Faxina no meu Pc - terminar a limpeza com o ZHP

Olá amigos,
gostaria que analizassem o meu PC conforme o relatorio anexo do ZHP; já passei o Zoek, Jrt, Malwarebytes e já percebi muitas melhoras; então, queria finalizar com esse ZHP aí, pude ver no log que estou postando que ainda tem restos do maldito Baidu no registro. Me ajudem por favor!!!

05.15.2014 20:14:06

Olá João. O arquivo não apareceu aqui no Fórum. Copie todo o relatório e poste aqui, ou então anexe como mostra este tutorial:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Vamos ver se dessa vez vai...obrigado Power Max


~ Relatório do ZHPDiag v2014.5.15.64 - Nicolas Coolman  (15/05/2014)
~ Iniciado por Windows 7 (15/05/2014 20:01:54)
~ Endereço do Website : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Blog de análise de software : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Fóruns de suporte gratuito para desinfecção : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Tradução pelo utilizador
~ Estatuto da versão :
~  Lista Branca : Ativado pelo programa
~ Elevação dos Privilégios : OK
~ Controle de Conta de Utilizador : Deactivate by program


---\\ Navegadores Internet
MSIE: Internet Explorer v11.0.9600.17041
GCIE: Google Chrome v34.0.1847.137 (Defaut)

---\\ Informações sobre os produtos Windows
~ Langage: Portugais
Windows 7 Ultimate, 32-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK

---\\ Softwares de proteçao do sistema
Malwarebytes Anti-Malware versão 2.0.1.1004
Windows Defender W7

---\\ Softwares d'optimização do sistema

---\\ Softwares de partilha do PeerToPeer (P2P)

---\\ Monitoramento dos softwares
Adobe Flash Player 13 Plugin
Adobe Reader XI

---\\ Informações sobre o sistema
~ Processor: x86 Family 6 Model 15 Stepping 13, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3063 MB (51% free)
System Restore: Activé (Enable)
System drive C: has 55 GB (37%) free of 149 GB

---\\ Modo de conexão ao sistema
~ Computer Name: WINDOWS7-PC
~ User Name: Windows 7
~ All Users Names: Windows 7, HomeGroupUser$, Convidado, Administrador,
~ Unselected Option: 045,061,O62,065,066,080,O82,089
Logged in as Administrator

---\\ As variáveis de ambiente
~ System Unit : C:\
~ %AppZHP% : C:\Users\Windows 7\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Windows 7\AppData\Roaming\
~ %Desktop% : C:\Users\Windows 7\Desktop\
~ %Favorites% : C:\Users\Windows 7\Favorites\
~ %LocalAppData% : C:\Users\Windows 7\AppData\Local\
~ %StartMenu% : C:\Users\Windows 7\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumeração das unidades dos discos
A: Floppy drive, Flash card reader, USB Key (Not Inserted)
C: Hard drive, Flash drive, Thumb drive (Free 55 Go of 149 Go)
D: CD-ROM drive (Not Inserted)
E: Hard drive, Flash drive, Thumb drive (Free 402 Go of 466 Go)



---\\ Estado do Centro de Segurança do Windows
~ Security Center: 49 Legitimates Filtered in 00mn 00s



---\\ Pesquisa particular de ficheiros genéricos
[MD5.8B88EBBB05A0E56B7DCC708498C02B3E] - (.Microsoft Corporation - Windows Explorer.) (.25/02/2011 - 02:30:54.) -- C:\Windows\Explorer.exe [2616320]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Aplicativo de Inicialização do Windows.) (.13/07/2009 - 22:14:45.) -- C:\Windows\System32\Wininit.exe [96256]
[MD5.E4E829EE073E046B0EB19B5FECB19B8C] - (.Microsoft Corporation - Internet Extensions para Win32.) (.06/03/2014 - 02:41:49.) -- C:\Windows\System32\wininet.dll [1789440]
[MD5.6D13E1406F50C66E2A95D97F22C47560] - (.Microsoft Corporation - Aplicativo de Logon do Windows.) (.20/11/2010 - 09:17:54.) -- C:\Windows\System32\Winlogon.exe [286720]
[MD5.E3AE23569749DE12D45BA3B489A036AE] - (.Microsoft Corporation - Biblioteca de Licenciamento de Software.) (.20/11/2010 - 09:21:24.) -- C:\Windows\System32\sppcomapi.dll [193536]
[MD5.F81BB7E487EDCEAB630A7EE66CF23913] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.15/11/2013 - 09:49:13.) -- C:\Windows\system32\Drivers\AFD.sys [338944]
[MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.13/07/2009 - 22:26:15.) -- C:\Windows\system32\Drivers\atapi.sys [21584]
[MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 20:11:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656]
[MD5.BE167ED0FDB9C1FA1133953C18D5A6C9] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 05:38:10.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544]
[MD5.F024449C97EC1E464AAFFDA18593DB88] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 05:42:32.) -- C:\Windows\system32\Drivers\DfsC.sys [78336]
[MD5.9036377B8A6C15DC2EEC53E489D159B5] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 06:59:29.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544]
[MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - Driver de porta i8042.) (.13/07/2009 - 20:11:24.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896]
[MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.13/07/2009 - 20:54:29.) -- C:\Windows\system32\Drivers\IpNat.sys [101888]
[MD5.5D16C921E3671636C0EBA3BBAAC5FD25] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.26/04/2011 - 23:17:22.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123904]
[MD5.280122DDCF04B378EDD1AD54D71C1E54] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 05:39:44.) -- C:\Windows\system32\Drivers\netBT.sys [187904]
[MD5.C8DFF8D07755A66C7A4A738930F0FEAC] - (.Microsoft Corporation - Driver do Sistema de Arquivos NT.) (.23/01/2014 - 23:18:22.) -- C:\Windows\system32\Drivers\ntfs.sys [1212352]
[MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - Driver de porta paralela.) (.13/07/2009 - 20:45:35.) -- C:\Windows\system32\Drivers\Parport.sys [79360]
[MD5.D9F91EAFEC2815365CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13/07/2009 - 20:54:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848]
[MD5.B973FCFC50DC1434E1970A146F7E3885] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.20/11/2010 - 07:24:46.) -- C:\Windows\system32\Drivers\rdpdr.sys [133632]
[MD5.3E21C083B8A01CB70BA1F09303010FCE] - (.Microsoft Corporation - SMB Transport driver.) (.13/07/2009 - 20:53:41.) -- C:\Windows\system32\Drivers\smb.sys [71168]
[MD5.B459575348C20E8121D6039DA063C704] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 05:39:17.) -- C:\Windows\system32\Drivers\tdx.sys [74752]
[MD5.F497F67932C6FA693D7DE2780631CFE7] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.20/11/2010 - 09:30:16.) -- C:\Windows\system32\Drivers\volsnap.sys [245632]
~ Generic Processes:  Scanned in 00mn 00s



---\\ Estatuto dos ficheiros ocultos (Oculto/Total)
~ Mes images (My Pictures) : 2/15368
~ Mes musiques (My Musics) : 13/3729
~ Mes Videos (My Videos) : 2/337
~ Mes Favoris (My Favorites) : 1/371
~ Mes Documents (My Documents) : 3/602
~ Mon Bureau (My Desktop) : 2/397
~ Menu demarrer (Programs) : 1/7
~ Hidden Files:  Scanned in 00mn 23s



---\\ Processos lançados
[MD5.68239842340DDFF8993DFD9127553EDA] - (.Intel Corporation - igfxTray Module.) -- C:\Windows\System32\igfxtray.exe   [141848] [PID.3144]
[MD5.004763BDF8E48244DBB9FDFDE3065EBC] - (.Intel Corporation - hkcmd Module.) -- C:\Windows\System32\hkcmd.exe   [173592] [PID.3232]
[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe   [254336] [PID.3388]
[MD5.1766A2E004154830D4327861AF1BD3AB] - (.Bitdefender - Bitdefender Agent.) -- C:\Program Files\Bitdefender\Bitdefender\bdagent.exe   [1845064] [PID.3596]
[MD5.C92D440021D08216409E04399F9C0D95] - (.Ashampoo Development GmbH & Co. KG - Ashampoo Live-Tuner Client.) -- C:\Program Files\Ashampoo\Ashampoo WinOptimizer 11\LiveTuner2.exe   [3516808] [PID.3864]
[MD5.B38B860BF3D89F17EB6FF6183DB97DC7] - (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe   [482392] [PID.3980]
[MD5.597CF4BEDFDC81B8903982664CAC6ED0] - (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\bdapppassmgr.exe   [614232] [PID.4092]
[MD5.62918A00DE565A7609893F0CD29A4045] - (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe   [901096] [PID.108]
[MD5.9F98821AE94E8CC78F7A5D423791B839] - (.TeamViewer GmbH - TeamViewer 9.) -- C:\Program Files\TeamViewer\Version9\TeamViewer.exe   [12971328] [PID.1528]
[MD5.345B1798395CEA9C178AFF1784FA2A37] - (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe   [841032] [PID.5316]
[MD5.C0EAE6AC1C580FC39754180A3726180E] - (.Bitdefender - Bitdefender Wallet Chrome Extension Native.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxcrnmh.exe   [62664] [PID.6208]
[MD5.254B28136B946880155025E40D150D3D] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe   [7875584] [PID.884]
~ Processes Running:  Scanned in 00mn 01s



---\\ Google Chrome, Arranque,Pesquisa,Extensões (G0,G1,G2)
C:\Users\Windows 7\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [ahfgeienlihckogmohjhadlkjgocpleb] Loja v.0.2 (Activé)
G2 - GCE: Preference [User Data\Default] [ccahoghmggldkcdjiebjkidpfongdfbl] Bitdefender Wallet v.17.28.1 (Activé)
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)

---\\ Pasta de extensão do Google Chrome
~ Google Lines Browser: 18 Legitimates Filtered in 00mn 01s



---\\ Mozilla Firefox, Plugins,Arranque,Pesquisa,Extensões (P2,M0,M1,M2,M3)
P2 - FPN: [HKCU] [gastecnologia.com.br/sf/bb] - (.GAS Tecnologia - Internet Banking Helper.) -- C:\Users\Windows 7\AppData\Local\GAS Tecnologia\GBBD\npsf_bb.dll
~ Firefox Browser: 10 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Arranque, Pesquisa, URLSearchHook( gancho de URL), Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.GAS Tecnologia - Internet Banking Helper.) (No version) -- (.not file.)
~ IE Browser: 16 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Gestão do Proxy (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
~ Proxy management:  Scanned in 00mn 00s



---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys:  Scanned in 00mn 00s



---\\ Redireção do ficheiro Hosts (01)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File:  Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Browser Helper Objects do navegador (02)
O2 - BHO: (no name) - AutorunsDisabled Chave orfã
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} . (.Banco do Brasil - Gbieh Module.) -- C:\PROGRAM FILES\GBPLUGIN\gbieh.dll
~ BHO: 16 Legitimates Filtered in 00mn 00s



---\\ Aplicações iniciadas por registo & pastas (04)
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe   =>.Adobe Systems Incorporated
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe   =>.Oracle Corporation
O4 - HKLM\..\Run: [Bdagent] . (.Bitdefender - Bitdefender Agent.) -- C:\Program Files\Bitdefender\Bitdefender\bdagent.exe
O4 - HKLM\..\Run: [Ashampoo WinOptimizer Live-Tuner2] . (.Ashampoo Development GmbH & Co. KG - Ashampoo Live-Tuner Client.) -- C:\Program Files\Ashampoo\Ashampoo WinOptimizer 11\LiveTuner2.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [Agente da Carteira Bitdefender] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe
O4 - HKCU\..\Run: [Agente de Aplicativo de Carteira Bitdefender] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\bdapppassmgr.exe
O4 - HKCU\..\Run: [Carteira Bitdefender] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe
O4 - HKUS\.DEFAULT\..\Run: [Agente da Carteira Bitdefender] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe
O4 - HKUS\.DEFAULT\..\Run: [Carteira Bitdefender] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe
O4 - HKUS\.DEFAULT\..\Run: [Agente de Aplicativo de Carteira Bitdefender] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\bdapppassmgr.exe
O4 - HKUS\S-1-5-18\..\Run: [Agente da Carteira Bitdefender] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe
O4 - HKUS\S-1-5-18\..\Run: [Carteira Bitdefender] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe
O4 - HKUS\S-1-5-18\..\Run: [Agente de Aplicativo de Carteira Bitdefender] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\bdapppassmgr.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [SPReview] . (.Microsoft Corporation - SP Reviewer.) -- C:\Windows\System32\SPReview\SPReview.exe   =>.Microsoft Corporation
O4 - HKUS\S-1-5-18\..\RunOnce: [SPReview] . (.Microsoft Corporation - SP Reviewer.) -- C:\Windows\System32\SPReview\SPReview.exe   =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-1345213309-4198415469-3032410945-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKUS\S-1-5-21-1345213309-4198415469-3032410945-1000\..\Run: [Agente da Carteira Bitdefender] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe
O4 - HKUS\S-1-5-21-1345213309-4198415469-3032410945-1000\..\Run: [Agente de Aplicativo de Carteira Bitdefender] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\bdapppassmgr.exe
O4 - HKUS\S-1-5-21-1345213309-4198415469-3032410945-1000\..\Run: [Carteira Bitdefender] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe
~ Application:  Scanned in 00mn 00s



---\\ Boutões da barra de ferramentas principal do Internet Explorer (09)
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} . (.Microsoft Corporation - Windows Live Writer Blog This Extension.) -- C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft Office OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- C:\Program Files\Skype\Toolbars\Internet Explorer\icon.ico
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO
~ IE Extra Buttons:  Scanned in 00mn 00s



---\\ Site na zona confiavél do Internet Explorer (05)
O15 - Trusted Zone: [HKCU\...\Domains\www] *.bancobrasil.com.br
O15 - Trusted Zone: [HKCU\...\Domains\www] *.bb.com.br
~ IE Zone Confiance:  Scanned in 00mn 01s



---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} ((no name)) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O16 - DPF: {7ECB1A47-6647-4B2C-A8DA-675569C9FF15} ((no name)) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Objets ActiveX:  Scanned in 00mn 00s



---\\ Alteração Dominio/Clientes DNS (017)
O17 - HKLM\System\CCS\Services\Tcpip\..\{7945DE37-1C7F-4B5C-AD77-9A1557BAC881}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{79850B7C-E72A-4EC3-BD8E-F78AAD1C339A}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\..\{7945DE37-1C7F-4B5C-AD77-9A1557BAC881}: DhcpDomain = lan
O17 - HKLM\System\CS1\Services\Tcpip\..\{7945DE37-1C7F-4B5C-AD77-9A1557BAC881}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{79850B7C-E72A-4EC3-BD8E-F78AAD1C339A}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CS1\Services\Tcpip\..\{7945DE37-1C7F-4B5C-AD77-9A1557BAC881}: DhcpDomain = lan
O17 - HKLM\System\CS2\Services\Tcpip\..\{7945DE37-1C7F-4B5C-AD77-9A1557BAC881}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{79850B7C-E72A-4EC3-BD8E-F78AAD1C339A}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CS2\Services\Tcpip\..\{7945DE37-1C7F-4B5C-AD77-9A1557BAC881}: DhcpDomain = lan
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain:  Scanned in 00mn 00s



---\\ Protocolo adicional (018)
O18 - Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (.Microsoft Corporation - Photo Gallery Album Download Protocol Handl.) -- C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll  =>.Microsoft Corporation
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.dll  =>.Microsoft Corporation
~ Protocole Additionnel:  Scanned in 00mn 00s



---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify:  GbPluginBb . (.Banco do Brasil - Gbieh Module.) -- C:\PROGRAM FILES\GBPLUGIN\gbieh.dll
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon:  Scanned in 00mn 00s



---\\ Lista dos serviços NT não Microsoft e não desativados (023)
O23 - Service: Gbp Service (GbpSv) . (.GAS Tecnologia - G-Buster Browser Defense - Service.) - C:\Program Files\GbPlugin\gbpsv.exe
O23 - Service: Ashampoo LiveTuner 2 Service (WO_LiveService2) . (...) - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 11\LiveTunerService.exe
~ Services: 12 Legitimates Filtered in 00mn 07s



---\\ Tarefas planificadas automaticamente (039)
[MD5.DA0D875CCA5C767D4BD8EE3D50845BF5] [APT] [One-Click Optimizer WO11] (.Ashampoo Development GmbH & Co. KG.) -- C:\Program Files\Ashampoo\Ashampoo WinOptimizer 11\WO11.exe   [8557448]
O39 - APT:  - (..) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater   [902]
O39 - APT:  - (..) -- C:\Windows\Tasks\CBU.exe_TEST_TASK.job   [286]
O39 - APT:  - (..) -- C:\Windows\System32\Tasks\CBU.exe_TEST_TASK   [286]
O39 - APT:  - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1ce7fe723970eac   [1054]
O39 - APT:  - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA1ce777c51b15b8f   [1058]
O39 - APT: One-Click Optimizer WO11 - (.Ashampoo Development GmbH & Co. KG.) -- C:\Windows\Tasks\One-Click Optimizer WO11.job   [394]
O39 - APT: One-Click Optimizer WO11 - (.Ashampoo Development GmbH & Co. KG.) -- C:\Windows\System32\Tasks\One-Click Optimizer WO11   [394]
~ Scheduled Task: 12 Legitimates Filtered in 00mn 06s



---\\ Drivers lançados ao arranque do sistema (041)
O41 - Driver:  (Ndisrd) . (.GAS Tecnologia - GAS Tecnologia - LWF Helper Driver.) - C:\Windows\System32\DRIVERS\gbpndisrdn.sys
O41 - Driver:  (UimBus) . (...) - C:\Windows\System32\DRIVERS\UimBus.sys
O41 - Driver:  (Uim_DEVIM) . (...) - C:\Windows\System32\DRIVERS\uim_devim.sys
O41 - Driver:  (Uim_IM) . (...) - C:\Windows\System32\DRIVERS\uim_im.sys
~ Drivers: 90 Legitimates Filtered in 00mn 00s



---\\ Software instalados (042)
O42 - Logiciel: Módulo de Segurança - Banco do Brasil - (...) [HKLM] -- {36386dc9-8543-4b12-ae6b-220fd52f19f3}_is1
~ Logic: 1 Legitimates Filtered in 00mn 00s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\GbAs]
[HKCU\Software\MicApp]
[HKCU\Software\WandouLabs]
[HKLM\Software\AutoHelpDesk]
[HKLM\Software\MaxPower]
~ Key Software: 150 Legitimates Filtered in 00mn 00s



---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 23/08/2012 - 21:49:44 - [] ----D C:\Program Files\Curriculum 3.0
O43 - CFD: 18/03/2013 - 00:47:21 - [] ----D C:\Users\Windows 7\AppData\Roaming\Baidu Security  =>Adware.BDSearch
O43 - CFD: 24/09/2013 - 00:42:07 - [] ----D C:\Users\Windows 7\AppData\Roaming\WandoujiaUsbDriver
O43 - CFD: 22/04/2014 - 00:08:45 - [] ----D C:\Users\Windows 7\AppData\Local\com
~ Program Folder: 178 Legitimates Filtered in 00mn 01s



---\\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044)
O44 - LFC:[MD5.DCC7ABC9D7FBB694B59CF44D392EB76B] - 01/05/2014 - 12:23:34 ---A- . (...) -- C:\zoek-results2014-04-30-040124.log   [1265]
O44 - LFC:[MD5.8C62772B554E27C796B3E84B44393337] - 01/05/2014 - 13:18:14 ---A- . (...) -- C:\zoek-results2014-05-01-161814.log   [25102]
O44 - LFC:[MD5.A51584ADD1859EF184B683D3DE6742C5] - 13/05/2014 - 11:41:50 ---A- . (...) -- C:\Windows\System32\prfc0416.dat   [163098]
O44 - LFC:[MD5.6810922B88A84EE2048C3962ADDB0C4E] - 13/05/2014 - 11:41:50 ---A- . (...) -- C:\Windows\System32\prfh0416.dat   [756196]
O44 - LFC:[MD5.CC7AA7B42CF418FC3D926913490048F8] - 14/05/2014 - 23:17:30 ---A- . (...) -- C:\Windows\zoek-delete.exe   [24064]
O44 - LFC:[MD5.211AC93890E037DE9B9A7C88626C4710] - 14/05/2014 - 23:41:30 ---A- . (...) -- C:\zoek-results.log   [21848]
O44 - LFC:[MD5.21FDADF888D46112570C24381428F2B8] - 15/05/2014 - 00:35:55 ---A- . (...) -- C:\bdlog.txt   [118963]
~ Files: 161 Legitimates Filtered in 00mn 08s



---\\ Operações e funções ao arranque do Windows Explorer (046)
O46 - SEH:ShellExecuteHooks - GbPlugin ShlObj - {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\PROGRAM FILES\GBPLUGIN\gbieh.dll
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
~ ShellExecuteHooks:  Scanned in 00mn 00s



---\\ Enumeração das chaves do registo PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorUser"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKLM\...\Policies\System] - "DisableCAD"=1
O55 - MWPS:[HKLM\...\Policies\System] - "VerboseStatus"=0
O55 - MWPS:[HKLM\...\Policies\System] - "NoDispCPL"=0
~ MWPS: 26 Legitimates Filtered in 00mn 00s



---\\ Enumeração das chaves do registo PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoLowDiskSpaceChecks"=1
O56 - MWPE:[HKLM\...\policies\Explorer] - "MemCheckBoxInRunDlg"=1
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoResolveTrack"=0
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoClose"=0
~ MWPE Keys: 17 Legitimates Filtered in 00mn 00s



---\\ Lista dos drivers do sistema (SDL) (O58)
O58 - SDL:13/07/2009 - 22:20:28 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys   [453712]
O58 - SDL:08/05/2013 - 09:52:48 ---A- . (.GAS Tecnologia - GbPlugin Device Driver.) -- C:\Windows\System32\Drivers\GbpKm.sys   [49536]
O58 - SDL:06/03/2014 - 18:09:42 ---A- . (.GAS Tecnologia - GAS Tecnologia - LWF Helper Driver.) -- C:\Windows\System32\Drivers\gbpndisrdn.sys   [29400]
O58 - SDL:13/07/2009 - 19:54:14 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys   [26624]
O58 - SDL:04/11/2013 - 20:32:43 ---A- . (.Sysinternals - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] - Process Explorer.) -- C:\Windows\System32\Drivers\PROCEXP113.SYS   [12568]
O58 - SDL:13/07/2009 - 22:19:04 ---A- . (.Promise Technology - Promise  SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys   [21072]
O58 - SDL:26/03/2014 - 12:46:02 ---A- . (...) -- C:\Windows\System32\Drivers\SWDUMon.sys   [13464]
O58 - SDL:16/12/2013 - 18:29:06 ---A- . (...) -- C:\Windows\System32\Drivers\UimBus.sys   [91016]
O58 - SDL:16/12/2013 - 18:29:06 ---A- . (...) -- C:\Windows\System32\Drivers\UimFIO.sys   [426248]
O58 - SDL:16/12/2013 - 18:29:06 ---A- . (...) -- C:\Windows\System32\Drivers\uim_devim.sys   [20616]
O58 - SDL:16/12/2013 - 18:29:06 ---A- . (...) -- C:\Windows\System32\Drivers\uim_im.sys   [540168]
O58 - SDL:13/07/2009 - 18:40:41 ---A- . (...) -- C:\Windows\System32\ANSI.SYS   [9029]
O58 - SDL:13/07/2009 - 18:40:44 ---A- . (...) -- C:\Windows\System32\country.sys   [27097]
O58 - SDL:13/07/2009 - 18:40:40 ---A- . (...) -- C:\Windows\System32\HIMEM.SYS   [4768]
O58 - SDL:13/07/2009 - 18:40:43 ---A- . (...) -- C:\Windows\System32\KEY01.SYS   [42809]
O58 - SDL:13/07/2009 - 18:40:43 ---A- . (...) -- C:\Windows\System32\KEYBOARD.SYS   [42537]
O58 - SDL:13/07/2009 - 18:40:23 ---A- . (...) -- C:\Windows\System32\NTDOS.SYS   [27866]
O58 - SDL:13/07/2009 - 18:40:31 ---A- . (...) -- C:\Windows\System32\NTDOS404.SYS   [29146]
O58 - SDL:13/07/2009 - 18:40:35 ---A- . (...) -- C:\Windows\System32\NTDOS411.SYS   [29370]
O58 - SDL:13/07/2009 - 18:40:39 ---A- . (...) -- C:\Windows\System32\NTDOS412.SYS   [29274]
O58 - SDL:13/07/2009 - 18:40:27 ---A- . (...) -- C:\Windows\System32\NTDOS804.SYS   [29146]
O58 - SDL:13/07/2009 - 18:40:11 ---A- . (...) -- C:\Windows\System32\NTIO.SYS   [33952]
O58 - SDL:13/07/2009 - 18:40:15 ---A- . (...) -- C:\Windows\System32\NTIO404.SYS   [34672]
O58 - SDL:13/07/2009 - 18:40:17 ---A- . (...) -- C:\Windows\System32\NTIO411.SYS   [35776]
O58 - SDL:13/07/2009 - 18:40:19 ---A- . (...) -- C:\Windows\System32\NTIO412.SYS   [35536]
O58 - SDL:13/07/2009 - 18:40:13 ---A- . (...) -- C:\Windows\System32\NTIO804.SYS   [34672]
~ Drivers: 93 Legitimates Filtered in 00mn 42s



---\\ Lista das ferramentas de remoção de vírus (LAT) (063)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1  =>.Nicolas Coolman
~ ADS:  Scanned in 00mn 00s



---\\ Lista dos serviços Legacy du registo (064)
O64 - Services: CurCS - 17/04/2012 - C:\Windows\System32\DRIVERS\bdvedisk.sys (BDVEDISK)  .(.BitDefender - FileVault Disk Driver.) - LEGACY_BDVEDISK
O64 - Services: CurCS - 08/05/2013 - C:\Windows\System32\drivers\gbpkm.sys (GbpKm)  .(.GAS Tecnologia - GbPlugin Device Driver.) - LEGACY_GBPKM
O64 - Services: CurCS - 20/03/2014 - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 11\LiveTuner32.sys (LiveTuner2PM) .(...) - LEGACY_LIVETUNER2PM
O64 - Services: CurCS - 08/03/2011 - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 10\LiveTunerProcessMonitor32.sys (LiveTunerPM) .(...) - LEGACY_LIVETUNERPM
O64 - Services: CurCS - 25/09/2012 - C:\Windows\System32\Drivers\secdrv.sys (secdrv)  .(.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) - LEGACY_SECDRV
~ Legacy: 135 Legitimates Filtered in 00mn 26s



---\\ Associações Shell Spawning (O67)
O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.PSafe - PSafeWeb.) -- C:\Users\Windows 7\AppData\Local\360Chrome\Chrome\Application\psafeweb.exe
~ FASS Keys: 11 Legitimates Filtered in 00mn 00s



---\\ Menu de inicialização Internet (068)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- C:\Program Files\Opera\Opera.exe (.not file.)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.PSafe - PSafeWeb.) -- C:\Users\Windows 7\AppData\Local\360Chrome\Chrome\Application\psafeweb.exe
~ Keys:  Scanned in 00mn 00s



---\\ Pesquisa de infeção nos navegadores da Internet (SBI) (069)
O69 - SBI: SearchScopes [HKCU] 47BBAD6203D54DA685657CCFF51E1757 - (Search) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>PUP.Ividi
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {3C465EA5-AE62-4CED-A8EF-BD961AA5268E} - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {5D2349CA-EC83-4BA0-8C86-B7215B7E7533} [DefaultScope] - (Bing) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {831985CC-9FED-4F43-AC36-DAF716ADAB2C} - (([Tens de ter uma conta e sessão iniciada para poderes visualizar este link] Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {A4B69E96-AA20-48EA-BB0A-981895F70403} - (Globo Vídeos) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Keys:  Scanned in 00mn 00s



---\\ Pesquisa adicional à raiz do sistema (radicular) (SPRF) (O84)
[MD5.882D937A019C4C19CB37543061707EF4] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.1412.bin   [1451]
[MD5.64D6AABFF194A69675A2B4CD801790FA] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.1984.bin   [3744]
[MD5.30CD45A9B8E1E4F9E108763C16B293CE] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.2152.bin   [2247]
[MD5.7F9A4D8F4AA0110E035ADA15A390DC73] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.2300.bin   [16864]
[MD5.F882A844C2990C8F696EBC12DB0C2E9D] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.2308.bin   [1090]
[MD5.1331EE1DC1DD1D68F7C802F12B8BB20B] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.2368.bin   [1090]
[MD5.CE68388606D3A980012FD4CEACE5A9DE] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.2880.bin   [81518]
[MD5.5BA674112F3C8A7A39AC7B8617B26667] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.3084.bin   [260317]
[MD5.70F66D222AA9D7027B282FD5C58D2F28] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.3596.bin   [10647]
[MD5.EF12E14DD3C457DCC17C27711575C5AC] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.3904.bin   [17072]
[MD5.6A7CA910ED42136ABD8662B0F24831DD] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.692.bin   [9970]
[MD5.722564B31BCFFC30EA3C602BA83A38AF] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.784.bin   [138114]
[MD5.F4AF348A49E5579CC975A6E273895D58] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.852.bin   [144024]
[MD5.600A8F6AFA0EB1DD37DF829C146EFB5D] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395883245.bdinstall.bin   [2081562]
[MD5.199051D6FD22490842BC1D99626CF0C7] [SPRF][03/05/2014] (...) -- C:\Users\Windows 7\AppData\Roaming\unins000.dat   [76312]
[MD5.41173EDCF7D1C6730A241A1963AFE55A] [SPRF][05/01/2010] (.RaProducts.org - System Purification Tool.) -- C:\Users\Windows 7\Desktop\PureRa.exe   [73901]
[MD5.2ED2319F3DE13495AAA49B70A1467055] [SPRF][30/04/2014] (...) -- C:\Users\Windows 7\Desktop\zoek.exe   [1285120]
[MD5.288D91AF7EEDE5BB86BFFF8C0D22ACF8] [SPRF][26/03/2014] (...) -- C:\Program Files\bitdefender-tsecurity.exe   [5708544]
~ Files: 20 Legitimates Filtered in 00mn 00s



---\\ Search Tracing Registry Key (O100)
HKLM\SOFTWARE\Microsoft\Tracing\GoogleToolbarInstaller_en32_signed_RASAPI32  =>Toolbar.Google
HKLM\SOFTWARE\Microsoft\Tracing\GoogleToolbarInstaller_en32_signed_RASMANCS  =>Toolbar.Google
HKLM\SOFTWARE\Microsoft\Tracing\GoogleToolbarInstaller_updater_signed_RASAPI32  =>Toolbar.Google
HKLM\SOFTWARE\Microsoft\Tracing\GoogleToolbarInstaller_updater_signed_RASMANCS  =>Toolbar.Google
HKLM\SOFTWARE\Microsoft\Tracing\GoogleToolbarManager_B6E98F0202354167_RASAPI32  =>Toolbar.Google
HKLM\SOFTWARE\Microsoft\Tracing\GoogleToolbarManager_B6E98F0202354167_RASMANCS  =>Toolbar.Google
HKLM\SOFTWARE\Microsoft\Tracing\GoogleToolbarNotifier_RASAPI32  =>Toolbar.Google
HKLM\SOFTWARE\Microsoft\Tracing\GoogleToolbarNotifier_RASMANCS  =>Toolbar.Google
~ BTK: 418 Legitimates Filtered in 00mn 00s



---\\ Search CLSID Registry Key (O101)
[HKCR\CLSID\{0A93904A-BB1E-4a0c-9753-B57B9AE272CB}] (baidu right click handler)  =>Adware.BDSearch
~ BCK: 7737 Legitimates Filtered in 00mn 19s



---\\ Estado general dos serviços não Microsoft (EGS) (SR=Executados, SS=Parados)
SS - | Disabled 10/07/1658 0 |  (ACDaemon) . (...) - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
SS - | Demand 14/05/2014 257712 |  (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Disabled 08/04/2014 69880 |  (BdDesktopParental) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender\bdparentalservice.exe
SS - | Auto 20/08/2011 136176 |  (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 20/08/2011 136176 |  (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 11/03/2014 136120 |  (gusvc) . (.Google.) - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Demand 25/09/2012 69632 |  (IDriverT) . (.Macrovision Corporation.) - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
SS - | Demand 13/04/2007 792112 |  (NBService) . (.Nero AG.) - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
SS - | Demand 01/06/2007 271920 |  (NMIndexingService) . (.Nero AG.) - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
SS - | Demand 17/04/2014 1716264 |  (PDF Architect 2) . (.pdfforge GmbH.) - C:\Program Files\PDF Architect 2\ws.exe
SS - | Demand 17/04/2014 861736 |  (pdfforge CrashHandler) . (.pdfforge GmbH.) - C:\Program Files\PDF Architect 2\crash-handler-ws.exe
SS - | Auto 08/07/2013 81704 |  (SafeBox) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe
SS - | Auto 23/10/2013 172192 |  (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe
SS - | Demand 13/07/2009 20992 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SS - | Demand 10/04/2013 885096 |  (WO_LiveService) . (...) - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 10\LiveTunerService.exe
SR - | Auto 21/12/2013 65432 |  (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 10/02/2014 3043520 |  (COSService.exe) . (.COMODO Security Solutions.) - C:\Program Files\COMODO\COMMON\COSService.exe
SR - | Auto 24/08/2009 406016 |  (DfSdkS) . (.mst software GmbH, Germany.) - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 11\DfsdkS.exe
SR - | Auto 21/02/2014 519720 |  (GbpSv) . (.GAS Tecnologia.) - C:\Program Files\GbPlugin\gbpsv.exe
SR - | Auto 10/02/2014 2783936 |  (SynchronizationService.exe) . (.COMODO Security Solutions.) - C:\Program Files\COMODO\COMMON\SynchronizationService.exe
SR - | Auto 25/04/2014 5024576 |  (TeamViewer9) . (.TeamViewer GmbH.) - C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
SR - | Auto 08/04/2014 54424 |  (UPDATESRV) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender\updatesrv.exe
SR - | Auto 08/04/2014 1248712 |  (vsserv) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender\vsserv.exe
SR - | Auto 06/05/2014 223624 |  (WO_LiveService2) . (...) - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 11\LiveTunerService.exe
SR - | Auto 13/07/2009 20992 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services:  Scanned in 00mn 39s



---\\ Scâner Aditional (088)
Database Version : 13045 - (15/05/2014)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 0
Dossiers trouvés  (Folders found) : 1
Fichiers trouvés  (Files found) : 1

C:\Users\Windows 7\AppData\Roaming\Baidu Security   =>Adware.BDSearch^
[HKCR\CLSID\{0A93904A-BB1E-4a0c-9753-B57B9AE272CB}] (baidu right click handler)   =>Adware.BDSearch^
~ Additionnel Scan: 248075 Items scanned in 00mn 42s



---\\ Sumário das deteções encontradas na sua estação
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>Adware.BDSearch
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>PUP.Ividi
~ MSI: 2 link(s) detected in 00mn 00s



~ 962 Legitimates filtered by white list
End of the scan (526 lines in 03mn 56s)(0)

 Acesse o site [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] e envie estes arquivos destacados em azul abaixo para serem analisados (um de cada vez):
C:\Windows\Tasks\CBU.exe_TEST_TASK.job
C:\Windows\System32\Tasks\CBU.exe_TEST_TASK

Assim que a análise de cada um deles for concluída, copie o link que aparecerá na barra de endereços de seu navegador e poste estes links em sua próxima resposta juntamente com o relatório do ZHPFix pedido nesta postagem.

Maiores informações de como analisar arquivos no site Virus Total você encontra neste tutorial:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
____________________________________________________________________________________________________________

 Selecione e copie todo o texto destacado em vermelho que te passei.
_____________________________________________________________________________________________________________

 Vá no menu: Iniciar > Todos os programas > ZHP > Clique com o botão direito do mouse sobre o Zhpfix e escolha a opção de Executar como administrador > Clique em Importação > Clique no botão GO > Clique em Oui > Caso queira que os arquivos da lixeira sejam excluídos clique em Oui novamente > Um relatório aparecerá no bloco de notas.

Copie este relatório e poste em sua próxima resposta juntamente com os links das análises dos arquivos no site Virus Total.

Boa noite,
não sei se estou fazendo a coisa certa, segue o relatório exibido:

Rapport de ZHPFix 2014.4.13.3 par Nicolas Coolman, Update du 13/04/2014
Fichier d'export Registre :
Run by Windows 7 at 15/05/2014 20:58:14
High Elevated Privileges : OK
Windows 7 Ultimate Edition, 32-bit Service Pack 1 (Build 7601)

Reciclagem vazia (00mn 05s)
Reparação de atalhos do navegador

========== Chaves do Registo ==========
ELIMINÉ: SearchScopes :47BBAD6203D54DA685657CCFF51E1757
ELIMINÉ: HKCR\CLSID\{0A93904A-BB1E-4a0c-9753-B57B9AE272CB}

========== Valores do Registo ==========
ProxyFix : Configuração proxy removida com sucesso
ELIMINÉ ProxyServer Value
ELIMINÉ ProxyEnable Value
ELIMINÉ EnableHttp1_1 Value
ELIMINÉ ProxyHttp1.1 Value
ELIMINÉ ProxyOverride Value

========== Pastas ==========
Nenhuma pasta CLSID local utilizador vazia

========== Ficheiros ==========
ELIMINÉ: c:\users\windows 7\appdata\local\360chrome\chrome\application\psafeweb.exe
ELIMINÉ Temporários windows (131) (1.949.279 octets)
ELIMINÉ Flash Cookies (0) (0 octets)

========== Restauração Sistema ==========
Ponto de restauro do sistema criado com sucesso


========== Recapitulativo ==========
2 : Chaves do Registo
6 : Valores do Registo
1 : Pastas
3 : Ficheiros
1 : Restauração Sistema


End of clean in 00mn 54s

========== Caminho do ficheiro do relatório ==========
C:\Users\Windows 7\AppData\Roaming\ZHP\ZHPFix[R1].txt - 12/05/2014 22:21:23 [1310]
C:\Users\Windows 7\AppData\Roaming\ZHP\ZHPFix[R2].txt - 15/05/2014 20:58:19 [1396]

 Abra novamente o ( ZHPDiag )

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Clique "SEARCH" ou "PESQUISAR" e aguarde a conclusão.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Clique OK e, ao concluir, poste o relatório ZHPDiag.txt

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

Relatório de ZPH:

Rapport de ZHPFix 2014.4.13.3 par Nicolas Coolman, Update du 13/04/2014
Fichier d'export Registre :
Run by Windows 7 at 15/05/2014 23:41:37
High Elevated Privileges : OK
Windows 7 Ultimate Edition, 32-bit Service Pack 1 (Build 7601)

Reciclagem vazia (00mn 04s)
Reparação de atalhos do navegador

========== Valores do Registo ==========
ProxyFix : Configuração proxy removida com sucesso
ELIMINÉ ProxyServer Value
ELIMINÉ ProxyEnable Value
ELIMINÉ EnableHttp1_1 Value
ELIMINÉ ProxyHttp1.1 Value
ELIMINÉ ProxyOverride Value

========== Pastas ==========
Nenhuma pasta CLSID local utilizador vazia

========== Ficheiros ==========
ELIMINÉ Temporários windows (11) (2.464.203 octets)
ELIMINÉ Flash Cookies (0) (0 octets)

========== Restauração Sistema ==========
Ponto de restauro do sistema criado com sucesso


========== Recapitulativo ==========
6 : Valores do Registo
1 : Pastas
2 : Ficheiros
1 : Restauração Sistema


End of clean in 00mn 40s

========== Caminho do ficheiro do relatório ==========
C:\Users\Windows 7\AppData\Roaming\ZHP\ZHPFix[R1].txt - 12/05/2014 22:21:23 [1310]
C:\Users\Windows 7\AppData\Roaming\ZHP\ZHPFix[R2].txt - 15/05/2014 20:58:19 [1480]
C:\Users\Windows 7\AppData\Roaming\ZHP\ZHPFix[R3].txt - 15/05/2014 23:41:41 [1211]



Link 1 - da análise do Virus Total:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

O outro arquivo (CBU.exe_TEST_TASK) não está aparecendo na pasta!

  Quanto ao link do Virus Total está certo.
________________________________________________

Mas quanto ao relatório do ZHP, você postou diferente do que pedi. O que preciso é que faça isto por gentileza:

 Abra novamente o ( ZHPDiag )

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Clique "SEARCH" ou "PESQUISAR" e aguarde a conclusão.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Clique OK e, ao concluir, poste o relatório ZHPDiag.txt

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

SEGUE ENTÃO NOVO LOG, CONF. SOLICITADO, OBRIGADO!
05.16.201412:54:29

~ Relatório do ZHPDiag v2014.5.16.65 - Nicolas Coolman (16/05/2014)
~ Iniciado por Windows 7 (16/05/2014 12:44:44)
~ Endereço do Website : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Blog de análise de software : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Fóruns de suporte gratuito para desinfecção : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Tradução pelo utilizador
~ Estatuto da versão :
~ Lista Branca : Ativado pelo programa
~ Elevação dos Privilégios : OK
~ Controle de Conta de Utilizador : Activate by user


---\\ Navegadores Internet
MSIE: Internet Explorer v11.0.9600.17041
GCIE: Google Chrome v34.0.1847.137

---\\ Informações sobre os produtos Windows
~ Langage: Portugais
Windows 7 Ultimate, 32-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK

---\\ Softwares de proteçao do sistema
Malwarebytes Anti-Malware versão 2.0.1.1004
Windows Defender W7

---\\ Softwares d'optimização do sistema

---\\ Softwares de partilha do PeerToPeer (P2P)

---\\ Monitoramento dos softwares
Adobe Flash Player 13 Plugin
Adobe Reader XI

---\\ Informações sobre o sistema
~ Processor: x86 Family 6 Model 15 Stepping 13, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3063 MB (61% free)
System Restore: Activé (Enable)
System drive C: has 56 GB (37%) free of 149 GB

---\\ Modo de conexão ao sistema
~ Computer Name: WINDOWS7-PC
~ User Name: Windows 7
~ All Users Names: Windows 7, HomeGroupUser$, Convidado, Administrador,
~ Unselected Option: 045,061,O62,065,066,080,O82,089
Logged in as Administrator

---\\ As variáveis de ambiente
~ System Unit : C:\
~ %AppZHP% : C:\Users\Windows 7\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Windows 7\AppData\Roaming\
~ %Desktop% : C:\Users\Windows 7\Desktop\
~ %Favorites% : C:\Users\Windows 7\Favorites\
~ %LocalAppData% : C:\Users\Windows 7\AppData\Local\
~ %StartMenu% : C:\Users\Windows 7\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumeração das unidades dos discos
A: Floppy drive, Flash card reader, USB Key (Not Inserted)
C: Hard drive, Flash drive, Thumb drive (Free 56 Go of 149 Go)
D: CD-ROM drive (Not Inserted)
E: Hard drive, Flash drive, Thumb drive (Free 402 Go of 466 Go)



---\\ Estado do Centro de Segurança do Windows
~ Security Center: 49 Legitimates Filtered in 00mn 00s



---\\ Pesquisa particular de ficheiros genéricos
[MD5.8B88EBBB05A0E56B7DCC708498C02B3E] - (.Microsoft Corporation - Windows Explorer.) (.25/02/2011 - 02:30:54.) -- C:\Windows\Explorer.exe [2616320]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Aplicativo de Inicialização do Windows.) (.13/07/2009 - 22:14:45.) -- C:\Windows\System32\Wininit.exe [96256]
[MD5.E4E829EE073E046B0EB19B5FECB19B8C] - (.Microsoft Corporation - Internet Extensions para Win32.) (.06/03/2014 - 02:41:49.) -- C:\Windows\System32\wininet.dll [1789440]
[MD5.6D13E1406F50C66E2A95D97F22C47560] - (.Microsoft Corporation - Aplicativo de Logon do Windows.) (.20/11/2010 - 09:17:54.) -- C:\Windows\System32\Winlogon.exe [286720]
[MD5.E3AE23569749DE12D45BA3B489A036AE] - (.Microsoft Corporation - Biblioteca de Licenciamento de Software.) (.20/11/2010 - 09:21:24.) -- C:\Windows\System32\sppcomapi.dll [193536]
[MD5.F81BB7E487EDCEAB630A7EE66CF23913] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.15/11/2013 - 09:49:13.) -- C:\Windows\system32\Drivers\AFD.sys [338944]
[MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.13/07/2009 - 22:26:15.) -- C:\Windows\system32\Drivers\atapi.sys [21584]
[MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 20:11:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656]
[MD5.BE167ED0FDB9C1FA1133953C18D5A6C9] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 05:38:10.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544]
[MD5.F024449C97EC1E464AAFFDA18593DB88] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 05:42:32.) -- C:\Windows\system32\Drivers\DfsC.sys [78336]
[MD5.9036377B8A6C15DC2EEC53E489D159B5] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 06:59:29.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544]
[MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - Driver de porta i8042.) (.13/07/2009 - 20:11:24.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896]
[MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.13/07/2009 - 20:54:29.) -- C:\Windows\system32\Drivers\IpNat.sys [101888]
[MD5.5D16C921E3671636C0EBA3BBAAC5FD25] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.26/04/2011 - 23:17:22.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123904]
[MD5.280122DDCF04B378EDD1AD54D71C1E54] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 05:39:44.) -- C:\Windows\system32\Drivers\netBT.sys [187904]
[MD5.C8DFF8D07755A66C7A4A738930F0FEAC] - (.Microsoft Corporation - Driver do Sistema de Arquivos NT.) (.23/01/2014 - 23:18:22.) -- C:\Windows\system32\Drivers\ntfs.sys [1212352]
[MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - Driver de porta paralela.) (.13/07/2009 - 20:45:35.) -- C:\Windows\system32\Drivers\Parport.sys [79360]
[MD5.D9F91EAFEC2815365CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13/07/2009 - 20:54:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848]
[MD5.B973FCFC50DC1434E1970A146F7E3885] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.20/11/2010 - 07:24:46.) -- C:\Windows\system32\Drivers\rdpdr.sys [133632]
[MD5.3E21C083B8A01CB70BA1F09303010FCE] - (.Microsoft Corporation - SMB Transport driver.) (.13/07/2009 - 20:53:41.) -- C:\Windows\system32\Drivers\smb.sys [71168]
[MD5.B459575348C20E8121D6039DA063C704] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 05:39:17.) -- C:\Windows\system32\Drivers\tdx.sys [74752]
[MD5.F497F67932C6FA693D7DE2780631CFE7] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.20/11/2010 - 09:30:16.) -- C:\Windows\system32\Drivers\volsnap.sys [245632]
~ Generic Processes: Scanned in 00mn 00s



---\\ Estatuto dos ficheiros ocultos (Oculto/Total)
~ Mes images (My Pictures) : 2/15368
~ Mes musiques (My Musics) : 13/3729
~ Mes Videos (My Videos) : 2/337
~ Mes Favoris (My Favorites) : 1/371
~ Mes Documents (My Documents) : 3/602
~ Mon Bureau (My Desktop) : 2/398
~ Menu demarrer (Programs) : 1/6
~ Hidden Files: Scanned in 00mn 15s



---\\ Processos lançados
[MD5.68239842340DDFF8993DFD9127553EDA] - (.Intel Corporation - igfxTray Module.) -- C:\Windows\System32\igfxtray.exe [141848] [PID.3200]
[MD5.004763BDF8E48244DBB9FDFDE3065EBC] - (.Intel Corporation - hkcmd Module.) -- C:\Windows\System32\hkcmd.exe [173592] [PID.3228]
[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336] [PID.3508]
[MD5.1766A2E004154830D4327861AF1BD3AB] - (.Bitdefender - Bitdefender Agent.) -- C:\Program Files\Bitdefender\Bitdefender\bdagent.exe [1845064] [PID.3524]
[MD5.C92D440021D08216409E04399F9C0D95] - (.Ashampoo Development GmbH & Co. KG - Ashampoo Live-Tuner Client.) -- C:\Program Files\Ashampoo\Ashampoo WinOptimizer 11\LiveTuner2.exe [3516808] [PID.3876]
[MD5.B38B860BF3D89F17EB6FF6183DB97DC7] - (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe [482392] [PID.4016]
[MD5.597CF4BEDFDC81B8903982664CAC6ED0] - (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\bdapppassmgr.exe [614232] [PID.4032]
[MD5.62918A00DE565A7609893F0CD29A4045] - (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe [901096] [PID.2284]
[MD5.9F98821AE94E8CC78F7A5D423791B839] - (.TeamViewer GmbH - TeamViewer 9.) -- C:\Program Files\TeamViewer\Version9\TeamViewer.exe [12971328] [PID.4700]
[MD5.317235FAE521626B9EBED5F47A9ED75A] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7876096] [PID.5328]
~ Processes Running: Scanned in 00mn 00s



---\\ Google Chrome, Arranque,Pesquisa,Extensões (G0,G1,G2)
C:\Users\Windows 7\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [ahfgeienlihckogmohjhadlkjgocpleb] Loja v.0.2 (Activé)
G2 - GCE: Preference [User Data\Default] [ccahoghmggldkcdjiebjkidpfongdfbl] Bitdefender Wallet v.17.28.1 (Activé)
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)

---\\ Pasta de extensão do Google Chrome
~ Google Lines Browser: 18 Legitimates Filtered in 00mn 01s



---\\ Mozilla Firefox, Plugins,Arranque,Pesquisa,Extensões (P2,M0,M1,M2,M3)
P2 - FPN: [HKCU] [gastecnologia.com.br/sf/bb] - (.GAS Tecnologia - Internet Banking Helper.) -- C:\Users\Windows 7\AppData\Local\GAS Tecnologia\GBBD\npsf_bb.dll
~ Firefox Browser: 10 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Arranque, Pesquisa, URLSearchHook( gancho de URL), Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.GAS Tecnologia - Internet Banking Helper.) (No version) -- (.not file.)
~ IE Browser: 16 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Gestão do Proxy (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyHttp1.1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
R5 - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
~ Proxy management: Scanned in 00mn 00s



---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s



---\\ Redireção do ficheiro Hosts (01)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21



---\\ Browser Helper Objects do navegador (02)
O2 - BHO: (no name) - AutorunsDisabled Chave orfã
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} . (.Banco do Brasil - Gbieh Module.) -- C:\PROGRAM FILES\GBPLUGIN\gbieh.dll
~ BHO: 16 Legitimates Filtered in 00mn 00s



---\\ Aplicações iniciadas por registo & pastas (04)
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKLM\..\Run: [Bdagent] . (.Bitdefender - Bitdefender Agent.) -- C:\Program Files\Bitdefender\Bitdefender\bdagent.exe
O4 - HKLM\..\Run: [Ashampoo WinOptimizer Live-Tuner2] . (.Ashampoo Development GmbH & Co. KG - Ashampoo Live-Tuner Client.) -- C:\Program Files\Ashampoo\Ashampoo WinOptimizer 11\LiveTuner2.exe
O4 - HKCU\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKCU\..\Run: [Agente da Carteira Bitdefender] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe
O4 - HKCU\..\Run: [Agente de Aplicativo de Carteira Bitdefender] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\bdapppassmgr.exe
O4 - HKCU\..\Run: [Carteira Bitdefender] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe
O4 - HKUS\.DEFAULT\..\Run: [Agente da Carteira Bitdefender] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe
O4 - HKUS\.DEFAULT\..\Run: [Carteira Bitdefender] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe
O4 - HKUS\.DEFAULT\..\Run: [Agente de Aplicativo de Carteira Bitdefender] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\bdapppassmgr.exe
O4 - HKUS\S-1-5-18\..\Run: [Agente da Carteira Bitdefender] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe
O4 - HKUS\S-1-5-18\..\Run: [Carteira Bitdefender] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe
O4 - HKUS\S-1-5-18\..\Run: [Agente de Aplicativo de Carteira Bitdefender] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\bdapppassmgr.exe
O4 - HKUS\.DEFAULT\..\RunOnce: [SPReview] . (.Microsoft Corporation - SP Reviewer.) -- C:\Windows\System32\SPReview\SPReview.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-18\..\RunOnce: [SPReview] . (.Microsoft Corporation - SP Reviewer.) -- C:\Windows\System32\SPReview\SPReview.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-1345213309-4198415469-3032410945-1000\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files\Windows Sidebar\sidebar.exe
O4 - HKUS\S-1-5-21-1345213309-4198415469-3032410945-1000\..\Run: [Agente da Carteira Bitdefender] . (.Bitdefender - Bitdefender Password Manager Agent.) -- C:\Program Files\Bitdefender\Bitdefender\pmbxag.exe
O4 - HKUS\S-1-5-21-1345213309-4198415469-3032410945-1000\..\Run: [Agente de Aplicativo de Carteira Bitdefender] . (.Bitdefender - Bitdefender Application Password Manager Ag.) -- C:\Program Files\Bitdefender\Bitdefender\bdapppassmgr.exe
O4 - HKUS\S-1-5-21-1345213309-4198415469-3032410945-1000\..\Run: [Carteira Bitdefender] . (.Bitdefender - Bitdefender Password Manager.) -- C:\Program Files\Bitdefender\Bitdefender\pwdmanui.exe
~ Application: Scanned in 00mn 00s



---\\ Boutões da barra de ferramentas principal do Internet Explorer (09)
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} . (.Microsoft Corporation - Windows Live Writer Blog This Extension.) -- C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft Office OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- C:\Program Files\Skype\Toolbars\Internet Explorer\icon.ico
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Site na zona confiavél do Internet Explorer (05)
O15 - Trusted Zone: [HKCU\...\Domains\www] *.bancobrasil.com.br
O15 - Trusted Zone: [HKCU\...\Domains\www] *.bb.com.br
~ IE Zone Confiance: Scanned in 00mn 00s



---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} ((no name)) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O16 - DPF: {7ECB1A47-6647-4B2C-A8DA-675569C9FF15} ((no name)) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Objets ActiveX: Scanned in 00mn 00s



---\\ Alteração Dominio/Clientes DNS (017)
O17 - HKLM\System\CCS\Services\Tcpip\..\{7945DE37-1C7F-4B5C-AD77-9A1557BAC881}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{79850B7C-E72A-4EC3-BD8E-F78AAD1C339A}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\..\{7945DE37-1C7F-4B5C-AD77-9A1557BAC881}: DhcpDomain = lan
O17 - HKLM\System\CS1\Services\Tcpip\..\{7945DE37-1C7F-4B5C-AD77-9A1557BAC881}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{79850B7C-E72A-4EC3-BD8E-F78AAD1C339A}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CS1\Services\Tcpip\..\{7945DE37-1C7F-4B5C-AD77-9A1557BAC881}: DhcpDomain = lan
O17 - HKLM\System\CS2\Services\Tcpip\..\{7945DE37-1C7F-4B5C-AD77-9A1557BAC881}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{79850B7C-E72A-4EC3-BD8E-F78AAD1C339A}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CS2\Services\Tcpip\..\{7945DE37-1C7F-4B5C-AD77-9A1557BAC881}: DhcpDomain = lan
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
~ Domain: Scanned in 00mn 00s



---\\ Protocolo adicional (018)
O18 - Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (.Microsoft Corporation - Photo Gallery Album Download Protocol Handl.) -- C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll =>.Microsoft Corporation
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: GbPluginBb . (.Banco do Brasil - Gbieh Module.) -- C:\PROGRAM FILES\GBPLUGIN\gbieh.dll
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s



---\\ Lista dos serviços NT não Microsoft e não desativados (023)
O23 - Service: Gbp Service (GbpSv) . (.GAS Tecnologia - G-Buster Browser Defense - Service.) - C:\Program Files\GbPlugin\gbpsv.exe
O23 - Service: Ashampoo LiveTuner 2 Service (WO_LiveService2) . (...) - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 11\LiveTunerService.exe
~ Services: 12 Legitimates Filtered in 00mn 06s



---\\ Tarefas planificadas automaticamente (039)
[MD5.DA0D875CCA5C767D4BD8EE3D50845BF5] [APT] [One-Click Optimizer WO11] (.Ashampoo Development GmbH & Co. KG.) -- C:\Program Files\Ashampoo\Ashampoo WinOptimizer 11\WO11.exe [8557448]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater [902]
O39 - APT: - (..) -- C:\Windows\Tasks\CBU.exe_TEST_TASK.job [286]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\CBU.exe_TEST_TASK [286]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1ce7fe723970eac [1054]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA1ce777c51b15b8f [1058]
O39 - APT: One-Click Optimizer WO11 - (.Ashampoo Development GmbH & Co. KG.) -- C:\Windows\Tasks\One-Click Optimizer WO11.job [394]
O39 - APT: One-Click Optimizer WO11 - (.Ashampoo Development GmbH & Co. KG.) -- C:\Windows\System32\Tasks\One-Click Optimizer WO11 [394]
~ Scheduled Task: 12 Legitimates Filtered in 00mn 03s



---\\ Drivers lançados ao arranque do sistema (041)
O41 - Driver: (Ndisrd) . (.GAS Tecnologia - GAS Tecnologia - LWF Helper Driver.) - C:\Windows\System32\DRIVERS\gbpndisrdn.sys
O41 - Driver: (UimBus) . (...) - C:\Windows\System32\DRIVERS\UimBus.sys
O41 - Driver: (Uim_DEVIM) . (...) - C:\Windows\System32\DRIVERS\uim_devim.sys
O41 - Driver: (Uim_IM) . (...) - C:\Windows\System32\DRIVERS\uim_im.sys
~ Drivers: 90 Legitimates Filtered in 00mn 00s



---\\ Software instalados (042)
O42 - Logiciel: Módulo de Segurança - Banco do Brasil - (...) [HKLM] -- {36386dc9-8543-4b12-ae6b-220fd52f19f3}_is1
~ Logic: 1 Legitimates Filtered in 00mn 00s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\GbAs]
[HKCU\Software\MicApp]
[HKCU\Software\WandouLabs]
[HKLM\Software\AutoHelpDesk]
[HKLM\Software\MaxPower]
~ Key Software: 147 Legitimates Filtered in 00mn 00s



---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 23/08/2012 - 21:49:44 - [] ----D C:\Program Files\Curriculum 3.0
O43 - CFD: 24/09/2013 - 00:42:07 - [] ----D C:\Users\Windows 7\AppData\Roaming\WandoujiaUsbDriver
O43 - CFD: 22/04/2014 - 00:08:45 - [] ----D C:\Users\Windows 7\AppData\Local\com
~ Program Folder: 176 Legitimates Filtered in 00mn 00s



---\\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044)
O44 - LFC:[MD5.8C62772B554E27C796B3E84B44393337] - 01/05/2014 - 13:18:14 ---A- . (...) -- C:\zoek-results2014-05-01-161814.log [25102]
O44 - LFC:[MD5.A51584ADD1859EF184B683D3DE6742C5] - 13/05/2014 - 11:41:50 ---A- . (...) -- C:\Windows\System32\prfc0416.dat [163098]
O44 - LFC:[MD5.6810922B88A84EE2048C3962ADDB0C4E] - 13/05/2014 - 11:41:50 ---A- . (...) -- C:\Windows\System32\prfh0416.dat [756196]
O44 - LFC:[MD5.CC7AA7B42CF418FC3D926913490048F8] - 14/05/2014 - 23:17:30 ---A- . (...) -- C:\Windows\zoek-delete.exe [24064]
O44 - LFC:[MD5.211AC93890E037DE9B9A7C88626C4710] - 14/05/2014 - 23:41:30 ---A- . (...) -- C:\zoek-results.log [21848]
O44 - LFC:[MD5.D0EC8F7600F127B78C6ED1AFAFB10DF0] - 15/05/2014 - 23:58:42 ---A- . (...) -- C:\bdlog.txt [120649]
~ Files: 160 Legitimates Filtered in 00mn 05s



---\\ Operações e funções ao arranque do Windows Explorer (046)
O46 - SEH:ShellExecuteHooks - GbPlugin ShlObj - {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\PROGRAM FILES\GBPLUGIN\gbieh.dll
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
~ ShellExecuteHooks: Scanned in 00mn 00s



---\\ Enumeração das chaves do registo PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorUser"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
O55 - MWPS:[HKLM\...\Policies\System] - "DisableCAD"=1
O55 - MWPS:[HKLM\...\Policies\System] - "VerboseStatus"=0
O55 - MWPS:[HKLM\...\Policies\System] - "NoDispCPL"=0
~ MWPS: 26 Legitimates Filtered in 00mn 00s



---\\ Enumeração das chaves do registo PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoLowDiskSpaceChecks"=1
O56 - MWPE:[HKLM\...\policies\Explorer] - "MemCheckBoxInRunDlg"=1
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoResolveTrack"=0
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoClose"=0
~ MWPE Keys: 17 Legitimates Filtered in 00mn 00s



---\\ Lista dos drivers do sistema (SDL) (O58)
O58 - SDL:13/07/2009 - 22:20:28 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [453712]
O58 - SDL:08/05/2013 - 09:52:48 ---A- . (.GAS Tecnologia - GbPlugin Device Driver.) -- C:\Windows\System32\Drivers\GbpKm.sys [49536]
O58 - SDL:06/03/2014 - 18:09:42 ---A- . (.GAS Tecnologia - GAS Tecnologia - LWF Helper Driver.) -- C:\Windows\System32\Drivers\gbpndisrdn.sys [29400]
O58 - SDL:13/07/2009 - 19:54:14 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [26624]
O58 - SDL:04/11/2013 - 20:32:43 ---A- . (.Sysinternals - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] - Process Explorer.) -- C:\Windows\System32\Drivers\PROCEXP113.SYS [12568]
O58 - SDL:13/07/2009 - 22:19:04 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [21072]
O58 - SDL:26/03/2014 - 12:46:02 ---A- . (...) -- C:\Windows\System32\Drivers\SWDUMon.sys [13464]
O58 - SDL:16/12/2013 - 18:29:06 ---A- . (...) -- C:\Windows\System32\Drivers\UimBus.sys [91016]
O58 - SDL:16/12/2013 - 18:29:06 ---A- . (...) -- C:\Windows\System32\Drivers\UimFIO.sys [426248]
O58 - SDL:16/12/2013 - 18:29:06 ---A- . (...) -- C:\Windows\System32\Drivers\uim_devim.sys [20616]
O58 - SDL:16/12/2013 - 18:29:06 ---A- . (...) -- C:\Windows\System32\Drivers\uim_im.sys [540168]
O58 - SDL:13/07/2009 - 18:40:41 ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029]
O58 - SDL:13/07/2009 - 18:40:44 ---A- . (...) -- C:\Windows\System32\country.sys [27097]
O58 - SDL:13/07/2009 - 18:40:40 ---A- . (...) -- C:\Windows\System32\HIMEM.SYS [4768]
O58 - SDL:13/07/2009 - 18:40:43 ---A- . (...) -- C:\Windows\System32\KEY01.SYS [42809]
O58 - SDL:13/07/2009 - 18:40:43 ---A- . (...) -- C:\Windows\System32\KEYBOARD.SYS [42537]
O58 - SDL:13/07/2009 - 18:40:23 ---A- . (...) -- C:\Windows\System32\NTDOS.SYS [27866]
O58 - SDL:13/07/2009 - 18:40:31 ---A- . (...) -- C:\Windows\System32\NTDOS404.SYS [29146]
O58 - SDL:13/07/2009 - 18:40:35 ---A- . (...) -- C:\Windows\System32\NTDOS411.SYS [29370]
O58 - SDL:13/07/2009 - 18:40:39 ---A- . (...) -- C:\Windows\System32\NTDOS412.SYS [29274]
O58 - SDL:13/07/2009 - 18:40:27 ---A- . (...) -- C:\Windows\System32\NTDOS804.SYS [29146]
O58 - SDL:13/07/2009 - 18:40:11 ---A- . (...) -- C:\Windows\System32\NTIO.SYS [33952]
O58 - SDL:13/07/2009 - 18:40:15 ---A- . (...) -- C:\Windows\System32\NTIO404.SYS [34672]
O58 - SDL:13/07/2009 - 18:40:17 ---A- . (...) -- C:\Windows\System32\NTIO411.SYS [35776]
O58 - SDL:13/07/2009 - 18:40:19 ---A- . (...) -- C:\Windows\System32\NTIO412.SYS [35536]
O58 - SDL:13/07/2009 - 18:40:13 ---A- . (...) -- C:\Windows\System32\NTIO804.SYS [34672]
~ Drivers: 93 Legitimates Filtered in 00mn 40s



---\\ Lista das ferramentas de remoção de vírus (LAT) (063)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Lista dos serviços Legacy du registo (064)
O64 - Services: CurCS - 17/04/2012 - C:\Windows\System32\DRIVERS\bdvedisk.sys (BDVEDISK) .(.BitDefender - FileVault Disk Driver.) - LEGACY_BDVEDISK
O64 - Services: CurCS - 08/05/2013 - C:\Windows\System32\drivers\gbpkm.sys (GbpKm) .(.GAS Tecnologia - GbPlugin Device Driver.) - LEGACY_GBPKM
O64 - Services: CurCS - 20/03/2014 - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 11\LiveTuner32.sys (LiveTuner2PM) .(...) - LEGACY_LIVETUNER2PM
O64 - Services: CurCS - 08/03/2011 - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 10\LiveTunerProcessMonitor32.sys (LiveTunerPM) .(...) - LEGACY_LIVETUNERPM
O64 - Services: CurCS - 25/09/2012 - C:\Windows\System32\Drivers\secdrv.sys (secdrv) .(.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) - LEGACY_SECDRV
~ Legacy: 135 Legitimates Filtered in 00mn 21s



---\\ Menu de inicialização Internet (068)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- C:\Program Files\Opera\Opera.exe (.not file.)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (...) -- C:\Users\Windows 7\AppData\Local\360Chrome\Chrome\Application\psafeweb.exe (.not file.)
~ Keys: Scanned in 00mn 00s



---\\ Pesquisa de infeção nos navegadores da Internet (SBI) (069)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {3C465EA5-AE62-4CED-A8EF-BD961AA5268E} - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {5D2349CA-EC83-4BA0-8C86-B7215B7E7533} [DefaultScope] - (Bing) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {831985CC-9FED-4F43-AC36-DAF716ADAB2C} - (([Tens de ter uma conta e sessão iniciada para poderes visualizar este link] Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {A4B69E96-AA20-48EA-BB0A-981895F70403} - (Globo Vídeos) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Keys: Scanned in 00mn 00s



---\\ Pesquisa adicional à raiz do sistema (radicular) (SPRF) (O84)
[MD5.882D937A019C4C19CB37543061707EF4] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.1412.bin [1451]
[MD5.64D6AABFF194A69675A2B4CD801790FA] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.1984.bin [3744]
[MD5.30CD45A9B8E1E4F9E108763C16B293CE] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.2152.bin [2247]
[MD5.7F9A4D8F4AA0110E035ADA15A390DC73] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.2300.bin [16864]
[MD5.F882A844C2990C8F696EBC12DB0C2E9D] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.2308.bin [1090]
[MD5.1331EE1DC1DD1D68F7C802F12B8BB20B] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.2368.bin [1090]
[MD5.CE68388606D3A980012FD4CEACE5A9DE] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.2880.bin [81518]
[MD5.5BA674112F3C8A7A39AC7B8617B26667] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.3084.bin [260317]
[MD5.70F66D222AA9D7027B282FD5C58D2F28] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.3596.bin [10647]
[MD5.EF12E14DD3C457DCC17C27711575C5AC] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.3904.bin [17072]
[MD5.6A7CA910ED42136ABD8662B0F24831DD] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.692.bin [9970]
[MD5.722564B31BCFFC30EA3C602BA83A38AF] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.784.bin [138114]
[MD5.F4AF348A49E5579CC975A6E273895D58] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395881700.852.bin [144024]
[MD5.600A8F6AFA0EB1DD37DF829C146EFB5D] [SPRF][26/03/2014] (...) -- C:\ProgramData\1395883245.bdinstall.bin [2081562]
[MD5.199051D6FD22490842BC1D99626CF0C7] [SPRF][03/05/2014] (...) -- C:\Users\Windows 7\AppData\Roaming\unins000.dat [76312]
[MD5.41173EDCF7D1C6730A241A1963AFE55A] [SPRF][05/01/2010] (.RaProducts.org - System Purification Tool.) -- C:\Users\Windows 7\Desktop\PureRa.exe [73901]
[MD5.2ED2319F3DE13495AAA49B70A1467055] [SPRF][30/04/2014] (...) -- C:\Users\Windows 7\Desktop\zoek.exe [1285120]
[MD5.288D91AF7EEDE5BB86BFFF8C0D22ACF8] [SPRF][26/03/2014] (...) -- C:\Program Files\bitdefender-tsecurity.exe [5708544]
~ Files: 20 Legitimates Filtered in 00mn 00s



---\\ Search Tracing Registry Key (O100)
HKLM\SOFTWARE\Microsoft\Tracing\GoogleToolbarInstaller_en32_signed_RASAPI32 =>Toolbar.Google
HKLM\SOFTWARE\Microsoft\Tracing\GoogleToolbarInstaller_en32_signed_RASMANCS =>Toolbar.Google
HKLM\SOFTWARE\Microsoft\Tracing\GoogleToolbarInstaller_updater_signed_RASAPI32 =>Toolbar.Google
HKLM\SOFTWARE\Microsoft\Tracing\GoogleToolbarInstaller_updater_signed_RASMANCS =>Toolbar.Google
HKLM\SOFTWARE\Microsoft\Tracing\GoogleToolbarManager_B6E98F0202354167_RASAPI32 =>Toolbar.Google
HKLM\SOFTWARE\Microsoft\Tracing\GoogleToolbarManager_B6E98F0202354167_RASMANCS =>Toolbar.Google
HKLM\SOFTWARE\Microsoft\Tracing\GoogleToolbarNotifier_RASAPI32 =>Toolbar.Google
HKLM\SOFTWARE\Microsoft\Tracing\GoogleToolbarNotifier_RASMANCS =>Toolbar.Google
~ BTK: 418 Legitimates Filtered in 00mn 00s



---\\ Estado general dos serviços não Microsoft (EGS) (SR=Executados, SS=Parados)
SS - | Disabled 10/07/1658 0 | (ACDaemon) . (...) - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
SS - | Demand 14/05/2014 257712 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Disabled 08/04/2014 69880 | (BdDesktopParental) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender\bdparentalservice.exe
SS - | Auto 20/08/2011 136176 | (gupdate) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 20/08/2011 136176 | (gupdatem) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 11/03/2014 136120 | (gusvc) . (.Google.) - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
SS - | Demand 25/09/2012 69632 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
SS - | Demand 13/04/2007 792112 | (NBService) . (.Nero AG.) - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
SS - | Demand 01/06/2007 271920 | (NMIndexingService) . (.Nero AG.) - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
SS - | Demand 17/04/2014 1716264 | (PDF Architect 2) . (.pdfforge GmbH.) - C:\Program Files\PDF Architect 2\ws.exe
SS - | Demand 17/04/2014 861736 | (pdfforge CrashHandler) . (.pdfforge GmbH.) - C:\Program Files\PDF Architect 2\crash-handler-ws.exe
SS - | Auto 08/07/2013 81704 | (SafeBox) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender SafeBox\safeboxservice.exe
SS - | Auto 23/10/2013 172192 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe
SS - | Demand 13/07/2009 20992 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SS - | Demand 10/04/2013 885096 | (WO_LiveService) . (...) - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 10\LiveTunerService.exe
SR - | Auto 21/12/2013 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 10/02/2014 3043520 | (COSService.exe) . (.COMODO Security Solutions.) - C:\Program Files\COMODO\COMMON\COSService.exe
SR - | Auto 24/08/2009 406016 | (DfSdkS) . (.mst software GmbH, Germany.) - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 11\DfsdkS.exe
SR - | Auto 21/02/2014 519720 | (GbpSv) . (.GAS Tecnologia.) - C:\Program Files\GbPlugin\gbpsv.exe
SR - | Auto 10/02/2014 2783936 | (SynchronizationService.exe) . (.COMODO Security Solutions.) - C:\Program Files\COMODO\COMMON\SynchronizationService.exe
SR - | Auto 25/04/2014 5024576 | (TeamViewer9) . (.TeamViewer GmbH.) - C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
SR - | Auto 08/04/2014 54424 | (UPDATESRV) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender\updatesrv.exe
SR - | Auto 08/04/2014 1248712 | (vsserv) . (.Bitdefender.) - C:\Program Files\Bitdefender\Bitdefender\vsserv.exe
SR - | Auto 06/05/2014 223624 | (WO_LiveService2) . (...) - C:\Program Files\Ashampoo\Ashampoo WinOptimizer 11\LiveTunerService.exe
SR - | Auto 13/07/2009 20992 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 39s



---\\ Scâner Aditional (088)
Database Version : 13045 - (16/05/2014)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 0

~ Additionnel Scan: 247830 Items scanned in 00mn 35s



---\\ Sumário das deteções encontradas na sua estação
~ MSI: 0 link(s) detected in 00mn 00s



~ 955 Legitimates filtered by white list
End of the scan (505 lines in 03mn 24s)(0)

 Selecione e copie todo o texto destacado em vermelho que te passei.
_____________________________________________________________________________________________________________

 Vá no menu: Iniciar > Todos os programas > ZHP > Clique com o botão direito do mouse sobre o Zhpfix e escolha a opção de Executar como administrador > Clique em Importação > Clique no botão GO > Clique em Oui > Caso queira que os arquivos da lixeira sejam excluídos clique em Oui novamente > Um relatório aparecerá no bloco de notas.

Copie este relatório e poste em sua próxima resposta

Boa noite, segue o log
05.17.201419:00:40

Rapport de ZHPFix 2014.4.13.3 par Nicolas Coolman, Update du 13/04/2014
Fichier d'export Registre :
Run by Windows 7 at 17/05/2014 18:56:36
High Elevated Privileges : OK
Windows 7 Ultimate Edition, 32-bit Service Pack 1 (Build 7601)

Reciclagem vazia (00mn 04s)

========== Pastas ==========
Nenhuma pasta CLSID local utilizador vazia

========== Ficheiros ==========
ELIMINÉ Temporários windows (11) (38.577 octets)
ELIMINÉ Flash Cookies (0) (0 octets)

========== Restauração Sistema ==========
Ponto de restauro do sistema criado com sucesso


========== Recapitulativo ==========
1 : Pastas
2 : Ficheiros
1 : Restauração Sistema


End of clean in 00mn 33s

========== Caminho do ficheiro do relatório ==========
C:\Users\Windows 7\AppData\Roaming\ZHP\ZHPFix[R1].txt - 12/05/2014 22:21:23 [1310]
C:\Users\Windows 7\AppData\Roaming\ZHP\ZHPFix[R2].txt - 15/05/2014 20:58:19 [1480]
C:\Users\Windows 7\AppData\Roaming\ZHP\ZHPFix[R3].txt - 15/05/2014 23:41:41 [1295]
C:\Users\Windows 7\AppData\Roaming\ZHP\ZHPFix[R4].txt - 17/05/2014 18:56:41 [997]

já passei o Zoek, Jrt, Malwarebytes

Quanto ao log do ZHP, ele já está limpo. Mas seria importante você postar os logs do Zoek, JRT e Malwarebytes para que possamos analisar.

TÓPICO ARQUIVADO

Como o autor não respondeu por mais de 15 dias, o tópico foi arquivado. Caso o autor do tópico necessite, o mesmo será reaberto, para isso deverá entrar em contato com um dos membros da [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] solicitando o desbloqueio.