Como posso remover o sweet page do meu PC.

Olá,
Sou um novo membro, estou com o meu PC e o meu Lap infectado pelo Sweet Page e gostaria da ajuda de vocês para removê-lo. Fiz o uso do Zoek eu tenho uma dúvida a lista de resultados do Zoek eu tenho que colocar nesta janela?
O sweet page ainda está no meu micro entrei no navegador do google quem apareceu? Sweet page.

Obrigado

Eros

Zoek.exe v5.0.0.0 Updated 02-June-2014
Tool run by Eros on seg 09/06/2014 at 23:24:38,62.
Microsoft Windows XP Home Edition 5.1.2600 Service Pack 2 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Documents and Settings\Eros\Meus documentos\Downloads\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

9/6/2014 23:26:16 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wpm deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wpm deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\Wpm deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Wpm deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iSafeNetFilter deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\iSafeNetFilter deleted successfully

==== Deleting Files \ Folders ======================

C:\Arquivos de programas\BrowseMark deleted
C:\Arquivos de programas\iSafe deleted
C:\Documents and Settings\Eros\Dados de aplicativos\SupTab deleted
C:\Documents and Settings\Eros\Dados de aplicativos\iLauncher deleted
C:\Documents and Settings\Eros\Dados de aplicativos\iLinker deleted
C:\Documents and Settings\Eros\Dados de aplicativos\sweet-page deleted
C:\Documents and Settings\Eros\Dados de aplicativos\Baidu deleted
C:\Documents and Settings\Eros\Dados de aplicativos\eCyber deleted
C:\Documents and Settings\Eros\Dados de aplicativos\isafe deleted
C:\Documents and Settings\Nadja\Dados de aplicativos\iSafe deleted
C:\Documents and Settings\JSSICA~1\Dados de aplicativos\isafe deleted
C:\WINDOWS\system32\config\systemprofile\Dados de aplicativos\isafe deleted
C:\DOCUME~1\ALLUSE~1\DADOSD~1\IePluginService deleted
C:\DOCUME~1\ALLUSE~1\DADOSD~1\WPM deleted
C:\DOCUME~1\ALLUSE~1\DADOSD~1\Baidu deleted
C:\WINDOWS\000001_.tmp deleted
C:\WINDOWS\SET21.tmp deleted
C:\WINDOWS\SET3.tmp deleted
C:\WINDOWS\SET4.tmp deleted
C:\WINDOWS\SET8.tmp deleted
"C:\Arquivos de programas\SupTab\DpInterface32.dll" deleted
"C:\DOCUME~1\ALLUSE~1\DADOSD~1\IePluginServices\PluginService.exe" deleted
"C:\Arquivos de programas\SupTab" not deleted
"C:\DOCUME~1\ALLUSE~1\DADOSD~1\IePluginServices" not deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"quiknowledge@quiknowledge.com"="C:\Arquivos de programas\Mozilla Firefox\extensions\quiknowledge@quiknowledge.com" []

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
gomekmidlodglbbmalcneegieacbdmki - C:\Arquivos de programas\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[27/05/2014 19:44]

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com.br/"
"Search Page"="http://www.sweet-page.com/web/?type=ds&ts=1399947673&from=cor&uid=SAMSUNGXSP2504C_S09QJDQP702434&q={searchTerms}"
"Default_Page_URL"="http://www.sweet-page.com/?type=hp&ts=1399947673&from=cor&uid=SAMSUNGXSP2504C_S09QJDQP702434"
"Default_Search_URL"="http://www.sweet-page.com/web/?type=ds&ts=1399947673&from=cor&uid=SAMSUNGXSP2504C_S09QJDQP702434&q={searchTerms}"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.sweet-page.com/?type=hp&ts=1399947673&from=cor&uid=SAMSUNGXSP2504C_S09QJDQP702434"
"Default_Search_URL"="http://www.sweet-page.com/web/?type=ds&ts=1397394805&from=cor&uid=SAMSUNGXSP2504C_S09QJDQP702434&q={searchTerms}"
"Search Page"="http://www.sweet-page.com/web/?type=ds&ts=1397394805&from=cor&uid=SAMSUNGXSP2504C_S09QJDQP702434&q={searchTerms}"
"Start Page"="http://www.sweet-page.com/?type=hp&ts=1399947673&from=cor&uid=SAMSUNGXSP2504C_S09QJDQP702434"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.sweet-page.com/web/?type=ds&ts=1399947673&from=cor&uid=SAMSUNGXSP2504C_S09QJDQP702434&q={searchTerms}"
"CustomizeSearch"="http://www.sweet-page.com/web/?type=ds&ts=1399947673&from=cor&uid=SAMSUNGXSP2504C_S09QJDQP702434&q={searchTerms}"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://www.google.com.br/"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
"(Default)"="http://search.msn.com/results.asp?q=%s"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm"
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google  Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Reset Google Chrome ======================

Nothing found to reset

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\quick_start@gmail.com deleted successfully
HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\quiknowledge@quiknowledge.com deleted successfully

==== shortcuts on Users Desktops ======================

C:\Documents and Settings\Eros\Desktop\Atalho para IRPF2014.lnk - C:\Documents and Settings\Eros\Meus documentos\Downloads\IRPF2014-1.2\IRPF2014\IRPF2014.exe
C:\Documents and Settings\Eros\Desktop\Atalho para Livreto de célula.lnk -  
C:\Documents and Settings\Eros\Desktop\I.R.I.S. Resource Center.lnk -  
C:\Documents and Settings\Eros\Desktop\Internet Explorer.lnk - C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Eros\Desktop\IRPF2013 - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País.lnk -  
C:\Documents and Settings\Eros\Desktop\Revo Uninstaller.lnk - C:\Arquivos de programas\VS Revo Group\Revo Uninstaller\Revouninstaller.exe
C:\Documents and Settings\Nadja\Desktop\BOL MA 3.00.Lnk - C:\Arquivos de programas\Bible\Olb.exe
C:\Documents and Settings\Nadja\Desktop\Integralização\Aula de Português CVQ.lnk -  
C:\Documents and Settings\Nadja\Desktop\Integralização\INTRODUÇÃO - LINGUA PORTUGUESA.lnk -  
C:\Documents and Settings\Nadja\Desktop\Integralização\Hebraico\Atalho para Hebraico refeito.lnk -  

==== shortcuts on All Users Desktop ======================

C:\Documents and Settings\All Users\Desktop\Adobe Reader XI.lnk - C:\Arquivos de programas\Adobe\Reader 11.0\Reader\AcroRd32.exe
C:\Documents and Settings\All Users\Desktop\avast Internet Security.lnk -  
C:\Documents and Settings\All Users\Desktop\Compre suprimentos - HP Officejet Pro 8600.lnk - C:\Arquivos de programas\HP\HP Officejet Pro 8600\Bin\hpqDTSS.exe
C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk - C:\Arquivos de programas\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\All Users\Desktop\HP ePrintCenter - HP Officejet Pro 8600.lnk - C:\Arquivos de programas\HP\HP Officejet Pro 8600\ePrintCenterShortcut.url
C:\Documents and Settings\All Users\Desktop\HP Officejet Pro 8600.lnk - C:\Arquivos de programas\HP\HP Officejet Pro 8600\Bin\HP Officejet Pro 8600.exe
C:\Documents and Settings\All Users\Desktop\Market Leader Advanced DVD-ROM.lnk - C:\Arquivos de programas\Longman\Market Leader\Market Leader Advanced DVD-ROM\CD-ROM.exe
C:\Documents and Settings\All Users\Desktop\Receitanet 1.04 .lnk - C:\Documents and Settings\Eros\Desktop\Windows\Receitanet.exe
C:\Documents and Settings\All Users\Desktop\Samsung i-Launcher.lnk - C:\Arquivos de programas\Samsung\iLauncher\iLauncher.exe

==== shortcuts in Users Start Menu ======================

C:\Documents and Settings\Eros\Menu Iniciar\Programas\Internet Explorer.lnk - C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
C:\Documents and Settings\Eros\Menu Iniciar\Programas\Dropbox\Dropbox.lnk - C:\Documents and Settings\Eros\Dados de aplicativos\Dropbox\bin\Dropbox.exe /home
C:\Documents and Settings\Eros\Menu Iniciar\Programas\Dropbox\Uninstall Dropbox.lnk - C:\Documents and Settings\Eros\Dados de aplicativos\Dropbox\bin\DropboxUninstaller.exe
C:\Documents and Settings\Eros\Menu Iniciar\Programas\Inicializar\Monitorar alertas de tinta - HP Officejet Pro 8600.lnk - C:\WINDOWS\system32\rundll32.exe "C:\Arquivos de programas\HP\HP Officejet Pro 8600\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN2BFBVHD405KC;CONNECTION=USB;MONITOR=1;
C:\Documents and Settings\Eros\Menu Iniciar\Programas\Longman\Market Leader\Market Leader Advanced DVD-ROM\Market Leader Advanced DVD-ROM.lnk - C:\Arquivos de programas\Longman\Market Leader\Market Leader Advanced DVD-ROM\CD-ROM.exe
C:\Documents and Settings\Eros\Menu Iniciar\Programas\Longman\Market Leader\Market Leader Advanced DVD-ROM\Uninstall.lnk - C:\Arquivos de programas\Longman\Market Leader\Market Leader Advanced DVD-ROM\Uninstall.exe
C:\Documents and Settings\Eros\Menu Iniciar\Programas\Programas RFB2013\IRPF - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País\Ajuda do IRPF2013.lnk -  
C:\Documents and Settings\Eros\Menu Iniciar\Programas\Programas RFB2013\IRPF - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País\Desinstalar IRPF2013.lnk -  
C:\Documents and Settings\Eros\Menu Iniciar\Programas\Programas RFB2013\IRPF - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País\IRPF2013 - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País.lnk -  
C:\Documents and Settings\Eros\Menu Iniciar\Programas\Programas RFB2013\IRPF - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País\Leia-me do IRPF2013.lnk -  
C:\Documents and Settings\Eros\Menu Iniciar\Programas\Revo Uninstaller\Revo Uninstaller.lnk - C:\Arquivos de programas\VS Revo Group\Revo Uninstaller\Revouninstaller.exe
C:\Documents and Settings\Eros\Menu Iniciar\Programas\Revo Uninstaller\Run Hunter Mode.lnk - C:\Arquivos de programas\VS Revo Group\Revo Uninstaller\Revouninstaller.exe -hunter
C:\Documents and Settings\Eros\Menu Iniciar\Programas\Revo Uninstaller\Uninstall.lnk - C:\Arquivos de programas\VS Revo Group\Revo Uninstaller\uninst.exe
C:\Documents and Settings\Eros\Menu Iniciar\Programas\Revo Uninstaller\Website.lnk - C:\Arquivos de programas\VS Revo Group\Revo Uninstaller\Revo Uninstaller.url
C:\Documents and Settings\Nadja\Menu Iniciar\Programas\Acessórios\Windows Explorer.lnk -  
C:\Documents and Settings\JSSICA~1\Menu Iniciar\Programas\EES\ees.lnk - C:\EES32\EES.exe
C:\Documents and Settings\JSSICA~1\Menu Iniciar\Programas\EES\Uninstall EES.lnk - C:\EES32\Unwise.exe

==== shortcuts in All Users Start Menu ======================

C:\Documents and Settings\All Users\Menu Iniciar\Programas\Adobe Reader XI.lnk - C:\WINDOWS\Installer\{AC76BA86-7AD7-1046-7B44-AB0000000001}\SC_Reader.ico
C:\Documents and Settings\All Users\Menu Iniciar\Programas\7-Zip\7-Zip File Manager.lnk - C:\Arquivos de programas\7-Zip\7zFM.exe
C:\Documents and Settings\All Users\Menu Iniciar\Programas\7-Zip\7-Zip Help.lnk - C:\Arquivos de programas\7-Zip\7-zip.chm
C:\Documents and Settings\All Users\Menu Iniciar\Programas\Avast\avast Internet Security.lnk -  
C:\Documents and Settings\All Users\Menu Iniciar\Programas\Google Chrome\Google Chrome.lnk - C:\Arquivos de programas\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\All Users\Menu Iniciar\Programas\Java\About Java.lnk - C:\Arquivos de programas\Java\jre7\bin\javacpl.exe -tab about
C:\Documents and Settings\All Users\Menu Iniciar\Programas\Java\Check For Updates.lnk - C:\Arquivos de programas\Java\jre7\bin\javacpl.exe -tab update
C:\Documents and Settings\All Users\Menu Iniciar\Programas\Java\Configure Java.lnk - C:\Arquivos de programas\Java\jre7\bin\javacpl.exe
C:\Documents and Settings\All Users\Menu Iniciar\Programas\Java\Get Help.lnk -  
C:\Documents and Settings\All Users\Menu Iniciar\Programas\Java\Visit Java.com.lnk -  
C:\Documents and Settings\All Users\Menu Iniciar\Programas\Microsoft Office\Microsoft Office Excel 2007.lnk - C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
C:\Documents and Settings\All Users\Menu Iniciar\Programas\Microsoft Office\Microsoft Office Word 2007.lnk - C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe

==== shortcuts in Quick Launch ======================

C:\Documents and Settings\Eros\Dados de aplicativos\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Arquivos de programas\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Eros\Dados de aplicativos\Microsoft\Internet Explorer\Quick Launch\Iniciar o navegador Internet Explorer.lnk - C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Eros\Dados de aplicativos\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk - C:\Arquivos de programas\Windows Media Player\wmplayer.exe /prefetch:1
C:\Documents and Settings\Nadja\Dados de aplicativos\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Arquivos de programas\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Nadja\Dados de aplicativos\Microsoft\Internet Explorer\Quick Launch\Iniciar o navegador Internet Explorer.lnk - C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Nadja\Dados de aplicativos\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk - C:\Arquivos de programas\Windows Media Player\wmplayer.exe /prefetch:1
C:\Documents and Settings\JSSICA~1\Dados de aplicativos\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Arquivos de programas\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\JSSICA~1\Dados de aplicativos\Microsoft\Internet Explorer\Quick Launch\Iniciar o navegador Internet Explorer.lnk - C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\JSSICA~1\Dados de aplicativos\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk - C:\Arquivos de programas\Windows Media Player\wmplayer.exe /prefetch:1

==== shortcuts After Repair ======================

C:\Documents and Settings\Eros\Menu Iniciar\Programas\Internet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe

==== Reset IE Proxy ======================

Value(s) before fix:
"ProxyEnable"=dword:00000000

Value(s) after fix:
"ProxyEnable"=dword:00000000

==== Empty IE Cache ======================

C:\Documents and Settings\Default User\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
C:\Documents and Settings\Eros\Configurações locais\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 emptied successfully
C:\Documents and Settings\Eros\Configurações locais\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Documents and Settings\Eros\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
C:\Documents and Settings\LocalService\Configurações locais\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Documents and Settings\LocalService\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
C:\Documents and Settings\Nadja\Configurações locais\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 emptied successfully
C:\Documents and Settings\Nadja\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
C:\Documents and Settings\NetworkService\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
C:\Documents and Settings\JSSICA~1\Configurações locais\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 emptied successfully
C:\Documents and Settings\JSSICA~1\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
C:\WINDOWS\system32\config\systemprofile\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
C:\WINDOWS\system32\config\systemprofile\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

No Chrome User Data found

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=220 folders=79 31140830 bytes)

==== Empty Temp Folders ======================

C:\WINDOWS\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied
C:\DOCUME~1\Eros\CONFIG~1\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\RECYCLER successfully emptied

==== Deleting Files / Folders ======================

"C:\Arquivos de programas\SupTab"  not found
"C:\DOCUME~1\ALLUSE~1\DADOSD~1\IePluginServices"  not found

==== EOF on seg 09/06/2014 at 23:36:52,81 ======================

Olá Eros.

Poste o relatório do Zoek aqui no seu tópico para podermos analisar.

Olá,
Gostaria de saber como eu continuo:
Já passei o Zoek,
Já postei o relatório do meu PC,
E, o que eu faço agora?

agradecido em adiantado,

Eros

Da próxima vez que você postar o relatório pedido, ao invés de editar sua resposta peço que você responda e coloque na resposta o relatório. Pois assim eu recebo um email me avisando da sua resposta, caso contrário eu não fico sabendo que você respondeu.
_________________________________________________________________________________________________________________

Baixe o programa Adwcleaner clicando no link abaixo e depois clique no botão Download Now @BleepingComputer:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Para executar corretamente o AdwCleaner é só seguir as dicas deste tutorial:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

* Na sua próxima resposta poste o log (relatório) do Adwcleaner que estará em C:\AdwCleaner\AdwCleaner[S0].txt

Ficamos na espera.

# AdwCleaner v3.212 - Relatório criado 18/06/2014 às 19:44:29
# Atualizado 05/06/2014 por Xplode
# Sistema Operacional : Microsoft Windows XP Service Pack 2 (32 bits)
# Usuário : Eros - CASA
# Executando de : C:\Documents and Settings\Eros\Meus documentos\Downloads\AdwCleaner.exe
# Opção : Examinar

***** [ Serviços ] *****

Serviço Encontrado : IePluginServices
Serviço Encontrado : qknfd

***** [ Arquivos / Pastas ] *****

Arquivo Encontrado : C:\Arquivos de programas\Mozilla Firefox\browser\searchplugins\sweet-page.xml
Pasta Encontrado : C:\Documents and Settings\Eros\Dados de aplicativos\0F1F1C2Y1H1P1C0I0T

***** [ Atalhos ] *****


***** [ Registro ] *****

Chave Encontrada : HKCU\Software\BrowseMark
Chave Encontrada : HKCU\Software\InstallCore
Chave Encontrada : HKLM\Software\BrowseMark
Chave Encontrada : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Chave Encontrada : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Chave Encontrada : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Chave Encontrada : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
Chave Encontrada : HKLM\Software\iSafe
Chave Encontrada : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BrowseMark
Chave Encontrada : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Wpm
Chave Encontrada : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BrowseMark
Chave Encontrada : HKLM\Software\SupDp
Chave Encontrada : HKLM\Software\SupTab
Chave Encontrada : HKLM\Software\supWPM
Chave Encontrada : HKLM\Software\sweet-pageSoftware
Chave Encontrada : HKLM\Software\Wpm
Dados Encontrada : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\ARQUIV~1\SupTab\SEARCH~1.DLL

***** [ Navegadores ] *****

-\\ Internet Explorer v6.0.2900.2180


-\\ Google Chrome v35.0.1916.153

[ Arquivo : C:\Documents and Settings\Eros\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\preferences ]

Encontrada [Startup_urls] : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Encontrada [Homepage] : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

[ Arquivo : C:\Documents and Settings\Jéssica\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\preferences ]

Encontrada [Homepage] : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

[ Arquivo : C:\Documents and Settings\Nadja\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\preferences ]

Encontrada [Search Provider] : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Encontrada [Startup_urls] : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

*************************

AdwCleaner[R0].txt - [3034 octets] - [18/06/2014 19:44:29]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [3094 octets] ##########

No seu relatório do Adwcleaner está constando que você usou só a função de Examinar. Abra novamente o Adwcleaner > Clique em Examinar > Depois disto clique em Limpar e aí é só ir seguindo os passos que ele vai te mostrando conforme está também no tutorial dele que te passei e depois disto poste o novo relatório do Adwcleaner que estará em C:\AdwCleaner\AdwCleaner[S0].txt

Olá Power Max aqui está o relatório correto agora. Desculpe-me pela trapalhada.


# AdwCleaner v3.212 - Relatório criado 20/06/2014 às 14:19:05
# Atualizado 05/06/2014 por Xplode
# Sistema Operacional : Microsoft Windows XP Service Pack 2 (32 bits)
# Usuário : Eros - CASA
# Executando de : C:\Documents and Settings\Eros\Meus documentos\Downloads\AdwCleaner (1).exe
# Opção : Limpar

***** [ Serviços ] *****

[#] Serviço Deletada : IePluginServices
[#] Serviço Deletada : qknfd

***** [ Arquivos / Pastas ] *****

Pasta Deletada : C:\Documents and Settings\Eros\Dados de aplicativos\0F1F1C2Y1H1P1C0I0T
Arquivo Deletada : C:\Arquivos de programas\Mozilla Firefox\browser\searchplugins\sweet-page.xml

***** [ Atalhos ] *****


***** [ Registro ] *****

Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
Chave Deletedo : HKCU\Software\BrowseMark
Chave Deletedo : HKCU\Software\InstallCore
Chave Deletedo : HKLM\Software\BrowseMark
Chave Deletedo : HKLM\Software\iSafe
Chave Deletedo : HKLM\Software\SupDp
Chave Deletedo : HKLM\Software\SupTab
Chave Deletedo : HKLM\Software\supWPM
Chave Deletedo : HKLM\Software\sweet-pageSoftware
Chave Deletedo : HKLM\Software\Wpm
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BrowseMark
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\BrowseMark
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Wpm
Dados Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\ARQUIV~1\SupTab\SEARCH~1.DLL

***** [ Navegadores ] *****

-\\ Internet Explorer v6.0.2900.2180


-\\ Google Chrome v35.0.1916.153

[ Arquivo : C:\Documents and Settings\Eros\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\preferences ]

Deletedo [Search Provider] : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Deletedo [Startup_urls] : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Deletedo [Homepage] : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

[ Arquivo : C:\Documents and Settings\Jéssica\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\preferences ]

Deletedo [Homepage] : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

[ Arquivo : C:\Documents and Settings\Nadja\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\preferences ]

Deletedo [Search Provider] : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Deletedo [Startup_urls] : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

*************************

AdwCleaner[R0].txt - [3174 octets] - [18/06/2014 19:44:29]
AdwCleaner[R1].txt - [3238 octets] - [20/06/2014 14:17:38]
AdwCleaner[S0].txt - [3257 octets] - [20/06/2014 14:19:05]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3317 octets] ##########

Baixe o programa Junkware Removal Tool no link abaixo:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Para executar corretamente o programa acima é só seguir as dicas deste tutorial:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

* Na sua próxima resposta poste o log (relatório) do Junkware Removal Tool que estará salvo em sua área de trabalho com o nome de JRT.txt

Ficamos na espera.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Microsoft Windows XP x86
Ran by Eros on sex 20/06/2014 at 15:07:46,82
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\baidu

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\All Users\application data\baidu"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on sex 20/06/2014 at 15:12:48,75
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

No seu PC está constando o antivirus Baidu instalado. Você quer continuar com ele ou quer removê-lo?

Podemos remove-lo.Eu n sabia que ele estava na minha máquina.

Desative temporariamente seu antivírus para evitar conflitos.

Se você tiver excluído o Zoek, acesse este link abaixo e clique no primeiro botão da esquerda que é o botão Download Zoek.exe:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

*Clique com o botão direito do mouse no Zoek.exe e selecione [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

* Selecione e copie todo este texto destacado em vermelho que te passei e cole-o no espaço em branco do Zoek:

*Clique [Run Script]

*Durante o scan uma mensagem parecida com esta abaixo mostrando o progresso do escaneamento será apresentada. Aguarde o término...pode demorar!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

*Caso a reinicialização do PC seja solicitada, clique [OK]

* Poste o log do Zoek que estará em C:\zoek-results.txt em sua próxima resposta.

Zoek.exe v5.0.0.0 Updated 20-06-2014
Tool run by Eros on s b 21/06/2014 at  8:51:59,15.
Microsoft Windows XP Home Edition 5.1.2600 Service Pack 2 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Documents and Settings\Eros\Meus documentos\Downloads\zoek (3).exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2014-06-10-023652.log 19843 bytes
C:\zoek-results2014-06-21-114923.log 7265 bytes

==== Folders Found ======================

2014-05-13 02:22:36 2014-05-13 02:22:36 -------- d-----w- C:\Arquivos de programas\Baidu Security
2014-05-13 02:22:36 2014-05-13 19:37:31 -------- d-----w- C:\Arquivos de programas\Baidu Security\Baidu Antivirus
2014-05-13 02:23:04 2014-05-13 02:23:04 -------- d-----w- C:\Documents and Settings\All Users\Dados de aplicativos\Baidu Security
2014-05-13 02:21:50 2014-05-13 02:21:50 -------- d-----w- C:\Documents and Settings\All Users\Documentos\Baidu
2014-06-10 02:32:09 2014-06-10 02:32:09 -------- d---a-w- C:\zoek_backup\C_Documents and Settings_Eros_Dados de aplicativos_Baidu
2014-06-10 02:32:14 2014-06-10 02:32:14 -------- d---a-w- C:\zoek_backup\C_DOCUME~1_ALLUSE~1_DADOSD~1_Baidu
2014-06-10 02:32:09 2014-06-10 02:32:09 -------- d---a-w- C:\zoek_backup\C_Documents and Settings_Eros_Dados de aplicativos_Baidu\Baidu Antivirus

==== Files Found ======================


==== Registry Search Results for "Baidu" ======================


[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\Antivirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\DuplicateRecord]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\PC Faster]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BFILTER\0000]
"DeviceDesc"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BFMON\0000]
"DeviceDesc"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BHBASE\0000]
"DeviceDesc"="Baidu Hook Base"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BNDEF\0000]
"DeviceDesc"="Baidu NetDefense"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BPROTECT\0000]
"DeviceDesc"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bfilter]
"DisplayName"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bfmon]
"DisplayName"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bhbase]
"DisplayName"="Baidu Hook Base"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BHipsEx]
"DisplayName"="Baidu HipsEx Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bndef]
"DisplayName"="Baidu NetDefense"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bprotect]
"InstPath"="C:\\Arquivos de programas\\Baidu Security\\Baidu Antivirus"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bprotect]
"DisplayName"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BFILTER\0000]
"DeviceDesc"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BFMON\0000]
"DeviceDesc"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BHBASE\0000]
"DeviceDesc"="Baidu Hook Base"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BNDEF\0000]
"DeviceDesc"="Baidu NetDefense"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BPROTECT\0000]
"DeviceDesc"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bfilter]
"DisplayName"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bfmon]
"DisplayName"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bhbase]
"DisplayName"="Baidu Hook Base"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BHipsEx]
"DisplayName"="Baidu HipsEx Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bndef]
"DisplayName"="Baidu NetDefense"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bprotect]
"InstPath"="C:\\Arquivos de programas\\Baidu Security\\Baidu Antivirus"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bprotect]
"DisplayName"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BFILTER\0000]
"DeviceDesc"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BFMON\0000]
"DeviceDesc"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BHBASE\0000]
"DeviceDesc"="Baidu Hook Base"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BNDEF\0000]
"DeviceDesc"="Baidu NetDefense"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BPROTECT\0000]
"DeviceDesc"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bfilter]
"DisplayName"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bfmon]
"DisplayName"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bhbase]
"DisplayName"="Baidu Hook Base"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BHipsEx]
"DisplayName"="Baidu HipsEx Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bndef]
"DisplayName"="Baidu NetDefense"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bprotect]
"InstPath"="C:\\Arquivos de programas\\Baidu Security\\Baidu Antivirus"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bprotect]
"DisplayName"="Baidu Protect"

[HKEY_USERS\.DEFAULT\Software\Baidu]

[HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug]

[HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug\Bav]

[HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug\Bav\log]

[HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug\Bav\log\BavSvc.exe]

[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security]

[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\Antivirus]

[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\Antivirus\web]

[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\Antivirus\web]
"ucloud"="u.br.bav.baidu.com"

[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\Antivirus\web]
"dcloud"="http://up.br.bav.baidu.com/cgi-bin/url_warnning/url_warnning.cgi"

[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\Antivirus\web]
"rcloud"="http://up.br.bav.baidu.com/cgi-bin/url_visit_action.cgi"

[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\PC Faster]

[HKEY_USERS\S-1-5-18\Software\Baidu]

[HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug]

[HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug\Bav]

[HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug\Bav\log]

[HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug\Bav\log\BavSvc.exe]

==== C:\zoek_backup content ======================

C:\zoek_backup (files=220 folders=79 31140830 bytes)

==== EOF on s b 21/06/2014 at  8:53:03,09 ======================

Desative temporariamente seu antivírus para evitar conflitos.

* Clique com o botão direito do mouse no Zoek.exe e selecione [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

* Selecione e copie todo este texto destacado em vermelho que te passei e cole-o no espaço em branco do Zoek:

*Clique [Run Script]

*Durante o scan uma mensagem parecida com esta abaixo mostrando o progresso do escaneamento será apresentada. Aguarde o término...pode demorar!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

*Caso a reinicialização do PC seja solicitada, clique [OK]

* Poste o log do Zoek que estará em C:\zoek-results.txt em sua próxima resposta.

Zoek.exe v5.0.0.0 Updated 20-06-2014
Tool run by Eros on s b 21/06/2014 at  8:51:59,15.
Microsoft Windows XP Home Edition 5.1.2600 Service Pack 2 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Documents and Settings\Eros\Meus documentos\Downloads\zoek (3).exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2014-06-10-023652.log 19843 bytes
C:\zoek-results2014-06-21-114923.log 7265 bytes

==== Folders Found ======================

2014-05-13 02:22:36 2014-05-13 02:22:36 -------- d-----w- C:\Arquivos de programas\Baidu Security
2014-05-13 02:22:36 2014-05-13 19:37:31 -------- d-----w- C:\Arquivos de programas\Baidu Security\Baidu Antivirus
2014-05-13 02:23:04 2014-05-13 02:23:04 -------- d-----w- C:\Documents and Settings\All Users\Dados de aplicativos\Baidu Security
2014-05-13 02:21:50 2014-05-13 02:21:50 -------- d-----w- C:\Documents and Settings\All Users\Documentos\Baidu
2014-06-10 02:32:09 2014-06-10 02:32:09 -------- d---a-w- C:\zoek_backup\C_Documents and Settings_Eros_Dados de aplicativos_Baidu
2014-06-10 02:32:14 2014-06-10 02:32:14 -------- d---a-w- C:\zoek_backup\C_DOCUME~1_ALLUSE~1_DADOSD~1_Baidu
2014-06-10 02:32:09 2014-06-10 02:32:09 -------- d---a-w- C:\zoek_backup\C_Documents and Settings_Eros_Dados de aplicativos_Baidu\Baidu Antivirus

==== Files Found ======================


==== Registry Search Results for "Baidu" ======================


[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\Antivirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\DuplicateRecord]

[HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\PC Faster]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BFILTER\0000]
"DeviceDesc"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BFMON\0000]
"DeviceDesc"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BHBASE\0000]
"DeviceDesc"="Baidu Hook Base"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BNDEF\0000]
"DeviceDesc"="Baidu NetDefense"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BPROTECT\0000]
"DeviceDesc"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bfilter]
"DisplayName"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bfmon]
"DisplayName"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bhbase]
"DisplayName"="Baidu Hook Base"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BHipsEx]
"DisplayName"="Baidu HipsEx Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bndef]
"DisplayName"="Baidu NetDefense"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bprotect]
"InstPath"="C:\\Arquivos de programas\\Baidu Security\\Baidu Antivirus"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bprotect]
"DisplayName"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BFILTER\0000]
"DeviceDesc"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BFMON\0000]
"DeviceDesc"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BHBASE\0000]
"DeviceDesc"="Baidu Hook Base"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BNDEF\0000]
"DeviceDesc"="Baidu NetDefense"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BPROTECT\0000]
"DeviceDesc"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bfilter]
"DisplayName"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bfmon]
"DisplayName"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bhbase]
"DisplayName"="Baidu Hook Base"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BHipsEx]
"DisplayName"="Baidu HipsEx Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bndef]
"DisplayName"="Baidu NetDefense"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bprotect]
"InstPath"="C:\\Arquivos de programas\\Baidu Security\\Baidu Antivirus"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bprotect]
"DisplayName"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BFILTER\0000]
"DeviceDesc"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BFMON\0000]
"DeviceDesc"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BHBASE\0000]
"DeviceDesc"="Baidu Hook Base"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BNDEF\0000]
"DeviceDesc"="Baidu NetDefense"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BPROTECT\0000]
"DeviceDesc"="Baidu Protect"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bfilter]
"DisplayName"="Baidu Antivirus Minifilter Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bfmon]
"DisplayName"="Baidu FS Monitor Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bhbase]
"DisplayName"="Baidu Hook Base"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BHipsEx]
"DisplayName"="Baidu HipsEx Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bndef]
"DisplayName"="Baidu NetDefense"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bprotect]
"InstPath"="C:\\Arquivos de programas\\Baidu Security\\Baidu Antivirus"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bprotect]
"DisplayName"="Baidu Protect"

[HKEY_USERS\.DEFAULT\Software\Baidu]

[HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug]

[HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug\Bav]

[HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug\Bav\log]

[HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug\Bav\log\BavSvc.exe]

[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security]

[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\Antivirus]

[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\Antivirus\web]

[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\Antivirus\web]
"ucloud"="u.br.bav.baidu.com"

[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\Antivirus\web]
"dcloud"="http://up.br.bav.baidu.com/cgi-bin/url_warnning/url_warnning.cgi"

[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\Antivirus\web]
"rcloud"="http://up.br.bav.baidu.com/cgi-bin/url_visit_action.cgi"

[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\PC Faster]

[HKEY_USERS\S-1-5-18\Software\Baidu]

[HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug]

[HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug\Bav]

[HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug\Bav\log]

[HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug\Bav\log\BavSvc.exe]

==== C:\zoek_backup content ======================

C:\zoek_backup (files=220 folders=79 31140830 bytes)

==== EOF on s b 21/06/2014 at  8:53:03,09 ======================

Parece que você não seguiu da forma que te passei na resposta anterior. Siga, por gentileza, exatamente da forma que lhe passei e depois poste o novo relatório que o Zoek irá criar.

Zoek.exe v5.0.0.0 Updated 22-06-2014
Tool run by Eros on seg 23/06/2014 at 21:12:43,62.
Microsoft Windows XP Home Edition 5.1.2600 Service Pack 2 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Documents and Settings\Eros\Meus documentos\Downloads\zoek (1).exe [Scan all users] [Script inserted]

==== System Restore Info ======================

23/6/2014 21:13:10 Zoek.exe System Restore Point Created Succesfully.

==== Deleting Services ======================


==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\Antivirus]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\DuplicateRecord]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\PC Faster]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BFILTER\0000]
"DeviceDesc"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BFILTER\0000]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BFMON\0000]
"DeviceDesc"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BFMON\0000]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BHBASE\0000]
"DeviceDesc"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BHBASE\0000]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BNDEF\0000]
"DeviceDesc"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BNDEF\0000]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BPROTECT\0000]
"DeviceDesc"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BPROTECT\0000]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bfilter]
"DisplayName"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bfilter]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bfmon]
"DisplayName"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bfmon]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bhbase]
"DisplayName"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bhbase]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BHipsEx]
"DisplayName"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BHipsEx]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bndef]
"DisplayName"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bndef]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bprotect]
"InstPath"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bprotect]
"DisplayName"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bprotect]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BFILTER\0000]
"DeviceDesc"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BFILTER\0000]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BFMON\0000]
"DeviceDesc"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BFMON\0000]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BHBASE\0000]
"DeviceDesc"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BHBASE\0000]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BNDEF\0000]
"DeviceDesc"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BNDEF\0000]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BPROTECT\0000]
"DeviceDesc"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_BPROTECT\0000]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bfilter]
"DisplayName"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bfilter]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bfmon]
"DisplayName"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bfmon]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bhbase]
"DisplayName"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bhbase]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BHipsEx]
"DisplayName"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\BHipsEx]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bndef]
"DisplayName"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bndef]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bprotect]
"InstPath"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bprotect]
"DisplayName"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Bprotect]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BFILTER\0000]
"DeviceDesc"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BFILTER\0000]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BFMON\0000]
"DeviceDesc"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BFMON\0000]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BHBASE\0000]
"DeviceDesc"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BHBASE\0000]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BNDEF\0000]
"DeviceDesc"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BNDEF\0000]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BPROTECT\0000]
"DeviceDesc"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BPROTECT\0000]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bfilter]
"DisplayName"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bfilter]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bfmon]
"DisplayName"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bfmon]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bhbase]
"DisplayName"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bhbase]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BHipsEx]
"DisplayName"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BHipsEx]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bndef]
"DisplayName"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bndef]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bprotect]
"InstPath"=-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bprotect]
"DisplayName"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bprotect]
[-HKEY_USERS\.DEFAULT\Software\Baidu]
[-HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug]
[-HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug\Bav]
[-HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug\Bav\log]
[-HKEY_USERS\.DEFAULT\Software\Baidu\Application Bug\Bav\log\BavSvc.exe]
[-HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security]
[-HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\Antivirus]
[-HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\Antivirus\web]
[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\Antivirus\web]
"ucloud"=-
[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\Antivirus\web]
"dcloud"=-
[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\Antivirus\web]
"rcloud"=-
[-HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\PC Faster]
[-HKEY_USERS\S-1-5-18\Software\Baidu]
[-HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug]
[-HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug\Bav]
[-HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug\Bav\log]
[-HKEY_USERS\S-1-5-18\Software\Baidu\Application Bug\Bav\log\BavSvc.exe]

==== Deleting Files \ Folders ======================

C:\Arquivos de programas\Baidu Security not found
C:\Arquivos de programas\Baidu Security\Baidu Antivirus not found
C:\Documents and Settings\All Users\Dados de aplicativos\Baidu Security not found
C:\Documents and Settings\All Users\Documentos\Baidu not found

==== Folders Found ======================

2014-06-23 00:30:52 2014-06-23 00:30:52 -------- d---a-w- C:\zoek_backup\C_Arquivos de programas_Baidu Security
2014-06-23 00:30:52 2014-05-13 19:37:31 -------- d---a-w- C:\zoek_backup\C_Arquivos de programas_Baidu Security_Baidu Antivirus
2014-06-23 00:30:52 2014-06-23 00:30:52 -------- d---a-w- C:\zoek_backup\C_Documents and Settings_All Users_Dados de aplicativos_Baidu Security
2014-06-23 00:30:52 2014-06-23 00:30:52 -------- d---a-w- C:\zoek_backup\C_Documents and Settings_All Users_Documentos_Baidu
2014-06-10 02:32:09 2014-06-10 02:32:09 -------- d---a-w- C:\zoek_backup\C_Documents and Settings_Eros_Dados de aplicativos_Baidu
2014-06-10 02:32:14 2014-06-10 02:32:14 -------- d---a-w- C:\zoek_backup\C_DOCUME~1_ALLUSE~1_DADOSD~1_Baidu
2014-06-23 00:30:52 2014-05-13 19:37:31 -------- d---a-w- C:\zoek_backup\C_Arquivos de programas_Baidu Security\Baidu Antivirus
2014-06-10 02:32:09 2014-06-10 02:32:09 -------- d---a-w- C:\zoek_backup\C_Documents and Settings_Eros_Dados de aplicativos_Baidu\Baidu Antivirus

==== Files Found ======================


==== Registry Search Results for "Baidu" ======================


[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security]

[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\Antivirus]

[HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\Antivirus\web]

==== C:\zoek_backup content ======================

C:\zoek_backup (files=222 folders=86 31155979 bytes)

==== EOF on seg 23/06/2014 at 21:14:25,64 ======================

Desative temporariamente seu antivírus para evitar conflitos.

* Clique com o botão direito do mouse no Zoek.exe e selecione [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

* Selecione e copie todo este texto destacado em vermelho que te passei e cole-o no espaço em branco do Zoek:

*Clique [Run Script]

*Durante o scan uma mensagem parecida com esta abaixo mostrando o progresso do escaneamento será apresentada. Aguarde o término...pode demorar!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

*Caso a reinicialização do PC seja solicitada, clique [OK]

* Poste o log do Zoek que estará em C:\zoek-results.txt em sua próxima resposta.

Zoek.exe v5.0.0.0 Updated 22-06-2014
Tool run by Eros on seg 23/06/2014 at 23:18:40,07.
Microsoft Windows XP Home Edition 5.1.2600 Service Pack 2 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Documents and Settings\Eros\Meus documentos\Downloads\zoek (1).exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2014-06-24-001425.log 9478 bytes

==== System Restore Info ======================

23/6/2014 23:19:14 Zoek.exe System Restore Point Created Succesfully.

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[-HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security]
[-HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\Antivirus]
[-HKEY_USERS\S-1-5-21-484763869-2146948623-725345543-1004\Software\Baidu Security\Antivirus\web]

==== Registry Search Results for "Baidu" ======================

No instances of string "Baidu" found.

==== C:\zoek_backup content ======================

C:\zoek_backup (files=222 folders=86 31155979 bytes)

==== EOF on seg 23/06/2014 at 23:19:35,95 ======================

Faça o download do < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > < [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]> ( ... de Nicolas Coolman )

Obs: Ao acessar o link acima clique no botão Télécharger referente ao ZHPDiag para baixá-lo, tal como mostra a imagem abaixo:

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

Para instalá-lo e executá-lo corretamente siga as dicas deste artigo:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

* Assim que ele concluir a sua verificação, copie todo o conteúdo do seu relatório ZHPDiag.txt e poste em sua próxima resposta.

~ Relatório do ZHPDiag v2014.6.23.97 - Nicolas Coolman  (23/6/2014)
~ Iniciado por Eros (24/6/2014 19:54:36)
~ Endereço do Website : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Tradução pelo utilizador
~ Estatuto da versão : Versão atualizada.
~  Lista Branca : Ativado pelo programa
~ Elevação dos Privilégios : OK
~ Controle de Conta de Utilizador : Not Found


---\\ Navegadores Internet
MSIE: Internet Explorer v6.0.2900.2180
GCIE: Google Chrome v35.0.1916.153 (Defaut)

---\\ Informações sobre os produtos Windows
~ Langage: Portugais
Microsoft Windows XP, 32-bit Service Pack 2 (Build 2600)
Windows Automatic Updates : OK
Windows Genuine Advantage : KO

---\\ Softwares de proteçao do sistema
avast! Internet Security v9.0.2018

---\\ Softwares d'optimização do sistema

---\\ Softwares de partilha do PeerToPeer (P2P)

---\\ Monitoramento dos softwares
Adobe Reader XI
Java 7 Update 60

---\\ Informações sobre o sistema
~ Processor: x86 Family 6 Model 15 Stepping 2, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 2046 MB (53% free)
System Restore: Activé (Enable)
System drive C: has 102 GB (87%) free of 117 GB

---\\ Modo de conexão ao sistema
~ Computer Name: CASA
~ User Name: Eros
~ All Users Names: SUPPORT_388945a0, Nadja, Jéssica, HelpAssistant, Eros, Convidado, Administrador,
~ Unselected Option: 045,061,O62,065,066,080,O82,089
Logged in as Administrator

---\\ As variáveis de ambiente
~ System Unit : C:\
~ %AppZHP% : C:\Documents and Settings\Eros\Dados de aplicativos\ZHP\
~ %AppData% : C:\Documents and Settings\Eros\Dados de aplicativos\
~ %Desktop% : C:\Documents and Settings\Eros\Desktop\
~ %Favorites% : C:\Documents and Settings\Eros\Favoritos\
~ %LocalAppData% : C:\Documents and Settings\Eros\Configurações locais\Dados de aplicativos\
~ %StartMenu% : C:\Documents and Settings\Eros\Menu Iniciar\
~ %Windir% : C:\WINDOWS\
~ %System% : C:\WINDOWS\system32\

---\\ Enumeração das unidades dos discos
A: Floppy drive, Flash card reader, USB Key (Not Inserted)
C: Hard drive, Flash drive, Thumb drive (Free 102 Go of 117 Go)
D: Hard drive, Flash drive, Thumb drive (Free 115 Go of 116 Go)
E: CD-ROM drive (Not Inserted)
G: Floppy drive, Flash card reader, USB Key (Free 1 Go of 2 Go)



---\\ Estado do Centro de Segurança do Windows
~ Security Center: 40 Legitimates Filtered in 00mn 00s



---\\ Pesquisa particular de ficheiros genéricos
[MD5.FA61A19050AE14BEC1A26DE82390DD65] - (.Microsoft Corporation - Windows Explorer.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\Explorer.exe [1034240]
[MD5.398A619CE60090303042D1F8CC68F712] - (.Microsoft Corporation - Internet Extensions para Win32.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\wininet.dll [658432]
[MD5.6F7BDE7A1126DEBF0CC359A54953EFC1] - (.Microsoft Corporation - Aplicativo de logon do Windows NT.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Winlogon.exe [504320]
[MD5.5AC495F4CB807B2B98AD2AD591E6D92E] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496]
[MD5.CDFE4411A69C224BD1D11B2DA92DAC51] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\atapi.sys [95360]
[MD5.CD7D5152DF32B47F4E36F710B35AAE02] - (.Microsoft Corporation - CD-ROM File System Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744]
[MD5.AF9C19B3100FE010496B1A27181FBF72] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [49536]
[MD5.8EC0D923CD6128DE73DDA0DF082BB985] - (.Microsoft Corporation - FIPS Crypto Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\Fips.sys [35072]
[MD5.CBC3DEF409549672B915FB9403D63F74] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.27/10/2004 - 15:21:36.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [138240]
[MD5.FCAD1D4A4724B6FA6F05A5DB7F89443C] - (.Microsoft Corporation - Driver de porta i8042.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [53760]
[MD5.F8AA320C6A0409C0380E5D8A99D76EC6] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [41856]
[MD5.B5A8E215AC29D24D60B4D1250EF05ACE] - (.Microsoft Corporation - IP Network Address Translator.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [134912]
[MD5.64537AA5C003A6AFEEE1DF819062D0D1] - (.Microsoft Corporation - IPSec Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [74752]
[MD5.1FD607FC67F7F7C633C3DA65BFC53D18] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [451456]
[MD5.0C80E410CD2F47134407EE7DD19CC86B] - (.Microsoft Corporation - MBT Transport driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\netBT.sys [162816]
[MD5.B78BE402C3F63DD55521F73876951CDD] - (.Microsoft Corporation - NT File System Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\ntfs.sys [574592]
[MD5.8B225D87CBE08A5CB090BBF9F7DE1D30] - (.Microsoft Corporation - Driver de porta paralela.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80384]
[MD5.98FAEB4A4DCF812BA1C6FCA4AA3E115C] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328]
[MD5.A2CAE2C60BC37E0751EF9DDA7CEAF4AD] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.3/8/2004 - 23:01:16.) -- C:\WINDOWS\system32\Drivers\rdpdr.sys [196864]
[MD5.DDD1A19CD2EDA2D6AE5AB61BAAEB4278] - (.Microsoft Corporation - Redbook Audio Filter Driver.) (.3/8/2004 - 21:36:32.) -- C:\WINDOWS\system32\Drivers\redbook.sys [57984]
[MD5.EB2F82AAEADCC9BAAC66CBA4D714E338] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [53248]
~ Generic Processes:  Scanned in 00mn 00s



---\\ Estatuto dos ficheiros ocultos (Oculto/Total)
~ Mes images (My Pictures) : 1/2
~ Mes musiques (My Musics) : 1/534
~ Mes Videos (My Videos) : 0/0
~ Mes Favoris (My Favorites) : 1/8
~ Mes Documents (My Documents) : 1/650
~ Mon Bureau (My Desktop) : 2/40
~ Menu demarrer (Programs) : 1/36
~ Hidden Files:  Scanned in 00mn 01s



---\\ Processos lançados
[MD5.37D17AE2936867F88EB3C4CBCBC6B8A1] - (.AVAST Software - avast! Service.) -- C:\Arquivos de programas\AVAST Software\Avast\AvastSvc.exe   [50344] [PID.1744]
[MD5.55FF0FFE359702D2E2B99DF5CBB3DD06] - (.AVAST Software - avast! firewall service.) -- C:\Arquivos de programas\AVAST Software\Avast\afwServ.exe   [109048] [PID.1920]
[MD5.E87885A59FDC241B6575943A75E495D9] - (.Oracle Corporation - Java Quick Starter Service.) -- C:\Arquivos de programas\Java\jre7\bin\jqs.exe   [182696] [PID.916]
[MD5.357CDE6C24EB15888E810C6D2787C238] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 169.0.) -- C:\WINDOWS\system32\nvsvc32.exe   [155716] [PID.1340]
[MD5.379C7AC3EBCB636ECDB704E188A96A13] - (.Microsoft Corporation - Application Layer Gateway Service.) -- C:\WINDOWS\System32\alg.exe   [44544] [PID.1636]
[MD5.28FECC2B93132BD283226E61C4011171] - (.No owner - Vtune : Display Control Panel.) -- C:\Arquivos de programas\Vtune\TBPanel.exe   [2162688] [PID.2140]
[MD5.5CA0EB9538C6ACEBDC3593FC53527B9D] - (.AVAST Software - avast! Antivirus.) -- C:\Arquivos de programas\AVAST Software\Avast\AvastUI.exe   [3890208] [PID.2160]
[MD5.697E07302EC965393ABC85AD5C2C8D53] - (.Microsoft Corporation - IPoint.exe.) -- C:\Arquivos de programas\Microsoft IntelliPoint\ipoint.exe   [1797008] [PID.2168]
[MD5.EDAD4A8A1D46AFCF9E76B996D55116EB] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe   [256896] [PID.2180]
[MD5.730EAD05B1FC178629F437F8A1D76E27] - (...) -- ystem32\RunDll32.exe   [0] [PID.2228]
[MD5.A5FCD42334CCC682DA1882A54338686C] - (.Google Inc. - Google Chrome.) -- C:\Arquivos de programas\Google\Chrome\Application\chrome.exe   [860488] [PID.3016]
[MD5.79A2C7527829F70FD5E59287B700D47C] - (.Nicolas Coolman - ZHPDiag.) -- C:\Arquivos de programas\ZHPDiag\ZHPDiag.exe   [8071168] [PID.3204]
~ Processes Running:  Scanned in 00mn 00s



---\\ Internet Explorer, Gestão do Proxy (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management:  Scanned in 00mn 00s



---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas
F2 - REG:system.ini: USERINIT=C:\WINDOWS\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Keys:  Scanned in 00mn 00s



---\\ Redireção do ficheiro Hosts (01)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File:  Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 19



---\\ Barras do Internet Explorer (03))
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{01E04581-4EEE-11D0-BFE9-00AA005B4383} Chave orfã
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{0E5CBF21-D15F-11D0-8301-00AA005B4383} Chave orfã
~ Toolbar:  Scanned in 00mn 00s



---\\ Aplicações iniciadas por registo & pastas (04)
O4 - HKLM\..\Run: [Gainward] . (.No owner - Vtune : Display Control Panel.) -- C:\Arquivos de programas\Vtune\TBPanel.exe
O4 - HKLM\..\Run: [JMB36X Configure] . (.JMicron Technology Corp. - JMB36X RAID Configurer.) -- C:\WINDOWS\system32\JMRaidTool.exe
O4 - HKLM\..\Run: [AvastUI.exe] . (.AVAST Software - avast! Antivirus.) -- C:\Arquivos de programas\AVAST Software\Avast\AvastUI.exe
O4 - HKLM\..\Run: [IntelliPoint] . (.Microsoft Corporation - IPoint.exe.) -- C:\Arquivos de programas\Microsoft IntelliPoint\ipoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe   =>.Oracle Corporation
O4 - HKLM\..\Run: [NvCplDaemon] . (.NVIDIA Corporation - NVIDIA Display Properties Extension.) -- C:\WINDOWS\system32\NvCpl.dll   =>.NVIDIA Corporation
O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-21-484763869-2146948623-725345543-1004\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
~ Application:  Scanned in 00mn 00s



---\\ Boutões da barra de ferramentas principal do Internet Explorer (09)
O9 - Extra button: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft Office OneNote Internet Explorer Add-in.) -- C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Arquivos de programas\Microsoft Office\Office12\REFBARH.ICO
O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- C:\Arquivos de programas\Messenger\msmsgs.exe
~ IE Extra Buttons:  Scanned in 00mn 00s



---\\ Piratagem da Opção " Redefinir Configurações da Web " (014)
O14 - IERESET.INF: SEARCH_PAGE_URL=SEARCH_PAGE_URL="&http://home.microsoft.com/intl/br/access/allinone.asp"
O14 - IERESET.INF: SAFESITE_VALUE=SAFESITE_VALUE="search.msn.com.br"
~ IE Paramètres WEB:  Scanned in 00mn 00s



---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} ((no name)) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} ((no name)) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Objets ActiveX:  Scanned in 00mn 00s



---\\ Alteração Dominio/Clientes DNS (017)
O17 - HKLM\System\CCS\Services\Tcpip\..\{041B56BC-AF66-44DC-8BC0-601192A2936E}: DhcpNameServer = 189.4.0.157 189.4.0.152
O17 - HKLM\System\CS1\Services\Tcpip\..\{041B56BC-AF66-44DC-8BC0-601192A2936E}: DhcpNameServer = 189.4.0.157 189.4.0.152
O17 - HKLM\System\CS3\Services\Tcpip\..\{041B56BC-AF66-44DC-8BC0-601192A2936E}: DhcpNameServer = 189.4.0.157 189.4.0.152
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 189.4.0.157 189.4.0.152
~ Domain:  Scanned in 00mn 00s



---\\ Protocolo adicional (018)
O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} . (.Microsoft Corporation - WIA Scripting Layer.) -- C:\WINDOWS\system32\wiascr.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\OFFICE12\MSOXMLMF.dll  =>.Microsoft Corporation
~ Protocole Additionnel:  Scanned in 00mn 00s



---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dll
O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dll
O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agente de rede off-line.) -- C:\WINDOWS\system32\cscdll.dll
O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL de notificação do serviço de logon secu.) -- C:\WINDOWS\system32\sclgntfy.dll
O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\WlNotify.dll
O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\wlnotify.dll
~ Winlogon:  Scanned in 00mn 00s



---\\ Chave do Registo autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} . (.Microsoft Corporation - Biblioteca da interface de usuário do naveg.) -- C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Pré-carregador Browseui - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Biblioteca da interface de usuário do naveg.) -- C:\WINDOWS\system32\browseui.dll
~ STS/SSO:  Scanned in 00mn 00s



---\\ Enumeração Ativa do Ambiente de trabalho & Editor MHTML (024)
O24 - Desktop Component 0: Minha página inicial atual - file:About:Home
O24 - Desktop General: BackupWallPaper - .(...) - C:\WINDOWS\web\wallpaper\Alegria.bmp
O24 - Desktop General: WallPaper - .(...) - C:\WINDOWS\web\wallpaper\Alegria.bmp
~ Desktop Component: 4 Legitimates Filtered in 00mn 00s



---\\ Tarefas planificadas automaticamente (039)
O39 - APT:  - (..) -- C:\WINDOWS\Tasks\060184C3-9766-46a0-B258-F4518A0B2633.job   [450]
~ Scheduled Task: 6 Legitimates Filtered in 00mn 00s



---\\ Drivers lançados ao arranque do sistema (041)
O41 - Driver: (Bnbase) . (. - .) - C:\WINDOWS\system32\drivers\bnbase.sys (.not file.)
~ Drivers: 75 Legitimates Filtered in 00mn 00s



---\\ Software instalados (042)
O42 - Logiciel: BOL MA 3.00 11.00 - (...) [HKLM] -- OnlineBible
O42 - Logiciel: Enciclopédia Barsa CD - (...) [HKLM] -- BarsaCD
O42 - Logiciel: IRPF2013 - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva  - (.Receita Federal do Brasil.) [HKLM] -- IRPF2013
O42 - Logiciel: Receitanet - (.Serpro - Serviço Federal de Processamento de Dados.) [HKLM] -- ECC16E3C-16D1-4DC2-9D8A-6AC06B3005A5
O42 - Logiciel: Vtune 5.9 - (...) [HKLM] -- Vtune_is1
~ Logic: 31 Legitimates Filtered in 00mn 00s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\ForumerIT]  =>Toolbar.Forumer
[HKLM\Software\Cie Argentina]
[HKLM\Software\Quiknowledge]
[HKLM\Software\jumpshot.com]
~ Key Software: 153 Legitimates Filtered in 00mn 00s



---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 3/7/2013 - 16:44:04 - [] ----D C:\Arquivos de programas\Barsa CD
O43 - CFD: 25/9/2013 - 21:49:18 - [] ----D C:\Arquivos de programas\Longman
O43 - CFD: 24/6/2013 - 18:33:14 - [] ----D C:\Arquivos de programas\Serviços on-line
O43 - CFD: 24/6/2013 - 18:52:26 - [] ----D C:\Arquivos de programas\Vtune
O43 - CFD: 24/6/2013 - 18:32:21 - [] ----D C:\Arquivos de programas\Arquivos comuns\Serviços
O43 - CFD: 24/6/2013 - 18:40:06 - [] R---D C:\Documents and Settings\Eros\Menu Iniciar\Programas\Acessórios
O43 - CFD: 21/6/2014 - 10:37:41 - [] R---D C:\Documents and Settings\Eros\Menu Iniciar\Programas\Inicializar
O43 - CFD: 25/9/2013 - 21:53:21 - [] ----D C:\Documents and Settings\Eros\Menu Iniciar\Programas\Longman
O43 - CFD: 23/4/2014 - 05:03:58 - [] ----D C:\Documents and Settings\Eros\Menu Iniciar\Programas\Programas RFB2013
~ Program Folder: 86 Legitimates Filtered in 00mn 00s



---\\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044)
O44 - LFC:[MD5.0DC5AF80D059DEC792B665ED598C6567] - 18/6/2014 - 19:45:01 ---A- . (.SQLite Development Team - SQLite Dynamic Link Library (No TCL).) -- C:\WINDOWS\system32\sqlite3.dll   [536576]
O44 - LFC:[MD5.667BA88F645BBEE710315967236F98C2] - 18/6/2014 - 19:52:07 ---A- . (...) -- C:\Atalho para Disco local (D).lnk   [275]
O44 - LFC:[MD5.A2CE7EAFA03686B74D8E3AFC096242F8] - 18/6/2014 - 21:04:31 ---A- . (...) -- C:\Atalho (2) para Disco local (D).lnk   [275]
O44 - LFC:[MD5.B4D2716BD9F9212FF59B136E6AB790F1] - 23/6/2014 - 21:14:25 ---A- . (...) -- C:\zoek-results2014-06-24-001425.log   [9478]
O44 - LFC:[MD5.D3B81A833A790D041A41C793D3590C78] - 23/6/2014 - 23:19:35 ---A- . (...) -- C:\zoek-results.log   [1195]
O44 - LFC:[MD5.DC46C258E5AC3B22C00A0F00ED4A8D38] - 24/6/2014 - 19:11:11 ---A- . (...) -- C:\WINDOWS\wiadebug.log   [159]
O44 - LFC:[MD5.3A07CC11AC48F56C7E18DDAA3679D4FE] - 24/6/2014 - 19:11:11 ---A- . (...) -- C:\WINDOWS\wiaservc.log   [49]
O44 - LFC:[MD5.9D40A5E2E0D3D99C53B7EC71632EA559] - 24/6/2014 - 19:51:34 ---A- . (...) -- C:\WINDOWS\DFC.INI   [558]
~ Files: 23 Legitimates Filtered in 00mn 04s



---\\ Operações e funções ao arranque do Windows Explorer (046)
O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll
~ ShellExecuteHooks:  Scanned in 00mn 00s



---\\ Image File Execution Options (IFEO) (O50)
O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d
~ IFEO:  Scanned in 00mn 00s



---\\ Chave do registo Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{61ae5d0d-100a-11e3-8aba-000000000010}\AutoRun\command. (...) -- F:\urDrive.exe (.not file.)
~ Keys:  Scanned in 00mn 00s



---\\ Enumeração das chaves do registo PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoInstrumentation"=1
~ MWPE Keys: 2 Legitimates Filtered in 00mn 00s



---\\ Lista dos drivers do sistema (SDL) (O58)
O58 - SDL:5/10/2005 - 14:21:10 R--A- . (.Analog Devices, Inc. - High Definition Audio Function Driver(Release Candidate 1).) -- C:\WINDOWS\system32\Drivers\ADIHdAud.sys   [141312]
O58 - SDL:12/8/2004 - 23:56:20 R--A- . (.No owner - ATK0110 ACPI Utility.) -- C:\WINDOWS\system32\Drivers\ASACPI.sys   [5810]
O58 - SDL:27/4/2004 - 12:26:48 ---A- . (...) -- C:\WINDOWS\system32\Drivers\ASUSHWIO.SYS   [5824]
O58 - SDL:27/5/2014 - 19:45:07 ---A- . (...) -- C:\WINDOWS\system32\Drivers\aswHwid.sys   [24184]  =>.ALWIL Software
O58 - SDL:27/5/2014 - 19:44:56 ---A- . (.ALWIL Software - avast! Filtering NDIS driver.) -- C:\WINDOWS\system32\Drivers\aswNdis.sys   [12112]
O58 - SDL:27/5/2014 - 19:45:07 ---A- . (...) -- C:\WINDOWS\system32\Drivers\aswRvrt.sys   [49944]  =>.ALWIL Software
O58 - SDL:27/5/2014 - 19:45:07 ---A- . (...) -- C:\WINDOWS\system32\Drivers\aswVmm.sys   [180632]  =>.ALWIL Software
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (.RAVISENT Technologies Inc. - CineMaster C 1.2 WDM Main Driver.) -- C:\WINDOWS\system32\Drivers\cinemst2.sys   [262528]
O58 - SDL:27/10/2004 - 15:21:36 ----- . (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) -- C:\WINDOWS\system32\Drivers\Hdaudbus.sys   [138240]
O58 - SDL:27/10/2004 - 15:21:30 ----- . (.Windows (R) Server 2003 DDK provider - High Definition Audio Function Driver v1.0a.) -- C:\WINDOWS\system32\Drivers\Hdaudio.sys   [145920]
O58 - SDL:3/8/2004 - 22:41:40 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\mtlmnt5.sys   [126686]
O58 - SDL:3/8/2004 - 22:41:38 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\mtlstrm.sys   [1309184]
O58 - SDL:3/8/2004 - 22:29:38 ----- . (.Matrox Graphics Inc. - Matrox Parhelia Miniport Driver.) -- C:\WINDOWS\system32\Drivers\mtxparhm.sys   [452736]
O58 - SDL:3/8/2004 - 22:41:40 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\ntmtlfax.sys   [180360]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (.Parallel Technologies, Inc. - Parallel Technologies DirectParallel IO Library.) -- C:\WINDOWS\system32\Drivers\ptilink.sys   [17792]
O58 - SDL:3/8/2004 - 22:41:40 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\recagent.sys   [13776]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\Drivers\secdrv.sys   [27440]
O58 - SDL:11/8/2005 - 10:49:28 R--A- . (.Sensaura - Sensaura WDM 3D Audio Driver.) -- C:\WINDOWS\system32\Drivers\senfilt.sys   [393088]
O58 - SDL:3/8/2004 - 22:41:42 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\slnt7554.sys   [129535]
O58 - SDL:3/8/2004 - 22:41:44 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\slntamr.sys   [404990]
O58 - SDL:3/8/2004 - 22:41:46 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\slnthal.sys   [95424]
O58 - SDL:3/8/2004 - 22:41:46 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\slwdmsup.sys   [13240]
O58 - SDL:16/3/2007 - 10:11:38 ---A- . (.Windows (R) 2000 DDK provider - Display Control Program.) -- C:\WINDOWS\system32\Drivers\TBPanel.sys   [12256]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (.RAVISENT Technologies Inc. - CineMaster C WDM DVD Minidriver.) -- C:\WINDOWS\system32\Drivers\vdmindvd.sys   [58112]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ansi.sys   [9032]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\country.sys   [27097]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\himem.sys   [4896]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\key01.sys   [42809]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\keyboard.sys   [42537]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos.sys   [27900]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos404.sys   [29146]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos411.sys   [29370]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos412.sys   [29274]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos804.sys   [29146]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio.sys   [33984]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio404.sys   [34560]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio411.sys   [35648]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio412.sys   [35424]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio804.sys   [34560]
~ Drivers: 97 Legitimates Filtered in 00mn 02s



---\\ Lista das ferramentas de remoção de vírus (LAT) (063)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1  =>.Nicolas Coolman
~ ADS:  Scanned in 00mn 00s



---\\ Lista dos serviços Legacy du registo (064)
O64 - Services: CurCS - 27/5/2014 - C:\WINDOWS\system32\drivers\aswHwid.sys (aswHwid) .(...) - LEGACY_ASWHWID
~ Legacy: 117 Legitimates Filtered in 00mn 00s



---\\ Associações Shell Spawning (O67)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 10 Legitimates Filtered in 00mn 00s



---\\ Menu de inicialização Internet (068)
O68 - StartMenuInternet: <chrome.exe> <>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Arquivos de programas\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Arquivos de programas\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- c:\arquivos de programas\internet explorer\iexplore.exe
~ Keys:  Scanned in 00mn 00s



---\\ Pesquisa de infeção nos navegadores da Internet (SBI) (069)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Keys:  Scanned in 00mn 00s



---\\ Pesquisa adicional à raiz do sistema (radicular) (SPRF) (O84)
[MD5.333A79F1A3964AF2A17AB2C88AF677DE] [SPRF][13/4/2014] (.No owner - Uninstall Receitanet 1.04.) -- C:\Documents and Settings\Eros\Desktop\Desinstalador.exe   [1605083]
[MD5.BDB0B87D300B3AEB98797FF0A3C54924] [SPRF][9/11/2010] (...) -- C:\Documents and Settings\Eros\Desktop\FSCapture.exe   [1111552]
[MD5.E3C43F58C5299EB2F2C0617A9F205946] [SPRF][10/5/2013] (...) -- C:\Documents and Settings\Eros\Desktop\receitanet.dat   [42]
[MD5.7EEBD2FC5E927CDA3ACC1CFEA699D8FE] [SPRF][10/5/2013] (...) -- C:\Documents and Settings\Eros\Desktop\receitanet.exe   [452096]
~ Files: 4 Legitimates Filtered in 00mn 00s



---\\ Estado general dos serviços não Microsoft (EGS) (SR=Executados, SS=Parados)
SS - | Demand 2/3/2006 225280 |  (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\system32\dmadmin.exe
SS - | Auto 8/6/2014 116648 |  (gupdate) . (.Google Inc..) - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe
SS - | Demand 8/6/2014 116648 |  (gupdatem) . (.Google Inc..) - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe
SR - | Auto 27/5/2014 50344 |  (avast! Antivirus) . (.AVAST Software.) - C:\Arquivos de programas\AVAST Software\Avast\AvastSvc.exe
SR - | Auto 27/5/2014 109048 |  (avast! Firewall) . (.AVAST Software.) - C:\Arquivos de programas\AVAST Software\Avast\afwServ.exe
SR - | Auto 21/6/2014 182696 |  (JavaQuickStarterService) . (.Oracle Corporation.) - C:\Arquivos de programas\Java\jre7\bin\jqs.exe
SR - | Auto 28/11/2007 155716 |  (NVSvc) . (.NVIDIA Corporation.) - C:\WINDOWS\system32\nvsvc32.exe
~ Services:  Scanned in 00mn 05s



---\\ Scâner Aditional (088)
Database Version : 13026 - (23/6/2014)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 0
Dossiers trouvés  (Folders found) : 0
Fichiers trouvés  (Files found) : 1

[HKCU\Software\ForumerIT]   =>Toolbar.Forumer^
~ Additionnel Scan: 121182 Items scanned in 00mn 23s



---\\ Informações complémentaires do módulos
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>.Internet Explorer, Gestão do Proxy (R5)
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>.Barras do Internet Explorer (03))
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>.Aplicações iniciadas por registo & pastas (04)
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>.Image File Execution Options (IFEO) (O50)
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>.Chave do registo Shell MountPoints2 (MPKS) (O51)
~ AMI: 5 Legitimates Filtered in 00mn 00s



---\\ Sumário das deteções encontradas na sua estação
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>Toolbar.Forumer
~ MSI: 1 link(s) detected in 00mn 00s



~ 634 Legitimates filtered by white list
End of the scan (451 lines in 00mn 58s)(0)

 Há programas desnecessários iniciando junto com o Windows, o que torna o seu PC mais lento. Para corrigir isto, siga as dicas deste tutorial:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

De preferência deixe apenas os programas de segurança (anti-vírus/anti-spywares/firewall) iniciarem junto com o Windows.

Use também o programa Ccleaner, indicado neste tutorial acima, para fazer uma limpeza e otimização do PC.
___________________________________________________________________________

 Selecione e copie todo o texto destacado em vermelho que te passei.

_____________________________________________________________________________________________________________

 Vá no menu: Iniciar > Todos os programas > ZHP > Clique com o botão direito do mouse sobre o Zhpfix e escolha a opção de Executar como administrador > Clique em Importação > Clique no botão GO > Clique em Oui > Caso queira que os arquivos da lixeira sejam excluídos clique em Oui novamente > Um relatório aparecerá no bloco de notas.

Copie este relatório e poste em sua próxima resposta.

Olá Power Max,

Durante este tempo em que tem me ajudado eu quase não podia teclar, pois, o Sweet Page deixou o meu computador louco e as vezes para dar um comando qual você me pedia eu tinha que martelar no teclado de 3 á 4 vezes por letra.
Hoje meu computador já está bem melhor.
Estou te agradecendo pelo bem que me tem feito. Deus cooperará com você em tudo que fizer de bom para te prosperar.
Seja sempre a benção que tem sido a todos.

Em adiantado meu muito obrigado,


Eros

Fico feliz que o PC esteja melhor. Já estamos quase terminando a limpeza, siga por gentileza as dicas que te passei na resposta acima e poste o relatório pedido.

Rapport de ZHPFix 2014.4.13.3 par Nicolas Coolman, Update du 13/04/2014
Fichier d'export Registre :
Run by Eros at 24/6/2014 20:53:42
High Elevated Privileges : OK
Windows XP Home Edition Service Pack 2 (Build 2600)

Reciclagem vazia (00mn 02s)
Reparação de atalhos do navegador

========== Chaves do Registo ==========
ELIMINÉ:³ HKCU\Software\ForumerIT
ELIMINÉ:³ HKLM\Software\Quiknowledge

========== Valores do Registo ==========
ProxyFix : Configuração proxy removida com sucesso
ELIMINÉ ProxyServer Value
ELIMINÉ ProxyEnable Value
ELIMINÉ EnableHttp1_1 Value
ELIMINÉ ProxyHttp1.1 Value
ELIMINÉ ProxyOverride Value

========== Pastas ==========
Nenhuma pasta CLSID local utilizador vazia

========== Ficheiros ==========
ELIMINA REINICIAR: c:\windows\tasks\060184c3-9766-46a0-b258-f4518a0b2633.job
ELIMINÉ Temporários windows (21) (104.574.813 octets)
ELIMINÉ Flash Cookies (0) (0 octets)

========== Restauração Sistema ==========
Nenhum ponto de restauro do sistema foi criado


========== Recapitulativo ==========
2 : Chaves do Registo
6 : Valores do Registo
1 : Pastas
3 : Ficheiros
1 : Restauração Sistema


End of clean in 00mn 34s

========== Caminho do ficheiro do relatório ==========
\ZHP\ZHPFix[R1].txt - 24/6/2014 20:53:44 [1244]