Remover AntiVirus Baidu

por crfornaciari Qua 09 Abr 2014, 23:26

Estou om essa encrenca tbm, não consigo eliminar este antivirus, segui umas dicas até os relatorios do AdwCleaner e do Zoek.

Att.
Crfornaciari

por **Power Max** Qua 09 Abr 2014, 23:28

baidu - Remover AntiVirus Baidu 648673379

Olá crfornaciari. Seja bem vindo ao Fórum PC Brasil.

baidu - Remover AntiVirus Baidu 772309

Poste o log (relatório) do Adwcleaner que está em C:\AdwCleaner\AdwCleaner[S0].txt para que possamos analisá-lo.

por crfornaciari Qua 09 Abr 2014, 23:32

# AdwCleaner v3.023 - Relatório criado 09/04/2014 às 23:06:10
# Atualizado 01/04/2014 por Xplode
# Sistema Operacional : Windows 7 Ultimate Service Pack 1 (64 bits)
# Usuário : Celso - CELSO-PC
# Executando de : C:\Users\Celso\Downloads\AdwCleaner.exe
# Opção : Limpar

***** [ Serviços ] *****

Serviço Deletada : InternetUpdater

***** [ Arquivos / Pastas ] *****

Pasta Deletada : C:\ProgramData\Ask
Pasta Deletada : C:\ProgramData\Babylon
Pasta Deletada : C:\ProgramData\baidu
Pasta Deletada : C:\ProgramData\boost_interprocess
Pasta Deletada : C:\ProgramData\Conduit
Pasta Deletada : C:\ProgramData\eSafe
Pasta Deletada : C:\ProgramData\InternetUpdater
Pasta Deletada : C:\ProgramData\RHelpers
Pasta Deletada : C:\ProgramData\SaveSenseLive
Pasta Deletada : C:\ProgramData\Websteroids
Pasta Deletada : C:\Program Files (x86)\BringStar
Pasta Deletada : C:\Program Files (x86)\Conduit
Pasta Deletada : C:\Program Files (x86)\Funmoods
Pasta Deletada : C:\Program Files (x86)\melondrea
Pasta Deletada : C:\Program Files (x86)\Mysearchdial
Pasta Deletada : C:\Program Files (x86)\SaveSenseLive
Pasta Deletada : C:\Users\Celso\AppData\Local\apn
Pasta Deletada : C:\Users\Celso\AppData\Local\Conduit
Pasta Deletada : C:\Users\Celso\AppData\Local\genienext
Pasta Deletada : C:\Users\Celso\AppData\Local\Mobogenie
Pasta Deletada : C:\Users\Celso\AppData\Local\NativeMessaging
Pasta Deletada : C:\Users\Celso\AppData\Local\OpenCandy
Pasta Deletada : C:\Users\Celso\AppData\Local\SaveSenseLive
Pasta Deletada : C:\Users\Celso\AppData\Local\TBHostSupport
Pasta Deletada : C:\Users\Celso\AppData\Local\WhiteListing
Pasta Deletada : C:\Users\Celso\AppData\LocalLow\Conduit
Pasta Deletada : C:\Users\Celso\AppData\LocalLow\PriceGong
Pasta Deletada : C:\Users\Celso\AppData\Roaming\Babylon
Pasta Deletada : C:\Users\Celso\AppData\Roaming\baidu
Pasta Deletada : C:\Users\Celso\AppData\Roaming\Mysearchdial
Pasta Deletada : C:\Users\Celso\AppData\Roaming\OpenCandy
Pasta Deletada : C:\Users\Celso\AppData\Roaming\SaveSense
Pasta Deletada : C:\Users\Celso\AppData\Roaming\Systweak
Pasta Deletada : C:\Users\Celso\AppData\Roaming\uniblue
Pasta Deletada : C:\Users\Celso\AppData\Roaming\yourfiledownloader
Pasta Deletada : C:\Users\Leticia\AppData\LocalLow\Conduit
Pasta Deletada : C:\Users\Leticia\AppData\LocalLow\ConduitEngine
Pasta Deletada : C:\Users\Leticia\AppData\LocalLow\PriceGong
Pasta Deletada : C:\Users\Nayara\AppData\LocalLow\AskToolbar
Pasta Deletada : C:\Users\Nayara\AppData\LocalLow\Conduit
Pasta Deletada : C:\Users\Nayara\AppData\LocalLow\ConduitEngine
Pasta Deletada : C:\Users\Nayara\AppData\LocalLow\PriceGong
Pasta Deletada : C:\Users\Celso\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb
Pasta Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb
Pasta Deletada : C:\Users\Nayara\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb
Pasta Deletada : C:\Users\Celso\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdebcffgnijbblbinknkbefciofebcda
Pasta Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdebcffgnijbblbinknkbefciofebcda
[!] Pasta Deletada : C:\Users\Celso\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdebcffgnijbblbinknkbefciofebcda
[!] Pasta Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdebcffgnijbblbinknkbefciofebcda
[!] Pasta Deletada : C:\Users\Celso\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdebcffgnijbblbinknkbefciofebcda
[!] Pasta Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdebcffgnijbblbinknkbefciofebcda
[!] Pasta Deletada : C:\Users\Celso\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdebcffgnijbblbinknkbefciofebcda
[!] Pasta Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdebcffgnijbblbinknkbefciofebcda
[!] Pasta Deletada : C:\Users\Celso\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdebcffgnijbblbinknkbefciofebcda
[!] Pasta Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdebcffgnijbblbinknkbefciofebcda
Arquivo Deletada : C:\END
Arquivo Deletada : C:\Windows\System32\roboot64.exe
Arquivo Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\bProtector Web Data
Arquivo Deletada : C:\Users\Nayara\AppData\Local\Google\Chrome\User Data\Default\bProtector Web Data
Arquivo Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\bprotectorpreferences
Arquivo Deletada : C:\Users\Nayara\AppData\Local\Google\Chrome\User Data\Default\bprotectorpreferences
Arquivo Deletada : C:\Users\Celso\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ifohbjbgfchkkfhphahclmkpgejiplfo_0.localstorage
Arquivo Deletada : C:\Users\Celso\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pflphaooapbgpeakohlggbpidpppgdff_0.localstorage
Arquivo Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage
Arquivo Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage-journal
Arquivo Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_apps.conduit.com_0.localstorage
Arquivo Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_apps.conduit.com_0.localstorage-journal
Arquivo Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_facebook.conduitapps.com_0.localstorage
Arquivo Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_facebook.conduitapps.com_0.localstorage-journal
Arquivo Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\user data\default\local storage\hxxp_pricegong.conduitapps.com_0.localstorage
Arquivo Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\user data\default\local storage\hxxp_pricegong.conduitapps.com_0.localstorage-journal
Arquivo Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage
Arquivo Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage-journal
Arquivo Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_storage.conduit.com_0.localstorage
Arquivo Deletada : C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_storage.conduit.com_0.localstorage-journal
Arquivo Deletada : C:\Windows\Tasks\Funmoods.job
Arquivo Deletada : C:\Windows\System32\Tasks\Funmoods
Arquivo Deletada : C:\Windows\Tasks\MySearchDial.job
Arquivo Deletada : C:\Windows\System32\Tasks\MySearchDial
Arquivo Deletada : C:\Windows\Tasks\SaveSense.job
Arquivo Deletada : C:\Windows\System32\Tasks\SaveSense
Arquivo Deletada : C:\Windows\System32\Tasks\SpyHunter4Startup

***** [ Atalhos ] *****

***** [ Registro ] *****

Chave Deletedo : HKCU\Software\Google\Chrome\Extensions\mdebcffgnijbblbinknkbefciofebcda
Chave Deletedo : HKLM\SOFTWARE\Google\Chrome\Extensions\mdebcffgnijbblbinknkbefciofebcda
Valor Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Updater]
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Chave Deletedo : HKLM\SOFTWARE\Classes\esrv.mysearchdialesrvc
Chave Deletedo : HKLM\SOFTWARE\Classes\esrv.mysearchdialesrvc.1
Chave Deletedo : HKLM\SOFTWARE\Classes\mysearchdial.mysearchdialappCore
Chave Deletedo : HKLM\SOFTWARE\Classes\mysearchdial.mysearchdialappCore.1
Chave Deletedo : HKLM\SOFTWARE\Classes\mysearchdial.mysearchdialdskBnd
Chave Deletedo : HKLM\SOFTWARE\Classes\mysearchdial.mysearchdialdskBnd.1
Chave Deletedo : HKLM\SOFTWARE\Classes\mysearchdial.mysearchdialHlpr
Chave Deletedo : HKLM\SOFTWARE\Classes\mysearchdial.mysearchdialHlpr.1
Chave Deletedo : HKLM\SOFTWARE\Classes\Prod.cap
Chave Deletedo : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager
Chave Deletedo : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager.1
Chave Deletedo : HKLM\SOFTWARE\Classes\speedupmypc
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASAPI32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASMANCS
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Valor Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Updater]
Chave Deletedo : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{3004627E-F8E9-4E8B-909D-316753CBA923}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{44ED99E2-16A6-4B89-80D6-5B21CF42E78B}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{4ED063C9-4A0B-4B44-A9DC-23AFF424A0D3}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{C358B3D0-B911-41E3-A276-E7D43A6BA56D}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}
Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{44ED99E2-16A6-4B89-80D6-5B21CF42E78B}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3004627E-F8E9-4E8B-909D-316753CBA923}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{44ED99E2-16A6-4B89-80D6-5B21CF42E78B}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7854F00C-DC77-477E-A10E-603F48442D3B}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3004627E-F8E9-4E8B-909D-316753CBA923}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{44ED99E2-16A6-4B89-80D6-5B21CF42E78B}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{219046AE-358F-4CF1-B1FD-2B4DE83642A8}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4250488A-CB24-0893-C066-B1AEA57BCFF2}
Chave Deletedo : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Chave Deletedo : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Chave Deletedo : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Chave Deletedo : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4B71-B0A3-3D82E62A6909}
Chave Deletedo : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Valor Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{3004627E-F8E9-4E8B-909D-316753CBA923}]
Valor Deletedo : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{30F9B915-B755-4826-820B-08FBA6BD249D}]
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Chave Deletedo : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Chave Deletedo : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}
Chave Deletedo : HKCU\Software\1ClickDownload
Chave Deletedo : HKCU\Software\BabylonToolbar
Chave Deletedo : HKCU\Software\BI
Chave Deletedo : HKCU\Software\Conduit
Chave Deletedo : HKCU\Software\InstallCore
Chave Deletedo : HKCU\Software\mysearchdial
Chave Deletedo : HKCU\Software\SaveSenseLive
Chave Deletedo : HKCU\Software\systweak
Chave Deletedo : HKCU\Software\YahooPartnerToolbar
Chave Deletedo : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Chave Deletedo : HKCU\Software\AppDataLow\Software\Conduit
Chave Deletedo : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Chave Deletedo : HKCU\Software\AppDataLow\Software\Crossrider
Chave Deletedo : HKCU\Software\AppDataLow\Software\DynConIE
Chave Deletedo : HKCU\Software\AppDataLow\Software\PriceGong
Chave Deletedo : HKCU\Software\AppDataLow\Software\SmartBar
Chave Deletedo : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Chave Deletedo : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Chave Deletedo : HKLM\Software\aartemisSoftware
Chave Deletedo : HKLM\Software\Babylon
Chave Deletedo : HKLM\Software\Conduit
Chave Deletedo : HKLM\Software\DataMngr
Chave Deletedo : HKLM\Software\InstallCore
Chave Deletedo : HKLM\Software\Uniblue
Chave Deletedo : HKLM\Software\YourFileDownloader

***** [ Navegadores ] *****

-\\ Internet Explorer v11.0.9600.16521

Configurações Restauradas : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Configurações Restauradas : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Configurações Restauradas : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Configurações Restauradas : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Configurações Restauradas : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Configurações Restauradas : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

-\\ Google Chrome v32.0.1700.107

[ Arquivo : C:\Users\Celso\AppData\Local\Google\Chrome\User Data\Default\preferences ]

[ Arquivo : C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deletedo : homepage
Deletedo : icon_url
Deletedo : search_url
Deletedo : keyword

[ Arquivo : C:\Users\Nayara\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deletedo : homepage

*************************

AdwCleaner[R0].txt - [21421 octets] - [09/04/2014 23:03:33]
AdwCleaner[S0].txt - [17843 octets] - [09/04/2014 23:06:10]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [17904 octets] ##########

por **Power Max** Qua 09 Abr 2014, 23:35

Desative temporariamente seu antivírus para evitar conflitos.

Acesse este link abaixo e clique no primeiro botão da esquerda que é o botão Download Zoek.exe:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

*Clique com o botão direito do mouse no Zoek.exe e selecione [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

* Selecione e copie todo este texto destacado em vermelho que te passei e cole-o no espaço em branco do Zoek

*Clique [Run Script]

*Durante o scan uma mensagem parecida com esta abaixo mostrando o progresso do escaneamento será apresentada. Aguarde o término...pode demorar!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

*Caso a reinicialização do PC seja solicitada, clique [OK]

* Poste o log do Zoek que estará em C:\zoek-results.txt em sua próxima resposta.

por crfornaciari Qui 10 Abr 2014, 00:15

Zoek.exe v5.0.0.0 Updated 07-March-2014
Tool run by Celso on 09/04/2014 at 23:36:33,70.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Celso\Downloads\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2014-04-10-014935.log 447 bytes

==== System Restore Info ======================

09/04/2014 23:39:35 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Microsoft\Internet Explorer\SearchScopes\{09BB1341-9F19-42E3-9A94-A74416DAE880} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== Deleting Files \ Folders ======================

C:\PROGRA~3\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F} deleted
C:\Users\Celso\daemonprocess.txt deleted
C:\Users\Celso\.android deleted
C:\PROGRA~2\Plus-HD-4.4 deleted
C:\extensions deleted
C:\Users\Celso\AppData\Roaming\FixVTS.ini deleted
C:\Users\Celso\AppData\Roaming\GetRightToGo deleted
C:\PROGRA~3\FileSplitUpLoad.dll deleted
C:\PROGRA~3\Updater deleted
C:\PROGRA~3\Baidu deleted
C:\Users\Celso\AppData\Local\CRE deleted
C:\Users\Celso\AppData\Local\cache deleted
C:\Users\wangzhisong\AppData\Local\Mobogenie deleted
C:\Users\Leticia\AppData\LocalLow\uTorrentBar_PT deleted
C:\Users\Nayara\AppData\LocalLow\uTorrentBar_PT deleted
C:\Windows\wininit.ini deleted
C:\windows\SysNative\tasks\Baidu Antivirus Update deleted
C:\windows\SysNative\tasks\YourFile DownloaderUpdate deleted
C:\Users\wangzhisong deleted
C:\Windows\Syswow64\_r_a_p_.tmp deleted
C:\Windows\SysWow64\searchplugins deleted
C:\Windows\SysWow64\Extensions deleted
C:\Users\Celso\AppData\Roaming\unins000.exe deleted
C:\Users\Celso\AppData\Roaming\unins001.exe deleted
"C:\Users\Celso\AppData\Roaming\Vso" deleted
"C:\Users\Celso\AppData\Roaming\GrabPro" deleted

==== Folders Found ======================

2014-04-10 02:06:13 2014-04-10 02:06:13 -------- d-----w- C:\AdwCleaner\Quarantine\C\ProgramData\baidu
2013-12-01 21:18:40 2014-03-07 02:10:34 -------- d-----w- C:\Program Files (x86)\Baidu Security
2014-03-07 02:10:34 2014-04-10 02:52:32 -------- d-----w- C:\Program Files (x86)\Baidu Security\Baidu Antivirus
2014-03-20 22:08:30 2014-03-20 22:08:30 -------- d-----w- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1033\BaiduSafe
2014-03-20 22:15:05 2014-03-20 22:15:11 -------- d-----w- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1033\tools\BaiduExtMgr
2014-03-20 22:08:31 2014-03-20 22:08:31 -------- d-----w- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1046\BaiduSafe
2014-03-20 22:15:05 2014-03-20 22:15:11 -------- d-----w- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1046\tools\BaiduExtMgr
2014-03-20 22:08:31 2014-03-20 22:08:31 -------- d-----w- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1054\BaiduSafe
2014-03-20 22:15:05 2014-03-20 22:15:11 -------- d-----w- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1054\tools\BaiduExtMgr
2014-03-20 22:08:31 2014-03-20 22:08:31 -------- d-----w- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1057\BaiduSafe
2014-03-20 22:15:05 2014-03-20 22:15:11 -------- d-----w- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1057\tools\BaiduExtMgr
2014-03-20 22:15:05 2014-03-20 22:15:11 -------- d-----w- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\skin\tools\BaiduExtMgr
2014-03-20 22:09:12 2014-03-20 22:15:11 -------- d-----w- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\update\I18N\1033\tools\BaiduExtMgr
2014-03-20 22:09:12 2014-03-20 22:15:11 -------- d-----w- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\update\I18N\1046\tools\BaiduExtMgr
2014-03-20 22:09:12 2014-03-20 22:15:11 -------- d-----w- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\update\I18N\1054\tools\BaiduExtMgr
2014-03-20 22:09:13 2014-03-20 22:15:11 -------- d-----w- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\update\I18N\1057\tools\BaiduExtMgr
2014-03-20 22:09:13 2014-03-20 22:15:11 -------- d-----w- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\update\skin\tools\BaiduExtMgr
2013-12-01 21:18:40 2014-03-22 14:08:00 -------- d-----w- C:\ProgramData\Baidu Security
2014-03-07 02:11:11 2014-03-22 14:08:00 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Baidu Antivirus
2013-12-01 21:18:40 2014-03-22 14:08:00 -------- d-----w- C:\Users\All Users\Baidu Security
2014-03-07 02:11:11 2014-03-22 14:08:00 -------- d-----w- C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Baidu Antivirus
2013-12-01 21:19:48 2013-12-01 21:19:48 -------- d-----w- C:\Users\Celso\AppData\Roaming\Baidu Security
2013-12-05 20:57:07 2013-12-05 20:57:07 -------- d-----w- C:\Users\Celso\AppData\Roaming\Baidu Security\PC Faster\3.7.0.0\Uninstall\Baidu PC Faster Uninstall
2013-12-05 20:57:07 2013-12-05 20:57:07 -------- d-----w- C:\Users\Celso\AppData\Roaming\Baidu Security\PC Faster\3.7.0.0\Uninstall\Baidu PC Faster Uninstall HK
2014-02-12 23:26:27 2014-02-12 23:26:27 -------- d-----w- C:\Users\Celso\AppData\Roaming\Baidu Security\PC Faster\4.0.0.0\Uninstall\Baidu PC Faster Uninstall
2014-02-12 23:26:28 2014-02-12 23:26:28 -------- d-----w- C:\Users\Celso\AppData\Roaming\Baidu Security\PC Faster\4.0.0.0\Uninstall\Baidu PC Faster Uninstall HK
2013-12-01 21:18:40 2014-03-22 14:08:00 -------- d-----w- C:\Users\Todos os Usuários\Baidu Security
2014-03-07 02:11:11 2014-03-22 14:08:00 -------- d-----w- C:\Users\Todos os Usuários\Microsoft\Windows\Start Menu\Programs\Baidu Antivirus
2014-04-10 02:52:11 2014-04-10 02:52:12 -------- d---a-w- C:\zoek_backup\C_PROGRA~3_Baidu

==== Files Found ======================

--- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1033\BaiduSafe\BaiduSafe.bskin ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 134244
Created time: 2013-11-27 09:51:20
Modified time: 2013-11-27 09:51:20
MD5: 8F3DD4DC7C018B4529FCE87C7C871A6B
SHA1: FCFAF556D83013022C85D987AB3FA5A79B99D95E

--- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1033\tools\BaiduExtMgr\BaiduExtMgr.bskin ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 36814
Created time: 2014-03-20 22:12:25
Modified time: 2014-03-20 22:12:25
MD5: 51002A20C9651142B49E83A58442E1F6
SHA1: B00474C7E8DD528A020DBD6D2459083C1F4DB588

--- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1046\BaiduSafe\BaiduSafe.bskin ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 134063
Created time: 2013-12-13 03:13:04
Modified time: 2013-12-13 03:13:04
MD5: 166DC9E2682D07D16E710C812EE28F36
SHA1: 600163BD7CE5B7ADF09EF58D849D28D16B6BEDF0

--- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1046\tools\BaiduExtMgr\BaiduExtMgr.bskin ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 88133
Created time: 2014-03-20 22:12:37
Modified time: 2014-03-20 22:12:37
MD5: 88797A769532300E0463DD93C31E3BBA
SHA1: 4DD1AB5A11E5876D5895379A2320AE9F61335882

--- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1054\BaiduSafe\BaiduSafe.bskin ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 219376
Created time: 2014-01-13 12:37:24
Modified time: 2014-01-13 12:37:24
MD5: D5429D318211761CCF103AA2BA2745B7
SHA1: 8F147B84C1D8E61EEA7BFFF1F652B9BC30B9D7FC

--- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1054\tools\BaiduExtMgr\BaiduExtMgr.bskin ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 36308
Created time: 2014-03-20 22:12:52
Modified time: 2014-03-20 22:12:52
MD5: B235FA1EB30EB0BE481F467BAF2B4226
SHA1: F2E6F01451239D58EAB328FA91353E5C81E27BF4

--- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1057\BaiduSafe\BaiduSafe.bskin ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 243531
Created time: 2013-12-13 03:13:08
Modified time: 2013-12-13 03:13:08
MD5: EEFD9637A525277EB974E1DD0F5F9923
SHA1: 2E24AEFBF34F23CBB7C15D62B55D547CD5B3B5C3

--- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1057\tools\BaiduExtMgr\BaiduExtMgr.bskin ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 36511
Created time: 2014-03-20 22:13:12
Modified time: 2014-03-20 22:13:12
MD5: D19D16CFA1ACBF369052D10388EFDBD5
SHA1: 489AF1A698E43A2B39B190435EEF7C65070C1F67

--- C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\skin\tools\BaiduExtMgr\BaiduExtMgr.bskin ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 4906
Created time: 2014-03-20 22:14:44
Modified time: 2014-03-20 22:14:44
MD5: 4B43E5222EA1E40873AA3332D00FC286
SHA1: E18F243574DE391D053DE64FC9F06E1ECA699BC1

--- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Baidu Antivirus\Baidu Antivirus.lnk ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 1176
Created time: 2014-03-07 02:11:11
Modified time: 2014-03-07 02:11:11
MD5: 3C5999A2D80A502EFB72902B36B58D90
SHA1: 825127CA8B59792FA28456647C55E8191692400A

--- C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Baidu Antivirus\Baidu Antivirus.lnk ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 1176
Created time: 2014-03-07 02:11:11
Modified time: 2014-03-07 02:11:11
MD5: 3C5999A2D80A502EFB72902B36B58D90
SHA1: 825127CA8B59792FA28456647C55E8191692400A

--- C:\Users\Leticia\AppData\Roaming\Microsoft\Windows\Cookies\Low\leticia@baidu[1].txt ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ------w-
File size: 109
Created time: 2010-05-04 16:48:19
Modified time: 2010-05-04 16:48:19
MD5: 2762D5F38A846310152E9A97F64A66C6
SHA1: 9C1B917B6EA4FFB638B74C0BF0BC73490E08F29D

--- C:\Users\Leticia\AppData\Roaming\Microsoft\Windows\Cookies\Low\leticia@hm.baidu[1].txt ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ------w-
File size: 94
Created time: 2010-03-09 18:09:46
Modified time: 2010-03-09 18:09:46
MD5: E0A32DF4EEECA64C361150ACD47BA910
SHA1: 64EDD6AACAFF951A7F8B907D47CDA044788FE4B0

--- C:\Users\Leticia\AppData\Roaming\Microsoft\Windows\Cookies\Low\leticia@hm.baidu[2].txt ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ------w-
File size: 94
Created time: 2010-06-12 15:32:25
Modified time: 2010-06-12 15:32:25
MD5: 25A9D23D4DDB689E3711F2E647B2004C
SHA1: DE760F63039132D363373A581D27BC92DD39616F

--- C:\Users\Public\Desktop\Baidu Antivirus.lnk ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 1158
Created time: 2014-03-07 02:11:11
Modified time: 2014-03-07 02:11:11
MD5: A95A01A9863BB7FC1639F385A542E09E
SHA1: EEB9AD3A549C5A9C8B298D248B6CF38673AF5BC5

==== Registry Search Results for "Baidu" ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\baidu]

[HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll]

[HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll\Splitupload]

[HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll\Splitupload\bav]

[HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll\Splitupload\bav]
"DllVersion_2.0"="C:\\ProgramData\\baidu\\commondll\\splitupload\\DllVersion_2.0\\FileSplitUpLoad.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\Antivirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\LogLoc]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\PC Faster]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\PC Faster\LogUp]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP\Processing]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP\Temp]

"C:\\ProgramData\\Baidu Security\\RpData\\rpFile-Updater-2014-02-12 02-51-43-0793-[23831].tmp"=""

"C:\\ProgramData\\Baidu Security\\RpData\\rpFile-PCFasterSvc-2014-02-12 02-51-43-0809-[23831].tmp"=""

"C:\\ProgramData\\Baidu Security\\RpData\\rpFile-PCFasterSvc-2014-02-12 02-07-17-0037-[26881].tmp"=""

"C:\\ProgramData\\Baidu Security\\RpData\\rpFile-pcftray-2014-02-12 02-07-17-0802-[26881].tmp"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{77FEF28E-EB96-44FF-B511-3185DEA48697}]
"DllName"="baidubar.dll;BaiduBarX.dll;BaiduBarX.dll;BaiduBarX.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{B580CF65-E151-49C3-B73F-70B13FCA8E86}]
"DllName"="baidubar.dll;BaiduBarX.dll;BaiduBarX.dll;BaiduBarX.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Baidu Antivirus"="\"C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus\\BavTray.exe\" -auto"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"DisplayName"="Baidu Antivirus"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"DisplayIcon"="\"C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus\\Bav.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"UninstallString"="\"C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus\\Uninstall.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"URLInfoAbout"="http://antivirus.baidu.com"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"Publisher"="Baidu, Inc."

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"InstallDir"="C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Baidu_Scan]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Baidu_Scan]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\Baidu_Scan]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Baidu_Scan]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BFILTER\0000]
"DeviceDesc"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BFMON\0000]
"DeviceDesc"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BPROTECT\0000]
"DeviceDesc"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BAVSvc]
"DisplayName"="Baidu Antivirus Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BAVSvc]
"Description"="Baidu Antivirus Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BdApiUtil]
"ImagePath"="\\??\\C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus\\BdApiUtil64.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BdCameraProtect]
"ImagePath"="\\??\\C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus\\BdCameraProtect64.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Bfilter]
"DisplayName"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Bfmon]
"DisplayName"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BHipsSvc]
"DisplayName"="Baidu Hips Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BHipsSvc]
"Description"="Baidu Hips Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Bprotect]
"DisplayName"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Bprotect]
"InstPath"="C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BprotectEx]
"DisplayName"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BprotectEx]
"InstPath"="C:\\Program Files (x86)\\Baidu Security\\PC Faster\\4.0.0.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCFApiUtil]
"ImagePath"="\\??\\C:\\Program Files (x86)\\Baidu Security\\PC Faster\\4.0.0.0\\PCFApiUtil64.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BFILTER\0000]
"DeviceDesc"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BFMON\0000]
"DeviceDesc"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BPROTECT\0000]
"DeviceDesc"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\BAVSvc]
"DisplayName"="Baidu Antivirus Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\BAVSvc]
"Description"="Baidu Antivirus Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\BdApiUtil]
"ImagePath"="\\??\\C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus\\BdApiUtil64.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\BdCameraProtect]
"ImagePath"="\\??\\C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus\\BdCameraProtect64.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Bfilter]
"DisplayName"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Bfmon]
"DisplayName"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\BHipsSvc]
"DisplayName"="Baidu Hips Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\BHipsSvc]
"Description"="Baidu Hips Service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Bprotect]
"DisplayName"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Bprotect]
"InstPath"="C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\BprotectEx]
"DisplayName"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\BprotectEx]
"InstPath"="C:\\Program Files (x86)\\Baidu Security\\PC Faster\\4.0.0.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PCFApiUtil]
"ImagePath"="\\??\\C:\\Program Files (x86)\\Baidu Security\\PC Faster\\4.0.0.0\\PCFApiUtil64.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BFILTER\0000]
"DeviceDesc"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BFMON\0000]
"DeviceDesc"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BPROTECT\0000]
"DeviceDesc"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BAVSvc]
"DisplayName"="Baidu Antivirus Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BAVSvc]
"Description"="Baidu Antivirus Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BdApiUtil]
"ImagePath"="\\??\\C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus\\BdApiUtil64.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BdCameraProtect]
"ImagePath"="\\??\\C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus\\BdCameraProtect64.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Bfilter]
"DisplayName"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Bfmon]
"DisplayName"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BHipsSvc]
"DisplayName"="Baidu Hips Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BHipsSvc]
"Description"="Baidu Hips Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Bprotect]
"DisplayName"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Bprotect]
"InstPath"="C:\\Program Files (x86)\\Baidu Security\\Baidu Antivirus"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BprotectEx]
"DisplayName"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BprotectEx]
"InstPath"="C:\\Program Files (x86)\\Baidu Security\\PC Faster\\4.0.0.0"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PCFApiUtil]
"ImagePath"="\\??\\C:\\Program Files (x86)\\Baidu Security\\PC Faster\\4.0.0.0\\PCFApiUtil64.sys"

[HKEY_USERS\.DEFAULT\Software\Baidu Security]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus\web]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus\web]
"ucloud"="u.br.bav.baidu.com"

[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus\web]
"dcloud"="http://up.br.bav.baidu.com/cgi-bin/url_warnning/url_warnning.cgi"

[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus\web]
"rcloud"="http://up.br.bav.baidu.com/cgi-bin/url_visit_action.cgi"

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\3.7.0.0]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\3.7.0.0\Run]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\alluser]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\curuser]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\hkcu]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\hklm]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\hklm64]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\bug]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\bug\driver]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\bug\driver\072613-22401-01.dmp]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\bug\driver\092613-28828-01.dmp]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\bug\driver\120113-28797-01.dmp]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\DataReport]

[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security]

[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\Antivirus]

[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\Antivirus\web]

[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\Antivirus\web]
"ucloud"="u.br.bav.baidu.com"

[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\Antivirus\web]
"dcloud"="http://up.br.bav.baidu.com/cgi-bin/url_warnning/url_warnning.cgi"

[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\Antivirus\web]
"rcloud"="http://up.br.bav.baidu.com/cgi-bin/url_visit_action.cgi"

[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster]

[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster\4.0.0.0]

[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster\4.0.0.0\Install]

[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster\4.0.0.0\Statistic]

[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster\4.0.0.0\UUReport]

[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster\DataReport]

[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster\DataReport]
"c:\\programdata\\baidu security\\rpdata"="http://sync.pcfaster.baidu.com/cgi-bin-py/get_pcf_statistic_info.cgi"

[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster\Setup]

[HKEY_USERS\S-1-5-18\Software\Baidu Security]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus\web]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus\web]
"ucloud"="u.br.bav.baidu.com"

[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus\web]
"dcloud"="http://up.br.bav.baidu.com/cgi-bin/url_warnning/url_warnning.cgi"

[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus\web]
"rcloud"="http://up.br.bav.baidu.com/cgi-bin/url_visit_action.cgi"

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\3.7.0.0]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\3.7.0.0\Run]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\alluser]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\curuser]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\hkcu]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\hklm]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\hklm64]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\bug]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\bug\driver]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\bug\driver\072613-22401-01.dmp]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\bug\driver\092613-28828-01.dmp]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\bug\driver\120113-28797-01.dmp]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\DataReport]

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}"="C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext" [01/12/2013 22:41]

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
dchlnpcodkpfdpacogkljefecpegganj - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\urladvisor.crx[29/08/2013 02:47]
hakdifolhalapjijoafobooafbilfakh - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\online_banking_chrome.crx[29/08/2013 02:47]
hghkgaeecgjhjkannahfamoehjmkjail - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\content_blocker_chrome.crx[29/08/2013 02:47]
idhngdhcfkoamngbedgpaokgjbnpdiji - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx[14/08/2013 14:24]
jagncdcchgajhfhijbbhecadmaiegcmh - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\virtkbd.crx[25/03/2014 23:47]
lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx[21/09/2011 09:35]
pjldcfjmnllhmgjclecdnfampinooman - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\ChromeExt\ab.crx[29/08/2013 02:47]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
nnjbodopomfddehlalfilheomcahbpei - C:\Users\Celso\AppData\Local\GAS Tecnologia\GBBD\cef\sf.crx[08/01/2014 21:37]
pgacfjdigcddmmncljpflgcfpfahebkh - C:\Users\Celso\AppData\Local\GAS Tecnologia\GBBD\bb\sf.crx[07/12/2013 15:27]

Kaspersky URL Advisor - Celso\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj
Safe Money - Celso\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh
Dangerous Websites Blocker - Celso\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail
RealDownloader - Celso\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji
Virtual Keyboard - Celso\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh
Google Wallet - Celso\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
GBBD Caixa Economica Federal - Celso\AppData\Local\Google\Chrome\User Data\Default\Extensions\nnjbodopomfddehlalfilheomcahbpei
GBBD Caixa Economica Federal - Celso\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbcaplhfkihhldmlbjhgajdeghjdbffi
GBBD Banco do Brasil - Celso\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgacfjdigcddmmncljpflgcfpfahebkh
Anti-Banner - Celso\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman
Kingdom Rush - Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckmfhhjalnddapegkbbohfaodgbnocim
Kaspersky URL Advisor - Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj
Stylish - Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe
Safe Money - Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh
Dangerous Websites Blocker - Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail
Troll Emoticons - Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\hndllphbhpadfpoikpaofkkkpkpnmjik
RealDownloader - Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji
Adventure Time - Tree Fort 2 - Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\ijlhfjbpidahjpmhimhammdcdoaalenc
Virtual Keyboard - Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh
Burrito Bison - Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\jjnlnlkkpikjojgijcdbfddkfbledeom
Skype Click to Call - Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl
The Fancy Pants - Adventure World 3 - Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndhgdobgdgafhekfiimmpnfkpieigjik
Google Wallet - Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Psykopaint - Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgjchkcfmigkkhedgjedmffdepgmpfil
Anti-Banner - Leticia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman
YouTube - Nayara\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Google Search - Nayara\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
Kaspersky URL Advisor - Nayara\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj
Papas Freezeria - Nayara\AppData\Local\Google\Chrome\User Data\Default\Extensions\gflibdiphnaciliajaeahdjoodibmbjb
Safe Money - Nayara\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh
Air Hockey - Nayara\AppData\Local\Google\Chrome\User Data\Default\Extensions\hcchbhjknakkndfpdbapmdkhbbgojkno
Dangerous Websites Blocker - Nayara\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail
Red Ball 3 HD (New Edition) - Nayara\AppData\Local\Google\Chrome\User Data\Default\Extensions\idfmopajaplmchbbecajoknaflijiebp
RealDownloader - Nayara\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji
Virtual Keyboard - Nayara\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh
Love Smoke - Nayara\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgibfhhccaknggplelmbaepoikkcnllb
Google Wallet - Nayara\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Gmail - Nayara\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia
Anti-Banner - Nayara\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman

==== Chrome Fix ======================

C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_cap1.conduit-apps.com_0.localstorage deleted successfully
C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_cap1.conduit-apps.com_0.localstorage-journal deleted successfully
C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_client.conduit-storage.com_0.localstorage deleted successfully
C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_utorrentbarpt.ourtoolbar.com_0.localstorage deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.google.com"
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.google.com"
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Reset Google Chrome ======================

C:\Users\Celso\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\preferences was reset successfully
C:\Users\Nayara\AppData\Local\Google\Chrome\User Data\Default\preferences was reset successfully
C:\Users\Celso\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\Nayara\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully
HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully
HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} deleted successfully
HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully

==== shortcuts on Users Desktops ======================

C:\Users\Celso\Desktop\Any Video Converter 5.lnk - C:\Program Files (x86)\AnvSoft\Any Video Converter 5\AVCFree.exe
C:\Users\Celso\Desktop\Continue SPlayer Installation.lnk - C:\Users\Celso\AppData\Local\Temp\ICReinstall_splayer-37-build-2437-32-bits.exe /RR
C:\Users\Celso\Desktop\ConvertXtoDvd 3.lnk - C:\Program Files (x86)\VSO\ConvertX\3\ConvertXtoDvd.exe
C:\Users\Celso\Desktop\DivX Movies.lnk - C:\Users\Celso\Videos\DivX Movies
C:\Users\Celso\Desktop\Easy Audio Cutter.lnk - C:\Program Files (x86)\Free Audio Pack\Easy Audio Cutter\AudioCutter.exe
C:\Users\Celso\Desktop\Execução Segura para sites.lnk - C:\Windows\system32\cmd.exe /c avp.exe -hidden SAFEBROWSE
C:\Users\Celso\Desktop\Free CD Ripper.lnk - C:\Program Files (x86)\Free Audio Pack\Free CD Ripper\FreeCDRipper.exe
C:\Users\Celso\Desktop\Free Mp3 Wma Converter.lnk - C:\Program Files (x86)\Free Audio Pack\FreeConverter\FreeConverter.exe
C:\Users\Celso\Desktop\IRPF2013 - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País.lnk - C:\Arquivos de Programas RFB\IRPF2013\IRPF2013.exe
C:\Users\Celso\Desktop\IRPF2014 - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País.lnk - C:\Arquivos de Programas RFB\IRPF2014\IRPF2014.exe
C:\Users\Celso\Desktop\Kernel for Excel Demo.lnk - C:\Program Files (x86)\Kernel for Excel(Demo Version)\Kernel for Excel.exe
C:\Users\Celso\Desktop\Media Crawler.lnk - C:\Program Files (x86)\Media Crawler\MediaCrawler.exe
C:\Users\Celso\Desktop\MPC-HC.lnk - C:\Program Files (x86)\MPC-HC\mpc-hc.exe
C:\Users\Celso\Desktop\Pagamento Seguro.lnk - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe -safebanking
C:\Users\Celso\Desktop\Recovery for Excel.lnk - C:\Users\Celso\AppData\Local\Apps\OfficeRecovery\xr\xr.exe
C:\Users\Celso\Desktop\Revo Uninstaller.lnk - C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe
C:\Users\Celso\Desktop\SpyHunter.lnk - C:\Program Files (x86)\Enigma Software Group\SpyHunter\SpyHunter4.exe
C:\Users\Celso\Desktop\Update Service.lnk - C:\Program Files (x86)\Sony Mobile\Update Service\Update Service.exe
C:\Users\Celso\Desktop\µTorrent.lnk - C:\Users\Celso\AppData\Roaming\uTorrent\uTorrent.exe
C:\Users\Leticia\Desktop\AER.lnk - C:\Program Files (x86)\AER\AER.exe
C:\Users\Leticia\Desktop\Computador - Atalho.lnk -
C:\Users\Leticia\Desktop\IRPF2008 Windows - Declaração de Ajuste Anual.lnk - C:\Program Files (x86)\Programas RFB\IRPF2008windows\IRPF2008.EXE
C:\Users\Leticia\Desktop\Jogos - Atalho.lnk -
C:\Users\Leticia\Desktop\Pagamento Seguro.lnk - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe -safebanking
C:\Users\Nayara\Desktop\AER.lnk - C:\Program Files (x86)\AER\AER.exe
C:\Users\Nayara\Desktop\IRPF2008 Windows - Declaração de Ajuste Anual.lnk - C:\Program Files (x86)\Programas RFB\IRPF2008windows\IRPF2008.EXE
C:\Users\Nayara\Desktop\Pagamento Seguro.lnk - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe -safebanking

==== shortcuts on All Users Desktop ======================

C:\Users\Public\Desktop\3D Home Architect Design Suite Deluxe 8.lnk - C:\Program Files (x86)\3D Home Architect\Design Suite Deluxe 8\Bin\3DHDS80.exe
C:\Users\Public\Desktop\Adobe Reader XI.lnk - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
C:\Users\Public\Desktop\AKKORD.lnk - C:\Program Files (x86)\Vimicro\AKKORD\akkord.exe
C:\Users\Public\Desktop\amcap.lnk - C:\Program Files (x86)\Vimicro\Vimicro USB PC Camera (ZS0211)\x86_x64\amcap.exe
C:\Users\Public\Desktop\Ashampoo Burning Studio 2010 Advanced.lnk - C:\Program Files (x86)\Ashampoo\Ashampoo Burning Studio 2010 Advanced\burningstudio2010adv.exe
C:\Users\Public\Desktop\Baidu Antivirus.lnk - C:\Program Files (x86)\Baidu Security\Baidu Antivirus\Bav.exe
C:\Users\Public\Desktop\CCleaner.lnk - C:\Program Files\CCleaner\CCleaner64.exe
C:\Users\Public\Desktop\Chief Architect Premier X4.lnk - C:\Program Files (x86)\Chief Architect\Chief Architect Premier X4\Chief Architect Premier X4.exe
C:\Users\Public\Desktop\Comprar suprimentos - HP Photosmart 5520 series.lnk - C:\Program Files (x86)\HP\HP Photosmart 5520 series\Bin\hpqDTSS.exe
C:\Users\Public\Desktop\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Public\Desktop\HP Photo Creations.lnk - C:\Program Files (x86)\HP Photo Creations\PhotoProduct.exe
C:\Users\Public\Desktop\HP Photosmart 5520 series.lnk - C:\Program Files\HP\HP Photosmart 5520 series\Bin\HP Photosmart 5520 series.exe -Start UDCDevicePage
C:\Users\Public\Desktop\Instant DVD Recorder.lnk - C:\Program Files (x86)\Pinnacle\Instant DVD Recorder\D2dWizard.exe
C:\Users\Public\Desktop\Kaspersky Internet Security.lnk - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
C:\Users\Public\Desktop\PhotoImpression 5.lnk - C:\Program Files (x86)\ArcSoft\PhotoImpression 5\photoimpression.exe
C:\Users\Public\Desktop\PowerISO.lnk - C:\Program Files (x86)\PowerISO\PowerISO.exe
C:\Users\Public\Desktop\QuickTime Player.lnk - C:\Program Files (x86)\QuickTime\QuickTimePlayer.exe
C:\Users\Public\Desktop\RealPlayer.lnk - C:\program files (x86)\real\realplayer\RealPlay.exe /launch:desktop
C:\Users\Public\Desktop\Receitanet 1.04 .lnk - C:\Program Files (x86)\Programas RFB\Receitanet\Windows\Receitanet.exe
C:\Users\Public\Desktop\Samsung Kies (Lite).lnk - C:\Program Files (x86)\Samsung\Kies\KiesAgent.exe /lite
C:\Users\Public\Desktop\Samsung Kies.lnk - C:\Program Files (x86)\Samsung\Kies\KiesAgent.exe
C:\Users\Public\Desktop\Skype.lnk - C:\Windows\Installer\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}\SkypeIcon.exe
C:\Users\Public\Desktop\Studio.lnk - C:\Program Files (x86)\Pinnacle\Studio 11\programs\Studio.exe
C:\Users\Public\Desktop\Zune.lnk - C:\Program Files (x86)\Zune\Zune.exe

==== shortcuts in Users Start Menu ======================

C:\Users\Celso\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk - C:\Users\Celso\AppData\Roaming\uTorrent\uTorrent.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Programas RFB2014\IRPF - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País\Ajuda do IRPF2014.lnk - C:\Arquivos de Programas RFB\IRPF2014\IRPF.chm
C:\Users\Celso\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Programas RFB2014\IRPF - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País\Desinstalar IRPF2014.lnk - C:\Arquivos de Programas RFB\IRPF2014\uninstall.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Programas RFB2014\IRPF - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País\IRPF2014 - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País.lnk - C:\Arquivos de Programas RFB\IRPF2014\IRPF2014.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Programas RFB2014\IRPF - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País\Leia-me do IRPF2014.lnk - C:\Arquivos de Programas RFB\IRPF2014\Leia_me.htm
C:\Users\Celso\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Recovery for Excel\Recovery for Excel.lnk - C:\Users\Celso\AppData\Roaming\Microsoft\Installer\{7B68448B-49EA-4C77-850D-3E766E3DA808}\xr.ico
C:\Users\Celso\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller\Revo Uninstaller.lnk - C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller\Run Hunter Mode.lnk - C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revouninstaller.exe -hunter
C:\Users\Celso\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller\Uninstall.lnk - C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\uninst.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller\Website.lnk - C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\Revo Uninstaller.url
C:\Users\Celso\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter\SpyHunter Emergency Startup.lnk - C:\Windows\explorer.exe "C:\Program Files (x86)\Enigma Software Group\SpyHunter\SH4.com"
C:\Users\Celso\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter\SpyHunter.lnk - C:\Program Files (x86)\Enigma Software Group\SpyHunter\SpyHunter4.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter\Uninstall SpyHunter.lnk - C:\Windows\SysWOW64\msiexec.exe /X {ACF5FE1B-3772-4068-8B87-2D2A6EFD0A05}

==== shortcuts in All Users Start Menu ======================

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight\Microsoft Silverlight.lnk - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\Silverlight.Configuration.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TP-LINK\Uninstall - TP-LINK TL-WN721N_TL-WN722N Driver.lnk - C:\Program Files (x86)\InstallShield Installation Information\{86A7EED0-02D0-4D91-8183-8D2F23F5E6AE}\setup.exe -runfromtemp -removeonly DriverOnly

==== shortcuts in Quick Launch ======================

C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Ashampoo Burning Studio 2010 Advanced.lnk - C:\Program Files (x86)\Ashampoo\Ashampoo Burning Studio 2010 Advanced\burningstudio2010adv.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\ConvertXtoDvd.lnk - C:\Program Files (x86)\VSO\ConvertX\3\ConvertXtoDvd.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Easy Audio Cutter.lnk - C:\Program Files (x86)\Free Audio Pack\Easy Audio Cutter\AudioCutter.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Free CD Ripper.lnk - C:\Program Files (x86)\Free Audio Pack\Free CD Ripper\FreeCDRipper.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Free Mp3 Wma Converter.lnk - C:\Program Files (x86)\Free Audio Pack\FreeConverter\FreeConverter.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart Essentials.lnk - C:\Program Files (x86)\Nero\Nero8\Nero StartSmart\NeroStartSmart.exe -ScParameter=65
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Samsung Kies (Lite).lnk - C:\Program Files (x86)\Samsung\Kies\KiesAgent.exe /lite
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Samsung Kies.lnk - C:\Program Files (x86)\Samsung\Kies\KiesAgent.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk - C:\Users\Celso\AppData\Roaming\uTorrent\uTorrent.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Paint.lnk - C:\Windows\system32\mspaint.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Adobe Illustrator CS6 (64 Bit).lnk - C:\Program Files\Adobe\Adobe Illustrator CS6 (64 Bit)\Support Files\Contents\Windows\Illustrator.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Adobe Photoshop CS6 (64 Bit).lnk - C:\Program Files\Adobe\Adobe Photoshop CS6 (64 Bit)\Photoshop.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft PowerPoint 2010.lnk - C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pptico.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Nero StartSmart Essentials.lnk - C:\Program Files (x86)\Nero\Nero8\Nero StartSmart\NeroStartSmart.exe -ScParameter=65
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk - C:\Windows\explorer.exe
C:\Users\Celso\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk - C:\Program Files (x86)\Windows Media Player\wmplayer.exe /prefetch:1
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Leticia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Leticia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Leticia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Leticia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\7e4dca80246863e3\pinned.lnk - C:\Windows\system32\control.exe
C:\Users\Leticia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Microsoft SharePoint Workspace 2010.lnk - C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\grvicons.exe
C:\Users\Leticia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Sticky Notes.lnk -
C:\Users\Leticia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Adobe Illustrator CS6 (64 Bit).lnk - C:\Program Files\Adobe\Adobe Illustrator CS6 (64 Bit)\Support Files\Contents\Windows\Illustrator.exe
C:\Users\Leticia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Adobe Photoshop CS6 (64 Bit).lnk - C:\Program Files\Adobe\Adobe Photoshop CS6 (64 Bit)\Photoshop.exe
C:\Users\Leticia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Leticia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft PowerPoint 2010.lnk - C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pptico.exe
C:\Users\Leticia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Word 2010.lnk - C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\wordicon.exe
C:\Users\Leticia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Paint.lnk - C:\Windows\system32\mspaint.exe
C:\Users\Leticia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk - C:\Windows\explorer.exe
C:\Users\Leticia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Live Messenger.lnk - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Users\Leticia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk - C:\Program Files (x86)\Windows Media Player\wmplayer.exe /prefetch:1
C:\Users\Nayara\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Nayara\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Nayara\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Nayara\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Nayara\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\7e4dca80246863e3\pinned.lnk - C:\Windows\system32\control.exe
C:\Users\Nayara\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Nayara\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Skype.lnk - C:\Windows\Installer\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}\SkypeIcon.exe
C:\Users\Usuário Padrão\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Usuário Padrão\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -

==== Reset IE Proxy ======================

Value(s) before fix:
"ProxyEnable"=dword:00000000

Value(s) after fix:
"ProxyEnable"=dword:00000000

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\InternetUpdater deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Celso\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Leticia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Leticia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Nayara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Nayara\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\Celso\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
C:\Users\Leticia\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
C:\Users\Nayara\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache is not empty, a reboot is needed

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=311 folders=80 14742527 bytes)

==== Empty Temp Folders ======================

C:\Users\Administrator\AppData\Local\temp emptied successfully
C:\Users\Celso\AppData\Local\Temp will be emptied at reboot
C:\Users\Default\AppData\Local\temp emptied successfully
C:\Users\Default User\AppData\Local\temp emptied successfully
C:\Users\Leticia\AppData\Local\temp emptied successfully
C:\Users\Nayara\AppData\Local\temp emptied successfully
C:\Users\Public\AppData\Local\temp emptied successfully
C:\Users\Usuário Padrão\AppData\Local\temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Celso\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\Leticia\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\XS557NNQ\empire.static.zgncdn.com" not found
"C:\Users\Leticia\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\XS557NNQ\www8.agame.com" not found

==== EOF on 10/04/2014 at 0:09:13,19 ======================

por **Power Max** Qui 10 Abr 2014, 08:48

Desative temporariamente seu antivírus para evitar conflitos.

*Clique com o botão direito do mouse no Zoek.exe e selecione [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

* Selecione e copie todo este texto destacado em vermelho que te passei e cole-o no espaço em branco do Zoek

*Clique [Run Script]

*Durante o scan uma mensagem parecida com esta abaixo mostrando o progresso do escaneamento será apresentada. Aguarde o término...pode demorar!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

*Caso a reinicialização do PC seja solicitada, clique [OK]

* Poste o log do Zoek que estará em C:\zoek-results.txt em sua próxima resposta.

por crfornaciari Qui 10 Abr 2014, 20:49

Zoek.exe v5.0.0.0 Updated 07-March-2014
Tool run by Celso on 10/04/2014 at 20:32:07,15.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Celso\Downloads\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2014-04-10-014935.log 447 bytes
C:\zoek-results2014-04-10-030913.log 59668 bytes
C:\zoek-results2014-04-10-225224.log 21490 bytes
C:\zoek-results2014-04-10-231039.log 16327 bytes

==== System Restore Info ======================

10/04/2014 20:35:53 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BAVSvc deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BAVSvc deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BdApiUtil deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BdApiUtil deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BdCameraProtect deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BdCameraProtect deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bfilter deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Bfilter deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bfmon deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Bfmon deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BHipsSvc deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BHipsSvc deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bprotect deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Bprotect deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BprotectEx deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BprotectEx deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PCFApiUtil deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\PCFApiUtil deleted successfully

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\baidu]
[-HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll\Splitupload]
[-HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll\Splitupload\bav]
[HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll\Splitupload\bav]
"DllVersion_2.0"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\Antivirus]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\LogLoc]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\PC Faster]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\PC Faster\LogUp]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP\Processing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP\Temp]
"C:\\ProgramData\\Baidu Security\\RpData\\rpFile-Updater-2014-02-12 02-51-43-0793-[23831].tmp"=-
"C:\\ProgramData\\Baidu Security\\RpData\\rpFile-PCFasterSvc-2014-02-12 02-51-43-0809-[23831].tmp"=-
"C:\\ProgramData\\Baidu Security\\RpData\\rpFile-PCFasterSvc-2014-02-12 02-07-17-0037-[26881].tmp"=-
"C:\\ProgramData\\Baidu Security\\RpData\\rpFile-pcftray-2014-02-12 02-07-17-0802-[26881].tmp"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{77FEF28E-EB96-44FF-B511-3185DEA48697}]
"DllName"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{B580CF65-E151-49C3-B73F-70B13FCA8E86}]
"DllName"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Baidu Antivirus"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"DisplayName"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"DisplayIcon"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"UninstallString"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"URLInfoAbout"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"Publisher"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
"InstallDir"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Baidu_Scan]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Baidu_Scan]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\Baidu_Scan]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\Baidu_Scan]
"DeviceDesc"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BFMON\0000]
"DeviceDesc"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BPROTECT\0000]
"DeviceDesc"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BAVSvc]
"DisplayName"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BAVSvc]
"Description"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BdApiUtil]
"ImagePath"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BdCameraProtect]
"ImagePath"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Bfilter]
"DisplayName"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Bfmon]
"DisplayName"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BHipsSvc]
"DisplayName"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BHipsSvc]
"Description"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Bprotect]
"DisplayName"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Bprotect]
"InstPath"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BprotectEx]
"DisplayName"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BprotectEx]
"InstPath"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCFApiUtil]
"ImagePath"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BFILTER\0000]
"DeviceDesc"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BFMON\0000]
"DeviceDesc"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BPROTECT\0000]
"DeviceDesc"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\BAVSvc]
"DisplayName"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\BAVSvc]
"Description"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\BdApiUtil]
"ImagePath"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\BdCameraProtect]
"ImagePath"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Bfilter]
"DisplayName"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Bfmon]
"DisplayName"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\BHipsSvc]
"DisplayName"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\BHipsSvc]
"Description"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Bprotect]
"DisplayName"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\Bprotect]
"InstPath"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\BprotectEx]
"DisplayName"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\BprotectEx]
"InstPath"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PCFApiUtil]
"ImagePath"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BFILTER\0000]
"DeviceDesc"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BFMON\0000]
"DeviceDesc"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BPROTECT\0000]
"DeviceDesc"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BAVSvc]
"DisplayName"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BAVSvc]
"Description"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BdApiUtil]
"ImagePath"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BdCameraProtect]
"ImagePath"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Bfilter]
"DisplayName"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Bfmon]
"DisplayName"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BHipsSvc]
"DisplayName"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BHipsSvc]
"Description"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Bprotect]
"DisplayName"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Bprotect]
"InstPath"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BprotectEx]
"DisplayName"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BprotectEx]
"InstPath"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PCFApiUtil]
"ImagePath"=-
[-HKEY_USERS\.DEFAULT\Software\Baidu Security]
[-HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus]
[-HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus\web]
[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus\web]
"ucloud"=-
[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus\web]
"dcloud"=-
[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus\web]
"rcloud"=-
[-HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster]
[-HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\3.7.0.0]
[-HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\3.7.0.0\Run]
[-HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable]
[-HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\alluser]
[-HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\curuser]
[-HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\hkcu]
[-HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\hklm]
[-HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\hklm64]
[-HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\bug]
[-HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\bug\driver]
[-HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\bug\driver\072613-22401-01.dmp]
[-HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\bug\driver\092613-28828-01.dmp]
[-HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\bug\driver\120113-28797-01.dmp]
[-HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\DataReport]
[-HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security]
[-HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\Antivirus]
[-HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\Antivirus\web]
[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\Antivirus\web]
"ucloud"=-
[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\Antivirus\web]
"dcloud"=-
[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\Antivirus\web]
"rcloud"=-
[-HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster]
[-HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster\4.0.0.0]
[-HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster\4.0.0.0\Install]
[-HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster\4.0.0.0\Statistic]
[-HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster\4.0.0.0\UUReport]
[-HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster\DataReport]
[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster\DataReport]
"c:\\programdata\\baidu security\\rpdata"=-
[-HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster\Setup]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus\web]
[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus\web]
"ucloud"=-
[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus\web]
"dcloud"=-
[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus\web]
"rcloud"=-
[-HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\3.7.0.0]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\3.7.0.0\Run]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\alluser]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\curuser]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\hkcu]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\hklm]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\3.7.0.0\Run\Disable\hklm64]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\bug]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\bug\driver]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\bug\driver\072613-22401-01.dmp]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\bug\driver\092613-28828-01.dmp]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\bug\driver\120113-28797-01.dmp]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\DataReport]

==== Deleting Files \ Folders ======================

C:\Program Files (x86)\Baidu Security not found
C:\Program Files (x86)\Baidu Security\Baidu Antivirus not found
C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1033\BaiduSafe not found
C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1033\tools\BaiduExtMgr not found
C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1046\BaiduSafe not found
C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1046\tools\BaiduExtMgr not found
C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1054\BaiduSafe not found
C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1054\tools\BaiduExtMgr not found
C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1057\BaiduSafe not found
C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\I18N\1057\tools\BaiduExtMgr not found
C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\skin\tools\BaiduExtMgr not found
C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\update\I18N\1033\tools\BaiduExtMgr not found
C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\update\I18N\1046\tools\BaiduExtMgr not found
C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\update\I18N\1054\tools\BaiduExtMgr not found
C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\update\I18N\1057\tools\BaiduExtMgr not found
C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\update\skin\tools\BaiduExtMgr not found
C:\ProgramData\Baidu Security not found
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Baidu Antivirus not found
C:\Users\All Users\Baidu Security not found
C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Baidu Antivirus not found
C:\Users\Celso\AppData\Roaming\Baidu Security not found
C:\Users\Celso\AppData\Roaming\Baidu Security\PC Faster\3.7.0.0\Uninstall\Baidu PC Faster Uninstall not found
C:\Users\Celso\AppData\Roaming\Baidu Security\PC Faster\3.7.0.0\Uninstall\Baidu PC Faster Uninstall HK not found
C:\Users\Celso\AppData\Roaming\Baidu Security\PC Faster\4.0.0.0\Uninstall\Baidu PC Faster Uninstall not found
C:\Users\Celso\AppData\Roaming\Baidu Security\PC Faster\4.0.0.0\Uninstall\Baidu PC Faster Uninstall HK not found
C:\Users\Todos os Usuários\Baidu Security not found
C:\Users\Todos os Usuários\Microsoft\Windows\Start Menu\Programs\Baidu Antivirus not found
"C:\Users\Public\Desktop\Baidu Antivirus.lnk" not found

==== Folders Found ======================

2014-04-10 02:06:13 2014-04-10 02:06:13 -------- d-----w- C:\AdwCleaner\Quarantine\C\ProgramData\baidu
2014-04-10 03:06:45 2014-04-10 03:06:45 -------- d-----w- C:\ProgramData\Baidu
2014-04-10 03:06:45 2014-04-10 03:06:45 -------- d-----w- C:\Users\All Users\Baidu
2014-04-10 03:06:45 2014-04-10 03:06:45 -------- d-----w- C:\Users\Todos os Usuários\Baidu
2014-04-10 22:51:24 2014-04-10 22:51:28 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security
2014-04-10 22:51:40 2014-04-10 22:51:48 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_Baidu Antivirus
2014-04-10 22:51:48 2014-04-10 22:51:48 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_I18N_1033_BaiduSafe
2014-04-10 22:51:48 2014-04-10 22:51:48 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_I18N_1033_tools_BaiduExtMgr
2014-04-10 22:51:48 2014-04-10 22:51:48 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_I18N_1046_BaiduSafe
2014-04-10 22:51:48 2014-04-10 22:51:49 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_I18N_1046_tools_BaiduExtMgr
2014-04-10 22:51:49 2014-04-10 22:51:49 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_I18N_1054_BaiduSafe
2014-04-10 22:51:49 2014-04-10 22:51:49 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_I18N_1054_tools_BaiduExtMgr
2014-04-10 22:51:49 2014-04-10 22:51:49 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_I18N_1057_BaiduSafe
2014-04-10 22:51:49 2014-04-10 22:51:49 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_I18N_1057_tools_BaiduExtMgr
2014-04-10 22:51:49 2014-04-10 22:51:49 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_skin_tools_BaiduExtMgr
2014-04-10 22:51:49 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_update_I18N_1033_tools_BaiduExtMgr
2014-04-10 22:51:49 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_update_I18N_1046_tools_BaiduExtMgr
2014-04-10 22:51:49 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_update_I18N_1054_tools_BaiduExtMgr
2014-04-10 22:51:49 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_update_I18N_1057_tools_BaiduExtMgr
2014-04-10 22:51:49 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_update_skin_tools_BaiduExtMgr
2014-04-10 22:51:49 2014-04-10 22:51:51 -------- d---a-w- C:\zoek_backup\C_ProgramData_Baidu Security
2014-04-10 22:51:51 2014-04-10 22:51:51 -------- d---a-w- C:\zoek_backup\C_ProgramData_Microsoft_Windows_Start Menu_Programs_Baidu Antivirus
2014-04-10 02:52:11 2014-04-10 02:52:12 -------- d---a-w- C:\zoek_backup\C_PROGRA~3_Baidu
2014-04-10 22:51:51 2014-04-10 22:51:53 -------- d---a-w- C:\zoek_backup\C_Users_All Users_Baidu Security
2014-04-10 22:51:53 2014-04-10 22:51:53 -------- d---a-w- C:\zoek_backup\C_Users_All Users_Microsoft_Windows_Start Menu_Programs_Baidu Antivirus
2014-04-10 22:51:53 2014-04-10 22:51:53 -------- d---a-w- C:\zoek_backup\C_Users_Celso_AppData_Roaming_Baidu Security
2014-04-10 22:51:53 2014-04-10 22:51:54 -------- d---a-w- C:\zoek_backup\C_Users_Celso_AppData_Roaming_Baidu Security_PC Faster_3.7.0.0_Uninstall_Baidu PC Faster Uninstall
2014-04-10 22:51:54 2014-04-10 22:51:54 -------- d---a-w- C:\zoek_backup\C_Users_Celso_AppData_Roaming_Baidu Security_PC Faster_3.7.0.0_Uninstall_Baidu PC Faster Uninstall HK
2014-04-10 22:51:54 2014-04-10 22:51:54 -------- d---a-w- C:\zoek_backup\C_Users_Celso_AppData_Roaming_Baidu Security_PC Faster_4.0.0.0_Uninstall_Baidu PC Faster Uninstall
2014-04-10 22:51:54 2014-04-10 22:51:54 -------- d---a-w- C:\zoek_backup\C_Users_Celso_AppData_Roaming_Baidu Security_PC Faster_4.0.0.0_Uninstall_Baidu PC Faster Uninstall HK
2014-04-10 22:51:54 2014-04-10 22:51:55 -------- d---a-w- C:\zoek_backup\C_Users_Todos os Usuários_Baidu Security
2014-04-10 22:51:55 2014-04-10 22:51:56 -------- d---a-w- C:\zoek_backup\C_Users_Todos os Usuários_Microsoft_Windows_Start Menu_Programs_Baidu Antivirus
2014-04-10 22:51:24 2014-04-10 22:51:28 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\Baidu Antivirus
2014-04-10 22:51:28 2014-04-10 22:51:28 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\I18N\1033\BaiduSafe
2014-04-10 22:51:28 2014-04-10 22:51:28 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\I18N\1033\tools\BaiduExtMgr
2014-04-10 22:51:29 2014-04-10 22:51:29 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\I18N\1046\BaiduSafe
2014-04-10 22:51:29 2014-04-10 22:51:29 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\I18N\1046\tools\BaiduExtMgr
2014-04-10 22:51:29 2014-04-10 22:51:29 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\I18N\1054\BaiduSafe
2014-04-10 22:51:30 2014-04-10 22:51:30 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\I18N\1054\tools\BaiduExtMgr
2014-04-10 22:51:30 2014-04-10 22:51:30 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\I18N\1057\BaiduSafe
2014-04-10 22:51:30 2014-04-10 22:51:30 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\I18N\1057\tools\BaiduExtMgr
2014-04-10 22:51:36 2014-04-10 22:51:36 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\skin\tools\BaiduExtMgr
2014-04-10 22:51:40 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\update\I18N\1033\tools\BaiduExtMgr
2014-04-10 22:51:40 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\update\I18N\1046\tools\BaiduExtMgr
2014-04-10 22:51:40 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\update\I18N\1054\tools\BaiduExtMgr
2014-04-10 22:51:40 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\update\I18N\1057\tools\BaiduExtMgr
2014-04-10 22:51:40 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\update\skin\tools\BaiduExtMgr
2014-04-10 22:51:53 2014-04-10 22:51:53 -------- d---a-w- C:\zoek_backup\C_Users_Celso_AppData_Roaming_Baidu Security\PC Faster\3.7.0.0\Uninstall\Baidu PC Faster Uninstall
2014-04-10 22:51:53 2014-04-10 22:51:53 -------- d---a-w- C:\zoek_backup\C_Users_Celso_AppData_Roaming_Baidu Security\PC Faster\3.7.0.0\Uninstall\Baidu PC Faster Uninstall HK
2014-04-10 22:51:53 2014-04-10 22:51:53 -------- d---a-w- C:\zoek_backup\C_Users_Celso_AppData_Roaming_Baidu Security\PC Faster\4.0.0.0\Uninstall\Baidu PC Faster Uninstall
2014-04-10 22:51:53 2014-04-10 22:51:53 -------- d---a-w- C:\zoek_backup\C_Users_Celso_AppData_Roaming_Baidu Security\PC Faster\4.0.0.0\Uninstall\Baidu PC Faster Uninstall HK

==== Files Found ======================

--- C:\Users\Leticia\AppData\Roaming\Microsoft\Windows\Cookies\Low\leticia@baidu[1].txt ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ------w-
File size: 109
Created time: 2010-05-04 16:48:19
Modified time: 2010-05-04 16:48:19
MD5: 2762D5F38A846310152E9A97F64A66C6
SHA1: 9C1B917B6EA4FFB638B74C0BF0BC73490E08F29D

--- C:\Users\Leticia\AppData\Roaming\Microsoft\Windows\Cookies\Low\leticia@hm.baidu[1].txt ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ------w-
File size: 94
Created time: 2010-03-09 18:09:46
Modified time: 2010-03-09 18:09:46
MD5: E0A32DF4EEECA64C361150ACD47BA910
SHA1: 64EDD6AACAFF951A7F8B907D47CDA044788FE4B0

--- C:\Users\Leticia\AppData\Roaming\Microsoft\Windows\Cookies\Low\leticia@hm.baidu[2].txt ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ------w-
File size: 94
Created time: 2010-06-12 15:32:25
Modified time: 2010-06-12 15:32:25
MD5: 25A9D23D4DDB689E3711F2E647B2004C
SHA1: DE760F63039132D363373A581D27BC92DD39616F

==== Registry Search Results for "Baidu" ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\baidu]

[HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll]

[HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll\Splitupload]

[HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll\Splitupload\bav]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP\Temp]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]

[HKEY_USERS\.DEFAULT\Software\Baidu]

[HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug]

[HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug\Bav]

[HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug\Bav\log]

[HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug\Bav\log\BavSvc.exe]

[HKEY_USERS\.DEFAULT\Software\Baidu Security]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus\web]

[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security]

[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\Antivirus]

[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\Antivirus\web]

[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster]

[HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster\DataReport]

[HKEY_USERS\S-1-5-18\Software\Baidu]

[HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug]

[HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug\Bav]

[HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug\Bav\log]

[HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug\Bav\log\BavSvc.exe]

[HKEY_USERS\S-1-5-18\Software\Baidu Security]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus\web]

==== C:\zoek_backup content ======================

C:\zoek_backup (files=1136 folders=523 288933387 bytes)

==== After Reboot ======================

==== Deleting Files / Folders ======================

"C:\Program Files (x86)\Baidu Security\Baidu Antivirus\Bavnt.dll" not found
"C:\Program Files (x86)\Baidu Security\Baidu Antivirus\Bavnt64.dll" not found
"C:\Program Files (x86)\Baidu Security\Baidu Antivirus\BavWl.dat" not found
"C:\Program Files (x86)\Baidu Security\Baidu Antivirus\BHipsSvc.exe" not found
"C:\Program Files (x86)\Baidu Security\Baidu Antivirus\Bavnt.dll" not found
"C:\Program Files (x86)\Baidu Security\Baidu Antivirus\Bavnt64.dll" not found
"C:\Program Files (x86)\Baidu Security\Baidu Antivirus\BavWl.dat" not found
"C:\Program Files (x86)\Baidu Security\Baidu Antivirus\BHipsSvc.exe" not found
"C:\Program Files (x86)\Baidu Security\Baidu Antivirus\log\BAVSvc.log" not found
"C:\Program Files (x86)\Baidu Security\Baidu Antivirus\log\BavTray.log" not found
"C:\Program Files (x86)\Baidu Security\Baidu Antivirus\log\BHipsSvc.log" not found
"C:\Program Files (x86)\Baidu Security\Baidu Antivirus\log\BAVSvc.log" not found
"C:\Program Files (x86)\Baidu Security\Baidu Antivirus\log\BavTray.log" not found
"C:\Program Files (x86)\Baidu Security\Baidu Antivirus\log\BHipsSvc.log" not found
"C:\Program Files (x86)\Baidu Security" not found
"C:\Program Files (x86)\Baidu Security\Baidu Antivirus" not found

==== EOF on 10/04/2014 at 20:45:20,92 ======================

por **Power Max** Qui 10 Abr 2014, 21:52

Desative temporariamente seu antivírus para evitar conflitos.

*Clique com o botão direito do mouse no Zoek.exe e selecione [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

* Selecione e copie todo este texto destacado em vermelho que te passei e cole-o no espaço em branco do Zoek

*Clique [Run Script]

*Durante o scan uma mensagem parecida com esta abaixo mostrando o progresso do escaneamento será apresentada. Aguarde o término...pode demorar!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

*Caso a reinicialização do PC seja solicitada, clique [OK]

* Poste o log do Zoek que estará em C:\zoek-results.txt em sua próxima resposta.

por crfornaciari Qui 10 Abr 2014, 22:27

Zoek.exe v5.0.0.0 Updated 07-March-2014
Tool run by Celso on 10/04/2014 at 22:15:54,24.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Celso\Downloads\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2014-04-10-014935.log 447 bytes
C:\zoek-results2014-04-10-030913.log 59668 bytes
C:\zoek-results2014-04-10-225224.log 21490 bytes
C:\zoek-results2014-04-10-231039.log 16327 bytes
C:\zoek-results2014-04-10-234520.log 28708 bytes

==== System Restore Info ======================

10/04/2014 22:17:30 Zoek.exe System Restore Point Created Succesfully.

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\baidu]
[-HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll\Splitupload]
[-HKEY_LOCAL_MACHINE\SOFTWARE\baidu\CommonDll\Splitupload\bav]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Baidu_Drp_pos\DRP\Temp]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
[-HKEY_USERS\.DEFAULT\Software\Baidu]
[-HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug]
[-HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug\Bav]
[-HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug\Bav\log]
[-HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug\Bav\log\BavSvc.exe]
[-HKEY_USERS\.DEFAULT\Software\Baidu Security]
[-HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus]
[-HKEY_USERS\.DEFAULT\Software\Baidu Security\Antivirus\web]
[-HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security]
[-HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\Antivirus]
[-HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\Antivirus\web]
[-HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster]
[-HKEY_USERS\S-1-5-21-242347955-4282888179-3146403011-1000\Software\Baidu Security\PC Faster\DataReport]
[-HKEY_USERS\S-1-5-18\Software\Baidu]
[-HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug]
[-HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug\Bav]
[-HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug\Bav\log]
[-HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug\Bav\log\BavSvc.exe]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus]
[-HKEY_USERS\S-1-5-18\Software\Baidu Security\Antivirus\web]

==== Deleting Files \ Folders ======================

C:\ProgramData\Baidu deleted

==== Folders Found ======================

2014-04-10 02:06:13 2014-04-10 02:06:13 -------- d-----w- C:\AdwCleaner\Quarantine\C\ProgramData\baidu
2014-04-10 22:51:24 2014-04-10 22:51:28 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security
2014-04-10 22:51:40 2014-04-10 22:51:48 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_Baidu Antivirus
2014-04-10 22:51:48 2014-04-10 22:51:48 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_I18N_1033_BaiduSafe
2014-04-10 22:51:48 2014-04-10 22:51:48 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_I18N_1033_tools_BaiduExtMgr
2014-04-10 22:51:48 2014-04-10 22:51:48 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_I18N_1046_BaiduSafe
2014-04-10 22:51:48 2014-04-10 22:51:49 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_I18N_1046_tools_BaiduExtMgr
2014-04-10 22:51:49 2014-04-10 22:51:49 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_I18N_1054_BaiduSafe
2014-04-10 22:51:49 2014-04-10 22:51:49 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_I18N_1054_tools_BaiduExtMgr
2014-04-10 22:51:49 2014-04-10 22:51:49 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_I18N_1057_BaiduSafe
2014-04-10 22:51:49 2014-04-10 22:51:49 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_I18N_1057_tools_BaiduExtMgr
2014-04-10 22:51:49 2014-04-10 22:51:49 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_skin_tools_BaiduExtMgr
2014-04-10 22:51:49 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_update_I18N_1033_tools_BaiduExtMgr
2014-04-10 22:51:49 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_update_I18N_1046_tools_BaiduExtMgr
2014-04-10 22:51:49 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_update_I18N_1054_tools_BaiduExtMgr
2014-04-10 22:51:49 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_update_I18N_1057_tools_BaiduExtMgr
2014-04-10 22:51:49 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security_PC Faster_4.0.0.0_update_skin_tools_BaiduExtMgr
2014-04-11 01:17:50 2014-04-11 01:17:50 -------- d---a-w- C:\zoek_backup\C_ProgramData_Baidu
2014-04-10 22:51:49 2014-04-10 22:51:51 -------- d---a-w- C:\zoek_backup\C_ProgramData_Baidu Security
2014-04-10 22:51:51 2014-04-10 22:51:51 -------- d---a-w- C:\zoek_backup\C_ProgramData_Microsoft_Windows_Start Menu_Programs_Baidu Antivirus
2014-04-10 02:52:11 2014-04-10 02:52:12 -------- d---a-w- C:\zoek_backup\C_PROGRA~3_Baidu
2014-04-11 01:17:50 2014-04-11 01:17:50 -------- d---a-w- C:\zoek_backup\C_Users_All Users_Baidu
2014-04-10 22:51:51 2014-04-10 22:51:53 -------- d---a-w- C:\zoek_backup\C_Users_All Users_Baidu Security
2014-04-10 22:51:53 2014-04-10 22:51:53 -------- d---a-w- C:\zoek_backup\C_Users_All Users_Microsoft_Windows_Start Menu_Programs_Baidu Antivirus
2014-04-10 22:51:53 2014-04-10 22:51:53 -------- d---a-w- C:\zoek_backup\C_Users_Celso_AppData_Roaming_Baidu Security
2014-04-10 22:51:53 2014-04-10 22:51:54 -------- d---a-w- C:\zoek_backup\C_Users_Celso_AppData_Roaming_Baidu Security_PC Faster_3.7.0.0_Uninstall_Baidu PC Faster Uninstall
2014-04-10 22:51:54 2014-04-10 22:51:54 -------- d---a-w- C:\zoek_backup\C_Users_Celso_AppData_Roaming_Baidu Security_PC Faster_3.7.0.0_Uninstall_Baidu PC Faster Uninstall HK
2014-04-10 22:51:54 2014-04-10 22:51:54 -------- d---a-w- C:\zoek_backup\C_Users_Celso_AppData_Roaming_Baidu Security_PC Faster_4.0.0.0_Uninstall_Baidu PC Faster Uninstall
2014-04-10 22:51:54 2014-04-10 22:51:54 -------- d---a-w- C:\zoek_backup\C_Users_Celso_AppData_Roaming_Baidu Security_PC Faster_4.0.0.0_Uninstall_Baidu PC Faster Uninstall HK
2014-04-11 01:17:50 2014-04-11 01:17:50 -------- d---a-w- C:\zoek_backup\C_Users_Todos os Usuários_Baidu
2014-04-10 22:51:54 2014-04-10 22:51:55 -------- d---a-w- C:\zoek_backup\C_Users_Todos os Usuários_Baidu Security
2014-04-10 22:51:55 2014-04-10 22:51:56 -------- d---a-w- C:\zoek_backup\C_Users_Todos os Usuários_Microsoft_Windows_Start Menu_Programs_Baidu Antivirus
2014-04-10 22:51:24 2014-04-10 22:51:28 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\Baidu Antivirus
2014-04-10 22:51:28 2014-04-10 22:51:28 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\I18N\1033\BaiduSafe
2014-04-10 22:51:28 2014-04-10 22:51:28 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\I18N\1033\tools\BaiduExtMgr
2014-04-10 22:51:29 2014-04-10 22:51:29 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\I18N\1046\BaiduSafe
2014-04-10 22:51:29 2014-04-10 22:51:29 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\I18N\1046\tools\BaiduExtMgr
2014-04-10 22:51:29 2014-04-10 22:51:29 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\I18N\1054\BaiduSafe
2014-04-10 22:51:30 2014-04-10 22:51:30 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\I18N\1054\tools\BaiduExtMgr
2014-04-10 22:51:30 2014-04-10 22:51:30 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\I18N\1057\BaiduSafe
2014-04-10 22:51:30 2014-04-10 22:51:30 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\I18N\1057\tools\BaiduExtMgr
2014-04-10 22:51:36 2014-04-10 22:51:36 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\skin\tools\BaiduExtMgr
2014-04-10 22:51:40 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\update\I18N\1033\tools\BaiduExtMgr
2014-04-10 22:51:40 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\update\I18N\1046\tools\BaiduExtMgr
2014-04-10 22:51:40 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\update\I18N\1054\tools\BaiduExtMgr
2014-04-10 22:51:40 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\update\I18N\1057\tools\BaiduExtMgr
2014-04-10 22:51:40 2014-03-20 22:15:11 -------- d---a-w- C:\zoek_backup\C_Program Files (x86)_Baidu Security\PC Faster\4.0.0.0\update\skin\tools\BaiduExtMgr
2014-04-10 22:51:53 2014-04-10 22:51:53 -------- d---a-w- C:\zoek_backup\C_Users_Celso_AppData_Roaming_Baidu Security\PC Faster\3.7.0.0\Uninstall\Baidu PC Faster Uninstall
2014-04-10 22:51:53 2014-04-10 22:51:53 -------- d---a-w- C:\zoek_backup\C_Users_Celso_AppData_Roaming_Baidu Security\PC Faster\3.7.0.0\Uninstall\Baidu PC Faster Uninstall HK
2014-04-10 22:51:53 2014-04-10 22:51:53 -------- d---a-w- C:\zoek_backup\C_Users_Celso_AppData_Roaming_Baidu Security\PC Faster\4.0.0.0\Uninstall\Baidu PC Faster Uninstall
2014-04-10 22:51:53 2014-04-10 22:51:53 -------- d---a-w- C:\zoek_backup\C_Users_Celso_AppData_Roaming_Baidu Security\PC Faster\4.0.0.0\Uninstall\Baidu PC Faster Uninstall HK

==== Files Found ======================

--- C:\Users\Leticia\AppData\Roaming\Microsoft\Windows\Cookies\Low\leticia@baidu[1].txt ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ------w-
File size: 109
Created time: 2010-05-04 16:48:19
Modified time: 2010-05-04 16:48:19
MD5: 2762D5F38A846310152E9A97F64A66C6
SHA1: 9C1B917B6EA4FFB638B74C0BF0BC73490E08F29D

--- C:\Users\Leticia\AppData\Roaming\Microsoft\Windows\Cookies\Low\leticia@hm.baidu[1].txt ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ------w-
File size: 94
Created time: 2010-03-09 18:09:46
Modified time: 2010-03-09 18:09:46
MD5: E0A32DF4EEECA64C361150ACD47BA910
SHA1: 64EDD6AACAFF951A7F8B907D47CDA044788FE4B0

--- C:\Users\Leticia\AppData\Roaming\Microsoft\Windows\Cookies\Low\leticia@hm.baidu[2].txt ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ------w-
File size: 94
Created time: 2010-06-12 15:32:25
Modified time: 2010-06-12 15:32:25
MD5: 25A9D23D4DDB689E3711F2E647B2004C
SHA1: DE760F63039132D363373A581D27BC92DD39616F

==== Registry Search Results for "Baidu" ======================

No instances of string "Baidu" found.

==== C:\zoek_backup content ======================

C:\zoek_backup (files=1145 folders=529 288934625 bytes)

==== EOF on 10/04/2014 at 22:22:20,45 ======================

por **Power Max** Qui 10 Abr 2014, 22:29

O Baidu não aparece mais no log do Zoek. Como está o PC após estes procedimentos?

por crfornaciari Qui 10 Abr 2014, 22:38

Aparentemente ele esta ok, porém o Baidu desativou meu Kaspersky, e ele não esta mais ativando, oque pode ter acontecido?

por **Power Max** Qui 10 Abr 2014, 22:39

E se você desinstalar o Kaspersky e reinstalá-lo, será que resolve?

por crfornaciari Qui 10 Abr 2014, 22:42

Tenho que deixar apenas o Kaspersky ativo correto? O Windows Defender deve estar desativado por causa de conflito, correto?
Vou instalar ele novamente.

.

por **Power Max** Qui 10 Abr 2014, 22:46

crfornaciari escreveu:Tenho que deixar apenas o Kaspersky ativo correto? O Windows Defender deve estar desativado por causa de conflito, correto?
Vou instalar ele novamente..

Sim, deixe só o Kaspersky ativado.

por crfornaciari Qui 10 Abr 2014, 23:27

Agora ativou, porém esta aparecendo uma mensagem de que o windows encontrou um erro no disco rigido e esta solicitando a execução de backup. Será que esse baidu danificou algo no disco rígido?

por **Power Max** Qui 10 Abr 2014, 23:36

Será que esse baidu danificou algo no disco rígido?

É bem provável, visto que ele altera e/ou inclui várias chaves e valores no registro do Windows.

Se o Windows permitir, faça uma limpeza com o Ccleaner e Purera, como mostram estes artigos abaixo, e veja se assim o problema se resolve:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

por **Danii** Sáb 26 Abr 2014, 10:29

TÓPICO ARQUIVADO

Caso o autor do tópico necessite, o mesmo será reaberto, para isso deverá entrar em contato com um dos membros da [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] solicitando o desbloqueio.

por Conteúdo patrocinado

Remover AntiVirus Baidu

Remover AntiVirus Baidu

Re: Remover AntiVirus Baidu

Re: Remover AntiVirus Baidu

Re: Remover AntiVirus Baidu

Re: Remover AntiVirus Baidu

Re: Remover AntiVirus Baidu

esculpe a demora, segue relatório.

Re: Remover AntiVirus Baidu

Re: Remover AntiVirus Baidu

Re: Remover AntiVirus Baidu

Re: Remover AntiVirus Baidu

Re: Remover AntiVirus Baidu

Re: Remover AntiVirus Baidu

Re: Remover AntiVirus Baidu

Re: Remover AntiVirus Baidu

Re: Remover AntiVirus Baidu

Re: Remover AntiVirus Baidu

Re: Remover AntiVirus Baidu

Seg	Ter	Qua	Qui	Sex	Sáb	Dom
1	2	3	4	5	6	7
8	9	10	11	12	13	14
15	16	17	18	19	20	21
22	23	24	25	26	27	28
29	30