16A1A0DC5D9DC3FB84] - (...) -- C:\Windows\SysWOW64\LocalServer\service.exe [89992] [PID.1940]
~ Processes Running: Scanned in 00mn 00s



---\\ Google Chrome, Arranque,Pesquisa,Extensões (G0,G1,G2)
C:\Users\Betao\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [ahfgeienlihckogmohjhadlkjgocpleb] Loja v.0.2 (Activé)
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)
~ Google Browser: 15 Legitimates Filtered in 00mn 00s



---\\ Mozilla Firefox, Plugins,Arranque,Pesquisa,Extensões (P2,M0,M1,M2,M3)
P2 - FPN: [HKCU] [gastecnologia.com.br/sf/cef] - (.GAS Tecnologia - Internet Banking Helper.) -- C:\Users\Betao\AppData\Local\GAS Tecnologia\GBBD\npsf_cef.dll
~ Firefox Browser: 6 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Gestão do Proxy (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Redireção do ficheiro Hosts (01)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Barras do Internet Explorer (03))
O3 - Toolbar: avast! Online Security - [HKLM]{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} . (.AVAST Software - IE Webrep plugin.) -- C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
~ Toolbar: Scanned in 00mn 00s



---\\ Outras conexões do utilizador (04)
O4 - GS\Desktop [Public]: Ashampoo Burning Studio 6 FREE.lnk . (.ashampoo Technology GmbH & Co. KG - Burning Studio 6 Free.) -- C:\Program Files (x86)\Ashampoo\Ashampoo Burning Studio 6 FREE\burningstudio.exe
O4 - GS\Desktop [Public]: EPSON Scan.lnk . (.SEIKO EPSON CORP. - EPSON Scan.) -- C:\Windows\twain_32\escndv\escndv.exe
O4 - GS\Desktop [Public]: Game option.lnk . (...) -- C:\Windows\USB Vibration\dr100&110\GameControler.exe
O4 - GS\Desktop [Public]: MPC-HC.lnk . (.MPC-HC Team - MPC-HC.) -- C:\Program Files (x86)\MPC-HC\mpc-hc.exe
O4 - GS\Desktop [Public]: VDownloader.lnk . (.Vitzo - VDownloader.) -- C:\Program Files\VDownloader\VDownloader.exe
O4 - GS\Program [Public]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - GS\Program [Public]: Internet Explorer (64-bit).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Program [Public]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch [Betao]: Acelerador de Vídeo Bywifi.lnk . (...) -- C:\Program Files (x86)\Bywifi\bywifi.exe (.not file.) =>Spyware.Bywifi
O4 - GS\QuickLaunch [Betao]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Betao]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch [Betao]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch [Betao]: PhotoScape.lnk . (...) -- C:\Program Files (x86)\PhotoScape\PhotoScape.exe
O4 - GS\QuickLaunch [Betao]: Transcodificador de Mídia Bywifi.lnk . (...) -- C:\Program Files (x86)\Bywifi\bywifidl.exe (.not file.) =>Spyware.Bywifi
O4 - GS\QuickLaunch [Betao]: µTorrent.lnk . (.BitTorrent, Inc. - µTorrent.) -- C:\Program Files (x86)\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\TaskBar [Betao]: Counter-Strike 1.6.lnk . (.Valve - Half-Life Launcher.) -- C:\Program Files (x86)\Valve\hl.exe
O4 - GS\TaskBar [Betao]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - GS\TaskBar [Betao]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Program [Betao]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - GS\Program [Betao]: Internet Explorer (64-bit).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Program [Betao]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [Betao]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Betao]: Acelerador de Vídeo Bywifi.lnk . (...) -- C:\Program Files (x86)\Bywifi\bywifi.exe (.not file.) =>Spyware.Bywifi
O4 - GS\Desktop [Betao]: PhotoScape.lnk . (...) -- C:\Program Files (x86)\PhotoScape\PhotoScape.exe
O4 - GS\Desktop [Betao]: Transcodificador de Mídia Bywifi.lnk . (...) -- C:\Program Files (x86)\Bywifi\bywifidl.exe (.not file.) =>Spyware.Bywifi
~ Global Startup: 74 Legitimates Filtered in 00mn 01s



---\\ Aplicações iniciadas por registo & pastas (04)
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] . (.Disc Soft Ltd - DAEMON Tools Pro Agent.) -- C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe
O4 - HKCU\..\Run: [EPSON TX115 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIFBB.exe =>.Epson Seiko Corporation
O4 - HKLM\..\Wow6432Node\Run: [tuto4pc_br_36] Chave orfã =>PUP.AgenceExclusive
O4 - HKLM\..\Wow6432Node\Run: [AvastUI.exe] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
O4 - HKLM\..\Wow6432Node\Run: [BAV mini setup] C:\ProgramData\Baidu\Antivirus\BavPro_Setup_Mini_051[1].exe (.not file.)
O4 - HKLM\..\Wow6432Node\Run: [DivXUpdate] . (.No owner - DivX Update.) -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [SPReview] . (.Microsoft Corporation - SP Reviewer.) -- C:\Windows\System32\SPReview\SPReview.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-18\..\RunOnce: [SPReview] . (.Microsoft Corporation - SP Reviewer.) -- C:\Windows\System32\SPReview\SPReview.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2032486206-3458049535-1664191965-1000\..\Run: [DAEMON Tools Pro Agent] . (.Disc Soft Ltd - DAEMON Tools Pro Agent.) -- C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe
O4 - HKUS\S-1-5-21-2032486206-3458049535-1664191965-1000\..\Run: [EPSON TX115 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIFBB.exe =>.Epson Seiko Corporation
~ Application: Scanned in 00mn 00s



---\\ Site na zona confiavél do Internet Explorer (05)
O15 - Trusted Zone: [HKCU\...\Domains\www] *.bancobrasil.com.br
O15 - Trusted Zone: [HKCU\...\Domains\www] *.bb.com.br
O15 - Trusted Zone: [HKCU\...\Domains\www] *.caixa.gov.br
O15 - Trusted Zone: [HKCU\...\Domains] http.hola.org
~ IE Zone Confiance: Scanned in 00mn 00s



---\\ Alteração Dominio/Clientes DNS (017)
O17 - HKLM\System\CCS\Services\Tcpip\..\{6E9F80D0-4D68-439D-8B15-E2D41615D3B1}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{6E9F80D0-4D68-439D-8B15-E2D41615D3B1}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{6E9F80D0-4D68-439D-8B15-E2D41615D3B1}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
~ Domain: Scanned in 00mn 00s



---\\ Protocolo adicional (018)
O18 - Handler: wlmailhtml [64Bits] - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} . (...) --
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s



---\\ Lista dos serviços NT não Microsoft e não desativados (023)
O23 - Service: LocalServiceSystem (LocalServiceSystem) . (...) - C:\Windows\SysWOW64\LocalServer\service.exe
O23 - Service: SpeedBit Update (SBUpd) . (...) - C:\Program Files\Common Files\SpeedBit\SBUpdate\sbu.exe (.not file.)
~ Services: 5 Legitimates Filtered in 00mn 05s



---\\ Tarefas planificadas automaticamente (039)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\DriverEasy Scheduled Scan.job [406]
[MD5.00000000000000000000000000000000] [APT] [DriverEasy Scheduled Scan] (...) -- C:\Program Files\Easeware\DriverEasy\DriverEasy.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [SBW_UpdateTask_Time_323333303337383030302d3437415a556c2a3223346c41] (...) -- C:\ProgramData\SpeedBit\sbhe.js" sbu.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{0A2ACAFB-E751-4645-A5DD-28283C48D565}] (...) -- C:\Users\Betao\Desktop\SETUP\DEVICEOP.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{0B6EC691-3F21-43C4-9D67-EF9BE041C8FD}] (...) -- D:\TX115_x86_66101APS_C1.exe (.not file.) [0]
[MD5.CDEC84EFA7E61E09F8F344F1A151BA59] [APT] [{2614A0FC-BA30-4A01-8BC3-F71D5C080A63}] (...) -- C:\Windows\'Full Speed' Internet Booster\uninstall.exe [574464]
[MD5.00000000000000000000000000000000] [APT] [{3FB5A75F-E1D5-446F-920D-6A27056639D5}] (...) -- C:\Program Files (x86)\Counter-Strike 1.6\cstrike.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{4A1FB7BC-9ADA-4368-8220-9DF2344A4FCD}] (...) -- C:\Program Files (x86)\Condition Zero\hl.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{57B69D33-EF8D-40FB-8358-87FB64CCDBE7}] (...) -- D:\setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{79A23675-6FA9-4930-8077-ABF2135B0762}] (...) -- D:\setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{82252345-F1A9-4661-839D-958454F1EDD1}] (...) -- C:\Program Files (x86)\Moo0\AudioEffecter 1.23\uninstaller.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{89B49D2A-6C36-46BA-A5AC-5865C73D2C87}] (...) -- C:\Users\Betao\Downloads\TX115_x86_66101APS_C1.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{89D5044B-8D21-4208-B01D-6BBF68A42970}] (...) -- C:\Users\Betao\Downloads\11254_half-life_counter-strike_mod_16_1.6.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{8A94F345-AC5F-4AD4-B1ED-7655EFC8869C}] (...) -- C:\Users\Betao\Desktop\tx115_x64_660aps_c1.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{8B6C465E-CCFE-4436-900D-76EFA408265D}] (...) -- C:\Users\Betao\Desktop\windows 8\setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{923C564B-0B54-4BEC-8F9C-F9791B1A2632}] (...) -- C:\Program Files (x86)\Counter-Strike 1.6\cstrike.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{92751747-6B48-47AC-A20F-B288BBA5FA5F}] (...) -- C:\Users\Betao\Downloads\TX115_x86_66101APS_C1 (1).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{A02FB06C-D2E2-4873-85BE-1AC5B0DC7A1C}] (...) -- C:\Users\Betao\Downloads\TX115_x86_66101APS_C1 (1).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{A52050C9-6C05-4E83-86CB-E88E69EBEB89}] (...) -- C:\Users\Betao\Downloads\igbpceffull.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{A53D09A0-7897-4C77-8FB4-9AE1F8A863A9}] (...) -- C:\Program Files (x86)\Counter-Strike 1.6\cstrike.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{C45D325E-0ED2-4853-A2A8-B6EEBABDB7B2}] (...) -- C:\Users\Betao\Downloads\Moo0 AudioEffecter 1_23 Installer.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{C9FB6161-C67D-4C7A-93AC-D789F2DA6768}] (...) -- C:\Program Files (x86)\CoolSMS\unins000.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{E8DEEBD7-39CC-4949-87A8-1DD7BFA1895D}] (...) -- C:\Users\Betao\Downloads\dxwebsetup (2).exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{ECFB7957-1440-42C9-A361-817349F93C55}] (...) -- C:\Program Files (x86)\VIVO INTERNET\uninst.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{F20586C5-2B96-4688-8FB6-C3F89246CC93}] (...) -- C:\Users\Betao\Desktop\Setup.exe (.not file.) [0]
~ Scheduled Task: 48 Legitimates Filtered in 00mn 04s



---\\ Software instalados (042)
O42 - Logiciel: Bywifi 2.8.1 - (.bywifi.com.) [HKLM][64Bits] -- Bywifi =>Spyware.Bywifi
O42 - Logiciel: Módulo Adicional de Segurança CAIXA - (...) [HKLM][64Bits] -- {5d01f486-f32d-462e-8830-cc1d116e8ece}_is1
O42 - Logiciel: ZBOT - (...) [HKLM][64Bits] -- ZBOT
~ Logic: 20 Legitimates Filtered in 00mn 00s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\AutoHelpDesk]
[HKCU\Software\Bywifi] =>Spyware.Bywifi
[HKCU\Software\GbAs]
[HKCU\Software\SpeedBit]
[HKCU\Software\labDV.com]
[HKCU\Software\tudodownloads]
[HKCU\Software\ziggi]
[HKLM\Software\Baidu Security] =>Adware.BDSearch
[HKLM\Software\SpeedBit]
[HKLM\Software\Wow6432Node\AutoHelpDesk]
[HKLM\Software\Wow6432Node\Baidu_Drp_pos] =>Adware.BDSearch
[HKLM\Software\Wow6432Node\Sakura]
[HKLM\Software\Wow6432Node\SpeedBit]
~ Key Software: 273 Legitimates Filtered in 00mn 00s



---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 28/10/2013 - 10:44:13 - [0,013] ----D C:\Program Files (x86)\Curriculum 3.1
O43 - CFD: 09/03/2014 - 20:36:28 - [0] ----D C:\Program Files (x86)\Oasis Games Limited
O43 - CFD: 07/03/2014 - 18:59:58 - [0] ----D C:\Program Files (x86)\RBM
O43 - CFD: 07/03/2014 - 14:08:40 - [0] ----D C:\Program Files (x86)\Common Files\SpeedBit
O43 - CFD: 09/03/2014 - 20:41:32 - [0] ----D C:\ProgramData\HostIt
O43 - CFD: 08/03/2014 - 21:40:59 - [27,645] -SH-D C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
O43 - CFD: 10/03/2013 - 10:54:35 - [0] ----D C:\Users\Betao\AppData\Roaming\GoPlayer
O43 - CFD: 20/03/2013 - 20:06:41 - [0] ----D C:\Users\Betao\AppData\Roaming\PCF
O43 - CFD: 05/02/2014 - 04:31:25 - [12,613] ----D C:\Users\Betao\AppData\Roaming\VIVO INTERNET
O43 - CFD: 13/07/2013 - 17:00:22 - [0,047] ----D C:\Users\Betao\AppData\Local\Ares
O43 - CFD: 07/03/2014 - 10:56:00 - [0,025] ----D C:\Users\Betao\AppData\Local\labDV.com
O43 - CFD: 12/06/2013 - 21:40:17 - [0,064] ----D C:\Users\Betao\AppData\Local\MediaBA
O43 - CFD: 20/02/2014 - 15:42:27 - [0,001] ----D C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZBOT
O43 - CFD: 30/03/2013 - 12:00:40 - [0] ----D C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\°²»úÍø
~ Program Folder: 193 Legitimates Filtered in 00mn 01s



---\\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044)
O44 - LFC:[MD5.7B59D275F7EF711781A35988ECC0FF0C] - 02/03/2014 - 16:41:29 ---A- . (...) -- C:\Windows\System32\prfc0416.dat [956686]
O44 - LFC:[MD5.999401F174E5E7F071A488C7FADBE978] - 02/03/2014 - 16:41:29 ---A- . (...) -- C:\Windows\System32\prfh0416.dat [1654314]
O44 - LFC:[MD5.37F5CDA64FC515B3072531C1187EDCCA] - 06/03/2014 - 17:30:12 ---A- . (.Baidu, Inc. - Baidu Antivirus Minifilter Driver.) -- C:\Windows\System32\Drivers\Bfilter.sys [52032]
O44 - LFC:[MD5.DFC1681F6645CB2AEA83897588F05362] - 06/03/2014 - 17:30:13 ---A- . (.Baidu, Inc. - Baidu FS Monitor Driver.) -- C:\Windows\System32\Drivers\Bfmon.sys [34624] =>Adware.BDSearch
O44 - LFC:[MD5.F4C1984178175ACE4A75BE23059C3E0A] - 06/03/2014 - 17:30:14 ---A- . (.Baidu, Inc. - Baidu Antivirus Selfprotect Driver.) -- C:\Windows\System32\Drivers\Bprotect.sys [128992]
O44 - LFC:[MD5.8E4A2031C4CABDE2783A301B91826D1E] - 07/03/2014 - 11:13:34 ---A- . (.Hola Networks Ltd. - Hola Network Monitor Driver.) -- C:\Windows\System32\Drivers\hola_mon_drv.sys [88984]
O44 - LFC:[MD5.815372073DA85B2098A37DED84083C8A] - 09/03/2014 - 20:44:07 ---A- . (...) -- C:\Windows\_MSRSTRT.EXE [2560]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 11/03/2014 - 11:19:56 ---A- . (...) -- C:\autoexec.bat [0]
O44 - LFC:[MD5.576BEDA40EF5136F7B8570BF37C9A656] - 11/03/2014 - 16:10:16 ---A- . (.No owner - Setup/Uninstall.) -- C:\Windows\unins000.exe [1169609]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 11/03/2014 - 16:10:38 ---A- . (...) -- C:\LIL69F9.tmp [0]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 11/03/2014 - 16:10:38 ---A- . (...) -- C:\LIL6A18.tmp [0]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 11/03/2014 - 16:10:38 ---A- . (...) -- C:\LIL6A28.tmp [0]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 11/03/2014 - 16:10:38 ---A- . (...) -- C:\LIL6A29.tmp [0]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 11/03/2014 - 16:10:38 ---A- . (...) -- C:\LIL6A38.tmp [0]
O44 - LFC:[MD5.F9C4F37E8E3E79AA36330A60D25C8296] - 11/03/2014 - 16:11:18 ---A- . (...) -- C:\Windows\unins000.dat [176885]
O44 - LFC:[MD5.D8D777CABFD17B12E3561FA41598B499] - 15/03/2014 - 14:46:59 ---A- . (...) -- C:\zoek-results2014-03-15-174659.log [35293]
O44 - LFC:[MD5.2C74C4391BA729BEAE097268987F387E] - 15/03/2014 - 15:08:25 ---A- . (...) -- C:\zoek-results2014-03-15-180825.log [5127]
O44 - LFC:[MD5.3F7C692987810144CD2A6BAC0DDA744D] - 15/03/2014 - 15:39:33 ---A- . (...) -- C:\zoek-results.log [4335]
~ Files: 71 Legitimates Filtered in 00mn 18s



---\\ Chave do registo Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{21875082-7ded-11e3-b16b-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{44188902-6eea-11e3-827b-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{463d2447-cf9c-11e2-9636-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{49eec246-c6e3-11e2-9198-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{49eec265-c6e3-11e2-9198-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{49eec271-c6e3-11e2-9198-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{49eec292-c6e3-11e2-9198-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{4d3a5422-c6fa-11e2-b979-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{4d3a5434-c6fa-11e2-b979-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{4fca9902-7b01-11e3-98f3-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{4fca9910-7b01-11e3-98f3-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{4fca991e-7b01-11e3-98f3-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{6c692162-c7c4-11e1-8908-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{6c69218f-c7c4-11e1-8908-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{8a422cfc-5b76-11e3-814c-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{9b49b3f7-d36b-11e2-b7e1-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{9b49b42d-d36b-11e2-b7e1-0025222fdd47}\AutoRun\command. (.Electronic Arts Inc. - InstallKitWizard7.) -- G:\Setup.exe
O51 - MPSK:{ae28540e-d10d-11e1-9d58-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{b2b09236-10af-11e3-b863-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{b2b09243-10af-11e3-b863-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{b2e68793-e714-11e1-8831-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{b89671fd-6eeb-11e3-bba5-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{b896720f-6eeb-11e3-bba5-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{bfda1368-7e9d-11e3-8d87-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{e4707643-57a3-11e3-8176-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{ed9f5f62-18db-11e3-b684-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{ed9f5f70-18db-11e3-b684-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{ed9f5f9f-18db-11e3-b684-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{ed9f5faa-18db-11e3-b684-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{ed9f5fb8-18db-11e3-b684-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{f06ff08a-6a4e-11e3-bab8-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{f06ff09a-6a4e-11e3-bab8-0025222fdd47}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
~ Keys: Scanned in 00mn 00s



---\\ Enumeração das chaves do registo PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 18 Legitimates Filtered in 00mn 00s



---\\ Enumeração das chaves do registo PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoLowDiskSpaceChecks"=1
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 6 Legitimates Filtered in 00mn 00s



---\\ Lista dos drivers do sistema (SDL) (O58)
O58 - SDL:[MD5.C04F7B373881009D7994D9BF55D24AB4] - 28/10/2013 - 14:46:47 ---A- . (...) -- C:\Windows\System32\Drivers\aswRvrt.sys [65776]
O58 - SDL:[MD5.59787B95DD9CA44CB139D96863438587] - 28/10/2013 - 14:46:47 ---A- . (...) -- C:\Windows\System32\Drivers\aswVmm.sys [205320]
O58 - SDL:[MD5.37F5CDA64FC515B3072531C1187EDCCA] - 21/01/2014 - 11:14:40 ---A- . (.Baidu, Inc. - Baidu Antivirus Minifilter Driver.) -- C:\Windows\System32\Drivers\Bfilter.sys [52032]
O58 - SDL:[MD5.DFC1681F6645CB2AEA83897588F05362] - 21/01/2014 - 11:14:50 ---A- . (.Baidu, Inc. - Baidu FS Monitor Driver.) -- C:\Windows\System32\Drivers\Bfmon.sys [34624] =>Adware.BDSearch
O58 - SDL:[MD5.F4C1984178175ACE4A75BE23059C3E0A] - 21/01/2014 - 07:01:36 ---A- . (.Baidu, Inc. - Baidu Antivirus Selfprotect Driver.) -- C:\Windows\System32\Drivers\Bprotect.sys [128992]
O58 - SDL:[MD5.46571ED73AE84469DCA53081D33CF3C8] - 12/06/2013 - 19:43:54 ---A- . (.DT Soft Ltd - DAEMON Tools Virtual Bus Driver.) -- C:\Windows\System32\Drivers\dtsoftbus01.sys [283200]
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 13/07/2009 - 22:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 17:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:[MD5.8E4A2031C4CABDE2783A301B91826D1E] - 07/03/2014 - 11:13:34 ---A- . (.Hola Networks Ltd. - Hola Network Monitor Driver.) -- C:\Windows\System32\Drivers\hola_mon_drv.sys [88984]
O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 13/07/2009 - 22:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
~ Drivers: 18 Legitimates Filtered in 00mn 03s



---\\ Lista das ferramentas de remoção de vírus (LAT) (063)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Menu de inicialização Internet (068)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- c:\users\betao\appdata\local\google\chrome\application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- c:\program files\internet explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s



---\\ Pesquisa de infeção nos navegadores da Internet (SBI) (069)
O69 - SBI: SearchScopes [HKCU] Web - (Web) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {0191A6B0-1154-4C22-9182-23A95BBE92D9} - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {05046B93-CC41-4CF5-84CF-3AC3004B22A7} - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} [DefaultScope] - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKUS\.DEFAULT] {0191A6B0-1154-4C22-9182-23A95BBE92D9} - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKUS\S-1-5-18] {0191A6B0-1154-4C22-9182-23A95BBE92D9} - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Keys: Scanned in 00mn 00s



---\\ Pesquisa adicional à raiz do sistema (radicular) (SPRF) (O84)
[MD5.005E451045A9C8A959C5FFDBC5B6FC20] [SPRF][10/06/2013] (...) -- C:\Users\Betao\AppData\Roaming\unins000.dat [24371]
[MD5.DF463B4C69C1531D1DA7DA3E30E7F8B5] [SPRF][07/03/2014] (...) -- C:\Users\Betao\Desktop\411-vlc-2.1.3-win32.exe [24677393]
[MD5.DF06DC5837316EA78746E3F790A950ED] [SPRF][14/03/2014] (...) -- C:\Users\Betao\Desktop\AdwCleaner.exe [1950720]
[MD5.8C78E50E45E548EEB7898BAA16413C96] [SPRF][22/06/2012] (...) -- C:\Users\Betao\Desktop\aresregular218_installer.exe [3006984]
~ Files: 5 Legitimates Filtered in 00mn 00s



---\\ Lista das exceções do FireWall (FirewallRules) (O87)
O87 - FAEL: "TCP Query User{E4A0C393-16BF-4769-8B71-B7969DB5C608}D:\easysetupassistant\wr741n\easysetupassistant.exe" |In - Private - P6 - TRUE | .(...) -- D:\easysetupassistant\wr741n\easysetupassistant.exe (.not file.)
O87 - FAEL: "UDP Query User{EE931308-488A-4E3F-9AE2-4C60BD90D13D}D:\easysetupassistant\wr741n\easysetupassistant.exe" |In - Private - P17 - TRUE | .(...) -- D:\easysetupassistant\wr741n\easysetupassistant.exe (.not file.)
O87 - FAEL: "TCP Query User{AA102844-6D57-4073-A34C-32C5F1CF622B}C:\program files (x86)\bywifi\bywifi.exe" |In - Private - P6 - TRUE | .(...) -- C:\program files (x86)\bywifi\bywifi.exe (.not file.) =>Spyware.Bywifi
O87 - FAEL: "UDP Query User{BE4AF6BA-55F5-452A-BEC9-E06470E1602B}C:\program files (x86)\bywifi\bywifi.exe" |In - Private - P17 - TRUE | .(...) -- C:\program files (x86)\bywifi\bywifi.exe (.not file.) =>Spyware.Bywifi
~ Firewall: 211 Legitimates Filtered in 00mn 00s



---\\ Estado general dos serviços não Microsoft (EGS) (SR=Executados, SS=Parados)
SS - | Disabled 09/03/2014 257928 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 29/07/2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 29/07/2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Auto 10/07/1658 0 | (SBUpd) . (...) - C:\Program Files\Common Files\SpeedBit\SBUpdate\sbu.exe
SS - | Disabled 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation

SR - | Auto 21/12/2013 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 28/10/2013 50344 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SR - | Auto 17/12/2007 163840 | (EPSON_EB_RPCV4_01) . (.SEIKO EPSON CORPORATION.) - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.exe
SR - | Auto 11/01/2007 126464 | (EPSON_PM_RPCV4_01) . (.SEIKO EPSON CORPORATION.) - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.exe
SR - | Auto 08/03/2014 89992 | (LocalServiceSystem) . (...) - C:\Windows\SysWOW64\LocalServer\service.exe
SR - | Auto 13/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 13/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

~ Services: Scanned in 00mn 06s



---\\ Scâner Aditional (088)
Database Version : 13031 - (12/03/2014)
Clés trouvées (Keys found) : 11
Valeurs trouvées (Values found) : 6
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 3

[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Bywifi] =>Spyware.Bywifi^
[HKCU\Software\Bywifi] =>Spyware.Bywifi
[HKLM\Software\Wow6432Node\Bywifi] =>Spyware.Bywifi
[HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bywifi] =>Spyware.Bywifi
[HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASAPI32] =>Toolbar.Bing
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyUpdate] =>PUP.DealPly
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375] =>PUP.Tarma
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5] =>PUP.Tarma
[HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\eSafeSvc] =>PUP.eSafeSecurity
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyLiveUpdateTaskMachineCore] =>PUP.DealPly
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyLiveUpdateTaskMachineUA] =>PUP.DealPly
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:tuto4pc_br_36 =>PUP.AgenceExclusive^
O4 - HKLM\..\Wow6432Node\Run: [tuto4pc_br_36] Chave orfã =>PUP.AgenceExclusive^
[HKLM\Software\Baidu Security] =>Adware.BDSearch^
[HKLM\Software\Wow6432Node\Baidu_Drp_pos] =>Adware.BDSearch^
~ Additionnel Scan: 188878 Items scanned in 00mn 19s



---\\ Sumário das deteções encontradas na sua estação
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Spyware.Bywifi
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Adware.BDSearch
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.DealPly
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Tarma
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.eSafeSecurity
~ MSI: 5 link(s) detected in 00mn 19s



~ 1163 Legitimates filtered by white list
End of the scan (527 lines in 01mn 19s)(0)

 Selecione e copie todo o texto destacado em vermelho que te passei (começando em script zhpfix e indo até emptyclsid)
____________________________________________________________________________________________________________

 Vá no menu: Iniciar > Todos os programas > ZHP > Clique com o botão direito do mouse sobre o Zhpfix e escolha a opção de Executar como administrador > Clique em Importação > Clique no botão GO > Clique em Oui > Caso queira que os arquivos da lixeira sejam excluídos clique em Oui novamente > Um relatório aparecerá no bloco de notas.

Copie este relatório e poste em sua próxima resposta.

Rapport de ZHPFix 2014.3.12.3 par Nicolas Coolman, Update du 12/03/2014
Fichier d'export Registre :
Run by Betao at 15/03/2014 17:26:53
High Elevated Privileges : OK
Windows 7 Ultimate Edition, 64-bit Service Pack 1 (Build 7601)

Reciclagem vazia (00mn 04s)
Reparação de atalhos do navegador

========== Softwares ==========
AUSENTE Uninstall Process: c:\program files (x86)\bywifi\uninst.exe

========== Chaves do Registo ==========
ELIMINÉ Logiciel Key: [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Bywifi]
ELIMINÉ: Service: SBUpd
ELIMINÉ: HKCU\Software\Bywifi
ELIMINÉ:* HKLM\Software\Baidu Security
ELIMINÉ: HKLM\Software\Wow6432Node\Baidu_Drp_pos
ELIMINÉ CLSID MPSK: {21875082-7ded-11e3-b16b-0025222fdd47}
ELIMINÉ CLSID MPSK: {44188902-6eea-11e3-827b-0025222fdd47}
ELIMINÉ CLSID MPSK: {463d2447-cf9c-11e2-9636-0025222fdd47}
ELIMINÉ CLSID MPSK: {49eec246-c6e3-11e2-9198-0025222fdd47}
ELIMINÉ CLSID MPSK: {49eec265-c6e3-11e2-9198-0025222fdd47}
ELIMINÉ CLSID MPSK: {49eec271-c6e3-11e2-9198-0025222fdd47}
ELIMINÉ CLSID MPSK: {49eec292-c6e3-11e2-9198-0025222fdd47}
ELIMINÉ CLSID MPSK: {4d3a5422-c6fa-11e2-b979-0025222fdd47}
ELIMINÉ CLSID MPSK: {4d3a5434-c6fa-11e2-b979-0025222fdd47}
ELIMINÉ CLSID MPSK: {4fca9902-7b01-11e3-98f3-0025222fdd47}
ELIMINÉ CLSID MPSK: {4fca9910-7b01-11e3-98f3-0025222fdd47}
ELIMINÉ CLSID MPSK: {4fca991e-7b01-11e3-98f3-0025222fdd47}
ELIMINÉ CLSID MPSK: {6c692162-c7c4-11e1-8908-0025222fdd47}
ELIMINÉ CLSID MPSK: {6c69218f-c7c4-11e1-8908-0025222fdd47}
ELIMINÉ CLSID MPSK: {8a422cfc-5b76-11e3-814c-0025222fdd47}
ELIMINÉ CLSID MPSK: {9b49b3f7-d36b-11e2-b7e1-0025222fdd47}
ELIMINÉ CLSID MPSK: {ae28540e-d10d-11e1-9d58-0025222fdd47}
ELIMINÉ CLSID MPSK: {b2b09236-10af-11e3-b863-0025222fdd47}
ELIMINÉ CLSID MPSK: {b2b09243-10af-11e3-b863-0025222fdd47}
ELIMINÉ CLSID MPSK: {b2e68793-e714-11e1-8831-0025222fdd47}
ELIMINÉ CLSID MPSK: {b89671fd-6eeb-11e3-bba5-0025222fdd47}
ELIMINÉ CLSID MPSK: {b896720f-6eeb-11e3-bba5-0025222fdd47}
ELIMINÉ CLSID MPSK: {bfda1368-7e9d-11e3-8d87-0025222fdd47}
ELIMINÉ CLSID MPSK: {e4707643-57a3-11e3-8176-0025222fdd47}
ELIMINÉ CLSID MPSK: {ed9f5f62-18db-11e3-b684-0025222fdd47}
ELIMINÉ CLSID MPSK: {ed9f5f70-18db-11e3-b684-0025222fdd47}
ELIMINÉ CLSID MPSK: {ed9f5f9f-18db-11e3-b684-0025222fdd47}
ELIMINÉ CLSID MPSK: {ed9f5faa-18db-11e3-b684-0025222fdd47}
ELIMINÉ CLSID MPSK: {ed9f5fb8-18db-11e3-b684-0025222fdd47}
ELIMINÉ CLSID MPSK: {f06ff08a-6a4e-11e3-bab8-0025222fdd47}
ELIMINÉ CLSID MPSK: {f06ff09a-6a4e-11e3-bab8-0025222fdd47}
ELIMINÉ: HKLM\Software\Wow6432Node\Bywifi
ELIMINÉ: HKLM\Software\Wow6432Node\Microsoft\Tracing\BingBar_RASAPI32
ELIMINÉ:* HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyUpdate
ELIMINÉ:* HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375
ELIMINÉ:* HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5
ELIMINÉ: HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\eSafeSvc
ELIMINÉ:* HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyLiveUpdateTaskMachineCore
ELIMINÉ:* HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyLiveUpdateTaskMachineUA

========== Valores do Registo ==========
ELIMINÉ: TCP Query User{E4A0C393-16BF-4769-8B71-B7969DB5C608}D:\easysetupassistant\wr741n\easysetupassistant.exe
ELIMINÉ: UDP Query User{EE931308-488A-4E3F-9AE2-4C60BD90D13D}D:\easysetupassistant\wr741n\easysetupassistant.exe
ELIMINÉ: TCP Query User{AA102844-6D57-4073-A34C-32C5F1CF622B}C:\program files (x86)\bywifi\bywifi.exe
ELIMINÉ: UDP Query User{BE4AF6BA-55F5-452A-BEC9-E06470E1602B}C:\program files (x86)\bywifi\bywifi.exe
Ausente Valor Perfil Padrão: FirewallRaz :
Ausente Valor Perfil Domínio FirewallRaz :
ELIMINÉ: FirewallRaz (None) : {19E756FC-4F3E-4C2A-AB2E-DA0EB1251E01}
ProxyFix : Configuração proxy removida com sucesso
ELIMINÉ ProxyServer Value
ELIMINÉ ProxyEnable Value
ELIMINÉ EnableHttp1_1 Value
ELIMINÉ ProxyHttp1.1 Value
ELIMINÉ ProxyOverride Value

========== Pastas ==========
Nenhuma pasta CLSID local utilizador vazia

========== Ficheiros ==========
ELIMINÉ: c:\users\betao\appdata\roaming\microsoft\internet explorer\quick launch\acelerador de vídeo bywifi.lnk
ELIMINÉ: c:\users\betao\appdata\roaming\microsoft\internet explorer\quick launch\transcodificador de mídia bywifi.lnk
ELIMINÉ: c:\users\betao\desktop\acelerador de vídeo bywifi.lnk
ELIMINÉ: c:\users\betao\desktop\transcodificador de mídia bywifi.lnk
ELIMINA REINICIAR: c:\windows\system32\drivers\bfilter.sys
ELIMINA REINICIAR: c:\windows\system32\drivers\bfmon.sys
ELIMINA REINICIAR: c:\windows\system32\drivers\bprotect.sys
ELIMINÉ: c:\lil69f9.tmp
ELIMINÉ: c:\lil6a18.tmp
ELIMINÉ: c:\lil6a28.tmp
ELIMINÉ: c:\lil6a29.tmp
ELIMINÉ: c:\lil6a38.tmp
ELIMINÉ Temporários windows (4) (36.846.017 octets)
ELIMINÉ Flash Cookies (0) (0 octets)

========== Tarefa planificada ==========
ELIMINÉ: SBW_UpdateTask_Time_323333303337383030302d3437415a556c2a3223346c41
ELIMINÉ: {0A2ACAFB-E751-4645-A5DD-28283C48D565}
ELIMINÉ: {0B6EC691-3F21-43C4-9D67-EF9BE041C8FD}
ELIMINÉ: {3FB5A75F-E1D5-446F-920D-6A27056639D5}
ELIMINÉ: {4A1FB7BC-9ADA-4368-8220-9DF2344A4FCD}
ELIMINÉ: {57B69D33-EF8D-40FB-8358-87FB64CCDBE7}
ELIMINÉ: {79A23675-6FA9-4930-8077-ABF2135B0762}
ELIMINÉ: {82252345-F1A9-4661-839D-958454F1EDD1}
ELIMINÉ: {89B49D2A-6C36-46BA-A5AC-5865C73D2C87}
ELIMINÉ: {89D5044B-8D21-4208-B01D-6BBF68A42970}
ELIMINÉ: {8A94F345-AC5F-4AD4-B1ED-7655EFC8869C}
ELIMINÉ: {8B6C465E-CCFE-4436-900D-76EFA408265D}
ELIMINÉ: {923C564B-0B54-4BEC-8F9C-F9791B1A2632}
ELIMINÉ: {92751747-6B48-47AC-A20F-B288BBA5FA5F}
ELIMINÉ: {A02FB06C-D2E2-4873-85BE-1AC5B0DC7A1C}
ELIMINÉ: {A52050C9-6C05-4E83-86CB-E88E69EBEB89}
ELIMINÉ: {A53D09A0-7897-4C77-8FB4-9AE1F8A863A9}
ELIMINÉ: {C45D325E-0ED2-4853-A2A8-B6EEBABDB7B2}
ELIMINÉ: {C9FB6161-C67D-4C7A-93AC-D789F2DA6768}
ELIMINÉ: {E8DEEBD7-39CC-4949-87A8-1DD7BFA1895D}
ELIMINÉ: {ECFB7957-1440-42C9-A361-817349F93C55}
ELIMINÉ: {F20586C5-2B96-4688-8FB6-C3F89246CC93}

========== Restauração Sistema ==========
Ponto de restauro do sistema criado com sucesso

========== Outros ==========
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [SBW_UpdateTask_Time_323333303337383030302d3437415a556c2a3223346c41] (...) -- C:\ProgramData\SpeedBit\sbhe.js" sbu.exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{0A2ACAFB-E751-4645-A5DD-28283C48D565}] (...) -- C:\Users\Betao\Desktop\SETUP\DEVICEOP.exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{0B6EC691-3F21-43C4-9D67-EF9BE041C8FD}] (...) -- D:\TX115_x86_66101APS_C1.exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{3FB5A75F-E1D5-446F-920D-6A27056639D5}] (...) -- C:\Program Files (x86)\Counter-Strike 1.6\cstrike.exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{4A1FB7BC-9ADA-4368-8220-9DF2344A4FCD}] (...) -- C:\Program Files (x86)\Condition Zero\hl.exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{57B69D33-EF8D-40FB-8358-87FB64CCDBE7}] (...) -- D:\setup.exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{79A23675-6FA9-4930-8077-ABF2135B0762}] (...) -- D:\setup.exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{82252345-F1A9-4661-839D-958454F1EDD1}] (...) -- C:\Program Files (x86)\Moo0\AudioEffecter 1.23\uninstaller.exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{89B49D2A-6C36-46BA-A5AC-5865C73D2C87}] (...) -- C:\Users\Betao\Downloads\TX115_x86_66101APS_C1.exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{89D5044B-8D21-4208-B01D-6BBF68A42970}] (...) -- C:\Users\Betao\Downloads\11254_half-life_counter-strike_mod_16_1.6.exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{8A94F345-AC5F-4AD4-B1ED-7655EFC8869C}] (...) -- C:\Users\Betao\Desktop\tx115_x64_660aps_c1.exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{8B6C465E-CCFE-4436-900D-76EFA408265D}] (...) -- C:\Users\Betao\Desktop\windows 8\setup.exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{923C564B-0B54-4BEC-8F9C-F9791B1A2632}] (...) -- C:\Program Files (x86)\Counter-Strike 1.6\cstrike.exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{92751747-6B48-47AC-A20F-B288BBA5FA5F}] (...) -- C:\Users\Betao\Downloads\TX115_x86_66101APS_C1 (1).exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{A02FB06C-D2E2-4873-85BE-1AC5B0DC7A1C}] (...) -- C:\Users\Betao\Downloads\TX115_x86_66101APS_C1 (1).exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{A52050C9-6C05-4E83-86CB-E88E69EBEB89}] (...) -- C:\Users\Betao\Downloads\igbpceffull.exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{A53D09A0-7897-4C77-8FB4-9AE1F8A863A9}] (...) -- C:\Program Files (x86)\Counter-Strike 1.6\cstrike.exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{C45D325E-0ED2-4853-A2A8-B6EEBABDB7B2}] (...) -- C:\Users\Betao\Downloads\Moo0 AudioEffecter 1_23 Installer.exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{C9FB6161-C67D-4C7A-93AC-D789F2DA6768}] (...) -- C:\Program Files (x86)\CoolSMS\unins000.exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{E8DEEBD7-39CC-4949-87A8-1DD7BFA1895D}] (...) -- C:\Users\Betao\Downloads\dxwebsetup (2).exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{ECFB7957-1440-42C9-A361-817349F93C55}] (...) -- C:\Program Files (x86)\VIVO INTERNET\uninst.exe (.not file.) [0]
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [{F20586C5-2B96-4688-8FB6-C3F89246CC93}] (...) -- C:\Users\Betao\Desktop\Setup.exe (.not file.) [0]


========== Recapitulativo ==========
44 : Chaves do Registo
13 : Valores do Registo
1 : Pastas
14 : Ficheiros
1 : Softwares
22 : Tarefa planificada
1 : Restauração Sistema
22 : Outros


End of clean in 01mn 15s

========== Caminho do ficheiro do relatório ==========
C:\Users\Betao\AppData\Roaming\ZHP\ZHPFix[R1].txt - 15/03/2014 17:26:58 [10385]

Abra novamente o ( ZHPDiag )

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
 
|- Clique "SEARCH" ou "PESQUISAR" e aguarde a conclusão.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
 
|- Clique OK e, ao concluir, poste o relatório ZHPDiag.txt

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

~ Relatório do ZHPDiag v2014.3.12.13 - Nicolas Coolman (12/03/2014)
~ Iniciado por Betao (15/03/2014 17:43:33)
~ Endereço do Website : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Fóruns de suporte gratuito para desinfecção : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Tradução pelo utilizador
~ Estatuto da versão :
~ Lista Branca : Ativado pelo programa
~ Elevação dos Privilégios : OK
~ Controle de Conta de Utilizador : Deactivate by user


---\\ Navegadores Internet
MSIE: Internet Explorer v11.0.9600.16521

---\\ Informações sobre os produtos Windows
~ Langage: Portugais
Windows 7 Ultimate, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ Softwares de proteçao do sistema
avast! Free Antivirus v9.0.2006
Malwarebytes Anti-Malware versão 1.75.0.1300
Windows Defender W7

---\\ Softwares d'optimização do sistema

---\\ Softwares de partilha do PeerToPeer (P2P)

---\\ Monitoramento dos softwares
Adobe Flash Player 12 Plugin
Adobe Reader XI
Java 7 Update 51

---\\ Informações sobre o sistema
~ Processor: Intel64 Family 6 Model 23 Stepping 10, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 2038 MB (46% free)
System Restore: Activé (Enable)
System drive C: has 177 GB (59%) free of 298 GB

---\\ Modo de conexão ao sistema
~ Computer Name: BETAO-PC
~ User Name: Betao
~ All Users Names: Convidado, Betao, Administrador,
~ Unselected Option: 045,061,O62,065,066,080,O82,089
Logged in as Administrator

---\\ As variáveis de ambiente
~ System Unit : C:\
~ %AppZHP% : C:\Users\Betao\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Betao\AppData\Roaming\
~ %Desktop% : C:\Users\Betao\Desktop\
~ %Favorites% : C:\Users\Betao\Favorites\
~ %LocalAppData% : C:\Users\Betao\AppData\Local\
~ %StartMenu% : C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumeração das unidades dos discos
C: Hard drive, Flash drive, Thumb drive (Free 177 Go of 298 Go)
D: CD-ROM drive (Not Inserted)
G: CD-ROM drive (Free 0 Go of 1 Go)



---\\ Estado do Centro de Segurança do Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
~ Security Center: 48 Legitimates Filtered in 00mn 00s



---\\ Pesquisa particular de ficheiros genéricos
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Windows Explorer.) (.25/02/2011 - 03:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Aplicativo de Inicialização do Windows.) (.13/07/2009 - 22:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.DF79CE9B950C62677D232154E93A81C7] - (.Microsoft Corporation - Internet Extensions para Win32.) (.01/03/2014 - 00:10:28.) -- C:\Windows\System32\wininet.dll [2334208]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Aplicativo de Logon do Windows.) (.20/11/2010 - 10:25:30.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Biblioteca de Licenciamento de Software.) (.20/11/2010 - 10:27:26.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.27/09/2013 - 22:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.13/07/2009 - 22:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 20:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 06:19:21.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 06:26:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 07:43:43.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Driver de porta i8042.) (.13/07/2009 - 20:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.13/07/2009 - 21:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.26/04/2011 - 23:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 06:23:20.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.B98F8C6E31CD07B2E6F71F7F648E38C0] - (.Microsoft Corporation - Driver do Sistema de Arquivos NT.) (.12/04/2013 - 11:45:08.) -- C:\Windows\system32\Drivers\ntfs.sys [1656680]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Driver de porta paralela.) (.13/07/2009 - 21:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 07:52:35.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.1B6163C503398B23FF8B939C67747683] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.20/11/2010 - 08:06:41.) -- C:\Windows\system32\Drivers\rdpdr.sys [165888]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.13/07/2009 - 21:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 06:21:56.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.20/11/2010 - 10:34:02.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s



---\\ Estatuto dos ficheiros ocultos (Oculto/Total)
~ Mes images (My Pictures) : 17/294
~ Mes musiques (My Musics) : 1/3
~ Mes Videos (My Videos) : 1/51
~ Mes Favoris (My Favorites) : 1/18
~ Mes Documents (My Documents) : 1/203
~ Mon Bureau (My Desktop) : 2/6868
~ Menu demarrer (Programs) : 1/43
~ Hidden Files: Scanned in 00mn 08s



---\\ Processos lançados
[MD5.7C0704D4523BA671AFE6D028399942D3] - (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\avastui.exe [3567800] [PID.2820]
[MD5.16AFB34618E1286FF856DC600AC49C79] - (.No owner - DivX Update.) -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968] [PID.2832]
[MD5.4C944FC01424E8B14F979AE6011413A2] - (.Disc Soft Ltd - DAEMON Tools Shell Extensions Helper.) -- C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe [2748448] [PID.3076]
[MD5.026C4CA19FAE1F84894A99735B15AACA] - (.Google Inc. - Google Chrome.) -- C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe [859464] [PID.3872]
[MD5.64A2A75D8F4BD07BD0A0029AA8825BBF] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8353792] [PID.188]
[MD5.4BE7EC02133544CDE7A580875E130208] - (.AVAST Software - avast! Service.) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344] [PID.1104]
[MD5.B362181ED3771DC03B4141927C80F801] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65432] [PID.1216]
[MD5.A6CCD2E757C35B16A1A0DC5D9DC3FB84] - (...) -- C:\Windows\SysWOW64\LocalServer\service.exe [89992] [PID.2488]
~ Processes Running: Scanned in 00mn 01s



---\\ Google Chrome, Arranque,Pesquisa,Extensões (G0,G1,G2)
C:\Users\Betao\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [ahfgeienlihckogmohjhadlkjgocpleb] Loja v.0.2 (Activé)
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)
~ Google Browser: 15 Legitimates Filtered in 00mn 00s



---\\ Mozilla Firefox, Plugins,Arranque,Pesquisa,Extensões (P2,M0,M1,M2,M3)
P2 - FPN: [HKCU] [gastecnologia.com.br/sf/cef] - (.GAS Tecnologia - Internet Banking Helper.) -- C:\Users\Betao\AppData\Local\GAS Tecnologia\GBBD\npsf_cef.dll
~ Firefox Browser: 6 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Gestão do Proxy (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Redireção do ficheiro Hosts (01)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Barras do Internet Explorer (03))
O3 - Toolbar: avast! Online Security - [HKLM]{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} . (.AVAST Software - IE Webrep plugin.) -- C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
~ Toolbar: Scanned in 00mn 00s



---\\ Outras conexões do utilizador (04)
O4 - GS\Desktop [Public]: Ashampoo Burning Studio 6 FREE.lnk . (.ashampoo Technology GmbH & Co. KG - Burning Studio 6 Free.) -- C:\Program Files (x86)\Ashampoo\Ashampoo Burning Studio 6 FREE\burningstudio.exe
O4 - GS\Desktop [Public]: EPSON Scan.lnk . (.SEIKO EPSON CORP. - EPSON Scan.) -- C:\Windows\twain_32\escndv\escndv.exe
O4 - GS\Desktop [Public]: Game option.lnk . (...) -- C:\Windows\USB Vibration\dr100&110\GameControler.exe
O4 - GS\Desktop [Public]: MPC-HC.lnk . (.MPC-HC Team - MPC-HC.) -- C:\Program Files (x86)\MPC-HC\mpc-hc.exe
O4 - GS\Desktop [Public]: VDownloader.lnk . (.Vitzo - VDownloader.) -- C:\Program Files\VDownloader\VDownloader.exe
O4 - GS\Program [Public]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - GS\Program [Public]: Internet Explorer (64-bit).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Program [Public]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch [Betao]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - GS\QuickLaunch [Betao]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch [Betao]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch [Betao]: PhotoScape.lnk . (...) -- C:\Program Files (x86)\PhotoScape\PhotoScape.exe
O4 - GS\QuickLaunch [Betao]: µTorrent.lnk . (.BitTorrent, Inc. - µTorrent.) -- C:\Program Files (x86)\uTorrent\uTorrent.exe =>P2P.BitTorrent
O4 - GS\TaskBar [Betao]: Counter-Strike 1.6.lnk . (.Valve - Half-Life Launcher.) -- C:\Program Files (x86)\Valve\hl.exe
O4 - GS\TaskBar [Betao]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - GS\TaskBar [Betao]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Program [Betao]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Users\Betao\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - GS\Program [Betao]: Internet Explorer (64-bit).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\Program [Betao]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
O4 - GS\SystemTools [Betao]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Desktop [Betao]: PhotoScape.lnk . (...) -- C:\Program Files (x86)\PhotoScape\PhotoScape.exe
~ Global Startup: 70 Legitimates Filtered in 00mn 03s



---\\ Aplicações iniciadas por registo & pastas (04)
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] . (.Disc Soft Ltd - DAEMON Tools Pro Agent.) -- C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe
O4 - HKCU\..\Run: [EPSON TX115 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIFBB.exe =>.Epson Seiko Corporation
O4 - HKLM\..\Wow6432Node\Run: [tuto4pc_br_36] Chave orfã =>PUP.AgenceExclusive
O4 - HKLM\..\Wow6432Node\Run: [AvastUI.exe] . (.AVAST Software - avast! Antivirus.) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
O4 - HKLM\..\Wow6432Node\Run: [BAV mini setup] C:\ProgramData\Baidu\Antivirus\BavPro_Setup_Mini_051[1].exe (.not file.)
O4 - HKLM\..\Wow6432Node\Run: [DivXUpdate] . (.No owner - DivX Update.) -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [SPReview] . (.Microsoft Corporation - SP Reviewer.) -- C:\Windows\System32\SPReview\SPReview.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-18\..\RunOnce: [SPReview] . (.Microsoft Corporation - SP Reviewer.) -- C:\Windows\System32\SPReview\SPReview.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-2032486206-3458049535-1664191965-1000\..\Run: [DAEMON Tools Pro Agent] . (.Disc Soft Ltd - DAEMON Tools Pro Agent.) -- C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe
O4 - HKUS\S-1-5-21-2032486206-3458049535-1664191965-1000\..\Run: [EPSON TX115 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIFBB.exe =>.Epson Seiko Corporation
~ Application: Scanned in 00mn 00s



---\\ Site na zona confiavél do Internet Explorer (05)
O15 - Trusted Zone: [HKCU\...\Domains\www] *.bancobrasil.com.br
O15 - Trusted Zone: [HKCU\...\Domains\www] *.bb.com.br
O15 - Trusted Zone: [HKCU\...\Domains\www] *.caixa.gov.br
O15 - Trusted Zone: [HKCU\...\Domains] http.hola.org
~ IE Zone Confiance: Scanned in 00mn 00s



---\\ Alteração Dominio/Clientes DNS (017)
O17 - HKLM\System\CCS\Services\Tcpip\..\{6E9F80D0-4D68-439D-8B15-E2D41615D3B1}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{6E9F80D0-4D68-439D-8B15-E2D41615D3B1}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{6E9F80D0-4D68-439D-8B15-E2D41615D3B1}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
~ Domain: Scanned in 00mn 00s



---\\ Protocolo adicional (018)
O18 - Handler: wlmailhtml [64Bits] - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} . (...) --
O18 - Filter: application/x-msdownload [64Bits] - {1E66F26B-79EE-11D2-8710-00C04F79ED0D} . (.Microsoft Corporation - Microsoft .NET Runtime Execution Engine.) -- C:\Windows\System32\mscoree.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s



---\\ Lista dos serviços NT não Microsoft e não desativados (023)
O23 - Service: LocalServiceSystem (LocalServiceSystem) . (...) - C:\Windows\SysWOW64\LocalServer\service.exe
~ Services: 5 Legitimates Filtered in 00mn 05s



---\\ Tarefas planificadas automaticamente (039)
O39 - APT:Automatic Planified Task - C:\Windows\Tasks\DriverEasy Scheduled Scan.job [406]
[MD5.00000000000000000000000000000000] [APT] [DriverEasy Scheduled Scan] (...) -- C:\Program Files\Easeware\DriverEasy\DriverEasy.exe (.not file.) [0]
[MD5.CDEC84EFA7E61E09F8F344F1A151BA59] [APT] [{2614A0FC-BA30-4A01-8BC3-F71D5C080A63}] (...) -- C:\Windows\'Full Speed' Internet Booster\uninstall.exe [574464]
~ Scheduled Task: 26 Legitimates Filtered in 00mn 04s



---\\ Software instalados (042)
O42 - Logiciel: Módulo Adicional de Segurança CAIXA - (...) [HKLM][64Bits] -- {5d01f486-f32d-462e-8830-cc1d116e8ece}_is1
O42 - Logiciel: ZBOT - (...) [HKLM][64Bits] -- ZBOT
~ Logic: 19 Legitimates Filtered in 00mn 00s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\AutoHelpDesk]
[HKCU\Software\GbAs]
[HKCU\Software\SpeedBit]
[HKCU\Software\labDV.com]
[HKCU\Software\tudodownloads]
[HKCU\Software\ziggi]
[HKLM\Software\SpeedBit]
[HKLM\Software\Wow6432Node\AutoHelpDesk]
[HKLM\Software\Wow6432Node\Sakura]
[HKLM\Software\Wow6432Node\SpeedBit]
~ Key Software: 267 Legitimates Filtered in 00mn 00s



---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 28/10/2013 - 10:44:13 - [0,013] ----D C:\Program Files (x86)\Curriculum 3.1
O43 - CFD: 09/03/2014 - 20:36:28 - [0] ----D C:\Program Files (x86)\Oasis Games Limited
O43 - CFD: 07/03/2014 - 18:59:58 - [0] ----D C:\Program Files (x86)\RBM
O43 - CFD: 07/03/2014 - 14:08:40 - [0] ----D C:\Program Files (x86)\Common Files\SpeedBit
O43 - CFD: 09/03/2014 - 20:41:32 - [0] ----D C:\ProgramData\HostIt
O43 - CFD: 08/03/2014 - 21:40:59 - [27,645] -SH-D C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
O43 - CFD: 10/03/2013 - 10:54:35 - [0] ----D C:\Users\Betao\AppData\Roaming\GoPlayer
O43 - CFD: 20/03/2013 - 20:06:41 - [0] ----D C:\Users\Betao\AppData\Roaming\PCF
O43 - CFD: 05/02/2014 - 04:31:25 - [12,613] ----D C:\Users\Betao\AppData\Roaming\VIVO INTERNET
O43 - CFD: 13/07/2013 - 17:00:22 - [0,047] ----D C:\Users\Betao\AppData\Local\Ares
O43 - CFD: 07/03/2014 - 10:56:00 - [0,025] ----D C:\Users\Betao\AppData\Local\labDV.com
O43 - CFD: 12/06/2013 - 21:40:17 - [0,064] ----D C:\Users\Betao\AppData\Local\MediaBA
O43 - CFD: 20/02/2014 - 15:42:27 - [0,001] ----D C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ZBOT
O43 - CFD: 30/03/2013 - 12:00:40 - [0] ----D C:\Users\Betao\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\°²»úÍø
~ Program Folder: 193 Legitimates Filtered in 00mn 17s



---\\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044)
O44 - LFC:[MD5.7B59D275F7EF711781A35988ECC0FF0C] - 02/03/2014 - 16:41:29 ---A- . (...) -- C:\Windows\System32\prfc0416.dat [956686]
O44 - LFC:[MD5.999401F174E5E7F071A488C7FADBE978] - 02/03/2014 - 16:41:29 ---A- . (...) -- C:\Windows\System32\prfh0416.dat [1654314]
O44 - LFC:[MD5.37F5CDA64FC515B3072531C1187EDCCA] - 06/03/2014 - 17:30:12 ---A- . (.Baidu, Inc. - Baidu Antivirus Minifilter Driver.) -- C:\Windows\System32\Drivers\Bfilter.sys [52032]
O44 - LFC:[MD5.DFC1681F6645CB2AEA83897588F05362] - 06/03/2014 - 17:30:13 ---A- . (.Baidu, Inc. - Baidu FS Monitor Driver.) -- C:\Windows\System32\Drivers\Bfmon.sys [34624] =>Adware.BDSearch
O44 - LFC:[MD5.F4C1984178175ACE4A75BE23059C3E0A] - 06/03/2014 - 17:30:14 ---A- . (.Baidu, Inc. - Baidu Antivirus Selfprotect Driver.) -- C:\Windows\System32\Drivers\Bprotect.sys [128992]
O44 - LFC:[MD5.8E4A2031C4CABDE2783A301B91826D1E] - 07/03/2014 - 11:13:34 ---A- . (.Hola Networks Ltd. - Hola Network Monitor Driver.) -- C:\Windows\System32\Drivers\hola_mon_drv.sys [88984]
O44 - LFC:[MD5.815372073DA85B2098A37DED84083C8A] - 09/03/2014 - 20:44:07 ---A- . (...) -- C:\Windows\_MSRSTRT.EXE [2560]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 11/03/2014 - 11:19:56 ---A- . (...) -- C:\autoexec.bat [0]
O44 - LFC:[MD5.576BEDA40EF5136F7B8570BF37C9A656] - 11/03/2014 - 16:10:16 ---A- . (.No owner - Setup/Uninstall.) -- C:\Windows\unins000.exe [1169609]
O44 - LFC:[MD5.F9C4F37E8E3E79AA36330A60D25C8296] - 11/03/2014 - 16:11:18 ---A- . (...) -- C:\Windows\unins000.dat [176885]
O44 - LFC:[MD5.D8D777CABFD17B12E3561FA41598B499] - 15/03/2014 - 14:46:59 ---A- . (...) -- C:\zoek-results2014-03-15-174659.log [35293]
O44 - LFC:[MD5.2C74C4391BA729BEAE097268987F387E] - 15/03/2014 - 15:08:25 ---A- . (...) -- C:\zoek-results2014-03-15-180825.log [5127]
O44 - LFC:[MD5.3F7C692987810144CD2A6BAC0DDA744D] - 15/03/2014 - 15:39:33 ---A- . (...) -- C:\zoek-results.log [4335]
~ Files: 66 Legitimates Filtered in 00mn 22s



---\\ Chave do registo Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{9b49b42d-d36b-11e2-b7e1-0025222fdd47}\AutoRun\command. (.Electronic Arts Inc. - InstallKitWizard7.) -- G:\Setup.exe
~ Keys: Scanned in 00mn 00s



---\\ Enumeração das chaves do registo PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 18 Legitimates Filtered in 00mn 00s



---\\ Enumeração das chaves do registo PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoLowDiskSpaceChecks"=1
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 6 Legitimates Filtered in 00mn 00s



---\\ Lista dos drivers do sistema (SDL) (O58)
O58 - SDL:[MD5.C04F7B373881009D7994D9BF55D24AB4] - 28/10/2013 - 14:46:47 ---A- . (...) -- C:\Windows\System32\Drivers\aswRvrt.sys [65776]
O58 - SDL:[MD5.59787B95DD9CA44CB139D96863438587] - 28/10/2013 - 14:46:47 ---A- . (...) -- C:\Windows\System32\Drivers\aswVmm.sys [205320]
O58 - SDL:[MD5.37F5CDA64FC515B3072531C1187EDCCA] - 21/01/2014 - 11:14:40 ---A- . (.Baidu, Inc. - Baidu Antivirus Minifilter Driver.) -- C:\Windows\System32\Drivers\Bfilter.sys [52032]
O58 - SDL:[MD5.DFC1681F6645CB2AEA83897588F05362] - 21/01/2014 - 11:14:50 ---A- . (.Baidu, Inc. - Baidu FS Monitor Driver.) -- C:\Windows\System32\Drivers\Bfmon.sys [34624] =>Adware.BDSearch
O58 - SDL:[MD5.F4C1984178175ACE4A75BE23059C3E0A] - 21/01/2014 - 07:01:36 ---A- . (.Baidu, Inc. - Baidu Antivirus Selfprotect Driver.) -- C:\Windows\System32\Drivers\Bprotect.sys [128992]
O58 - SDL:[MD5.46571ED73AE84469DCA53081D33CF3C8] - 12/06/2013 - 19:43:54 ---A- . (.DT Soft Ltd - DAEMON Tools Virtual Bus Driver.) -- C:\Windows\System32\Drivers\dtsoftbus01.sys [283200]
O58 - SDL:[MD5.0E5DA5369A0FCAEA12456DD852545184] - 13/07/2009 - 22:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:[MD5.F2523EF6460FC42405B12248338AB2F0] - 10/06/2009 - 17:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:[MD5.8E4A2031C4CABDE2783A301B91826D1E] - 07/03/2014 - 11:13:34 ---A- . (.Hola Networks Ltd. - Hola Network Monitor Driver.) -- C:\Windows\System32\Drivers\hola_mon_drv.sys [88984]
O58 - SDL:[MD5.F3817967ED533D08327DC73BC4D5542A] - 13/07/2009 - 22:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
~ Drivers: 18 Legitimates Filtered in 00mn 03s



---\\ Lista das ferramentas de remoção de vírus (LAT) (063)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Menu de inicialização Internet (068)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- c:\users\betao\appdata\local\google\chrome\application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- c:\program files\internet explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s



---\\ Pesquisa de infeção nos navegadores da Internet (SBI) (069)
O69 - SBI: SearchScopes [HKCU] Web - (Web) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {0191A6B0-1154-4C22-9182-23A95BBE92D9} - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {05046B93-CC41-4CF5-84CF-3AC3004B22A7} - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} [DefaultScope] - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKUS\.DEFAULT] {0191A6B0-1154-4C22-9182-23A95BBE92D9} - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKUS\S-1-5-18] {0191A6B0-1154-4C22-9182-23A95BBE92D9} - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Keys: Scanned in 00mn 00s



---\\ Pesquisa adicional à raiz do sistema (radicular) (SPRF) (O84)
[MD5.005E451045A9C8A959C5FFDBC5B6FC20] [SPRF][10/06/2013] (...) -- C:\Users\Betao\AppData\Roaming\unins000.dat [24371]
[MD5.DF463B4C69C1531D1DA7DA3E30E7F8B5] [SPRF][07/03/2014] (...) -- C:\Users\Betao\Desktop\411-vlc-2.1.3-win32.exe [24677393]
[MD5.DF06DC5837316EA78746E3F790A950ED] [SPRF][14/03/2014] (...) -- C:\Users\Betao\Desktop\AdwCleaner.exe [1950720]
[MD5.8C78E50E45E548EEB7898BAA16413C96] [SPRF][22/06/2012] (...) -- C:\Users\Betao\Desktop\aresregular218_installer.exe [3006984]
~ Files: 5 Legitimates Filtered in 00mn 05s



---\\ Estado general dos serviços não Microsoft (EGS) (SR=Executados, SS=Parados)
SS - | Disabled 09/03/2014 257928 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 29/07/2013 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 29/07/2013 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Disabled 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation

SR - | Auto 21/12/2013 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 28/10/2013 50344 | (avast! Antivirus) . (.AVAST Software.) - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
SR - | Auto 17/12/2007 163840 | (EPSON_EB_RPCV4_01) . (.SEIKO EPSON CORPORATION.) - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.exe
SR - | Auto 11/01/2007 126464 | (EPSON_PM_RPCV4_01) . (.SEIKO EPSON CORPORATION.) - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.exe
SR - | Auto 08/03/2014 89992 | (LocalServiceSystem) . (...) - C:\Windows\SysWOW64\LocalServer\service.exe
SR - | Auto 13/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 13/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe

~ Services: Scanned in 00mn 07s



---\\ Scâner Aditional (088)
Database Version : 13031 - (12/03/2014)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 2
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 1

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:tuto4pc_br_36 =>PUP.AgenceExclusive^
O4 - HKLM\..\Wow6432Node\Run: [tuto4pc_br_36] Chave orfã =>PUP.AgenceExclusive^
~ Additionnel Scan: 188788 Items scanned in 00mn 25s



---\\ Sumário das deteções encontradas na sua estação
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Adware.BDSearch
~ MSI: 1 link(s) detected in 00mn 25s



~ 1127 Legitimates filtered by white list
End of the scan (433 lines in 02mn 06s)(0)

 Selecione e copie todo o texto destacado em vermelho que te passei (começando em script zhpfix e indo até emptyclsid)
_____________________________________________________________________________________________________________

 Vá no menu: Iniciar > Todos os programas > ZHP > Clique com o botão direito do mouse sobre o Zhpfix e escolha a opção de Executar como administrador > Clique em Importação > Clique no botão GO > Clique em Oui > Caso queira que os arquivos da lixeira sejam excluídos clique em Oui novamente > Um relatório aparecerá no bloco de notas.

Copie este relatório e poste em sua próxima resposta.

Rapport de ZHPFix 2014.3.12.3 par Nicolas Coolman, Update du 12/03/2014
Fichier d'export Registre :
Run by Betao at 15/03/2014 20:07:37
High Elevated Privileges : OK
Windows 7 Ultimate Edition, 64-bit Service Pack 1 (Build 7601)

Reciclagem vazia (00mn 03s)

========== Valores do Registo ==========
ProxyFix : Configuração proxy removida com sucesso
ELIMINÉ ProxyServer Value
ELIMINÉ ProxyEnable Value
ELIMINÉ EnableHttp1_1 Value
ELIMINÉ ProxyHttp1.1 Value
ELIMINÉ ProxyOverride Value

========== Pastas ==========
Nenhuma pasta CLSID local utilizador vazia

========== Ficheiros ==========
ELIMINA REINICIAR: c:\windows\system32\drivers\bfilter.sys
ELIMINA REINICIAR: c:\windows\system32\drivers\bfmon.sys
ELIMINA REINICIAR: c:\windows\system32\drivers\bprotect.sys
ELIMINÉ Temporários windows (2) (1.198 octets)
ELIMINÉ Flash Cookies (0) (0 octets)

========== Tarefa planificada ==========
ELIMINÉ: DriverEasy Scheduled Scan

========== Restauração Sistema ==========
Ponto de restauro do sistema criado com sucesso

========== Outros ==========
NÃO-TRATADO [MD5.00000000000000000000000000000000] [APT] [DriverEasy Scheduled Scan] (...) -- C:\Program Files\Easeware\DriverEasy\DriverEasy.exe (.not file.) [0]


========== Recapitulativo ==========
6 : Valores do Registo
1 : Pastas
5 : Ficheiros
1 : Tarefa planificada
1 : Restauração Sistema
1 : Outros


End of clean in 00mn 41s

========== Caminho do ficheiro do relatório ==========
C:\Users\Betao\AppData\Roaming\ZHP\ZHPFix[R1].txt - 15/03/2014 17:26:58 [10466]
C:\Users\Betao\AppData\Roaming\ZHP\ZHPFix[R2].txt - 15/03/2014 20:07:41 [1571]