Retirar Start Web Search do meu Computador

Olá ; Venho através deste site q por sinal so vjo elogios,venho solicitar a ajuda de vcs com este indesejável programinha q estar me tirando do serio.Preciso remover do meu computador o start web search. Desde já agradeço pela ajuda de vcs.

Olá Alfeu.

Baixe o programa Adwcleaner clicando no link abaixo e depois clique no botão Download Now @BleepingComputer:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Para executar corretamente o AdwCleaner é só seguir as dicas deste tutorial:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

* Na sua próxima resposta poste o log (relatório) do Adwcleaner que estará em C:\AdwCleaner\AdwCleaner[S0].txt

Ficamos na espera.

Power Max escreveu:Olá Alfeu.

Baixe o programa Adwcleaner clicando no link abaixo e depois clique no botão Download Now @BleepingComputer:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Para executar corretamente o AdwCleaner é só seguir as dicas deste tutorial:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

* Na sua próxima resposta poste o log (relatório) do Adwcleaner que estará em C:\AdwCleaner\AdwCleaner[S0].txt

Ficamos na espera.

Aqui estar o Relatório.




# AdwCleaner v3.216 - Relatório criado 24/07/2014 às 13:05:10
# Atualizado 17/07/2014 por Xplode
# Sistema Operacional : Windows 7 Professional Service Pack 1 (32 bits)
# Usuário : cliente - CLIENTE-PC
# Executando de : C:\Users\cliente\Downloads\AdwCleaner.exe
# Opção : Examinar

***** [ Serviços ] *****


***** [ Arquivos / Pastas ] *****


***** [ Atalhos ] *****


***** [ Registro ] *****


***** [ Navegadores ] *****

-\\ Internet Explorer v8.0.7601.17514


-\\ Google Chrome v35.0.1916.153

[ Arquivo : C:\Users\cliente\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Encontrada [Startup_urls] : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

*************************

AdwCleaner[R0].txt - [792 octets] - [24/07/2014 13:05:10]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [851 octets] ##########

Falta você clicar no botão Limpar e seguir os outros procedimentos indicados no tutorial que te passei. Depois disto poste o novo relatório que o AdwCleaner irá criar aqui no seu tópico.

Aki estar o relatório após o computador ser reiniciado. Lembrando q logo em seguida o istart.webssearches volta aparecer na aba do navegador. Pq já tinha feito este procedimento antes.



# AdwCleaner v3.216 - Relatório criado 24/07/2014 às 13:52:53
# Atualizado 17/07/2014 por Xplode
# Sistema Operacional : Windows 7 Professional Service Pack 1 (32 bits)
# Usuário : cliente - CLIENTE-PC
# Executando de : C:\Users\cliente\Downloads\AdwCleaner.exe
# Opção : Limpar

***** [ Serviços ] *****


***** [ Arquivos / Pastas ] *****


***** [ Atalhos ] *****


***** [ Registro ] *****


***** [ Navegadores ] *****

-\\ Internet Explorer v8.0.7601.17514


-\\ Google Chrome v35.0.1916.153

[ Arquivo : C:\Users\cliente\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deletedo [Startup_urls] : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

*************************

AdwCleaner[R0].txt - [930 octets] - [24/07/2014 13:05:10]
AdwCleaner[R1].txt - [1048 octets] - [24/07/2014 13:51:32]
AdwCleaner[S0].txt - [985 octets] - [24/07/2014 13:06:25]
AdwCleaner[S1].txt - [966 octets] - [24/07/2014 13:52:53]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1025 octets] ##########

Desative temporariamente seu antivírus para evitar conflitos.

* Acesse este link abaixo e clique no primeiro botão da esquerda que é o botão Download Zoek.exe:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Para executá-lo corretamente siga as dicas deste tutorial:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

* Assim que ele concluir a limpeza dos problemas acesse o log (relatório) do Zoek que estará em C:\zoek-results.txt e copie todo seu conteúdo e poste em sua próxima resposta.

Zoek.exe v5.0.0.0 Updated 24-07-2014
Tool run by cliente on 25-Jul-14 at 2:05:27,87.
Microsoft Windows 7 Professional 6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\cliente\Downloads\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

25-Jul-14 2:06:08 AM Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-2346172771-2055397070-329482368-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E627DC4B-8C04-4234-A2D4-1D634EE01C41} deleted successfully

==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Alfeu-Pc\AppData\Roaming\Mozilla\Firefox\Profiles\adjfj1yt.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");

Added to C:\Users\Alfeu-Pc\AppData\Roaming\Mozilla\Firefox\Profiles\adjfj1yt.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

ProfilePath: C:\Users\Alfeu-Pc\AppData\Roaming\Mozilla\Firefox\Profiles\adjfj1yt.default

user.js not found
---- Lines browser.startup.page removed from prefs.js ----
user_pref("browser.startup.page", 1);
---- FireFox user.js and prefs.js backups ----

prefs__0212_.backup

==== Deleting Files \ Folders ======================

C:\Users\cliente\AppData\LocalLow\{11A52A79-528A-8DAD-5897-CAF80EDA6738} deleted
C:\Users\cliente\AppData\LocalLow\{1867EBBC-8784-AB13-759C-115D38A69799} deleted
C:\Users\cliente\AppData\LocalLow\{801CC7F1-A3D0-4408-5DF5-AD5D2D744DEA} deleted
C:\Users\cliente\AppData\LocalLow\{AB55C53F-16E6-6CF0-AF2D-6DC3EA48D483} deleted
C:\Users\cliente\AppData\LocalLow\{C65F1198-1015-72F4-8207-58CD6B1DA39C} deleted
C:\Users\cliente\AppData\LocalLow\{D7E3D9C8-4371-9A2B-4980-B5BBE247CEBD} deleted
C:\Users\cliente\AppData\LocalLow\{F046CA46-149A-BCC1-38A9-A3B1E893D56E} deleted
C:\PROGRA~2\6b18dbb6a02c25b5 deleted
C:\PROGRA~2\YouTuAdBlocker deleted
C:\PROGRA~2\AllSSaver deleted
C:\PROGRA~2\SihopDroup deleted
C:\mso4D1A.tmp deleted
C:\Users\cliente\AppData\Roaming\GetRightToGo deleted
C:\PROGRA~2\FileSplitUpLoad.dll deleted
C:\PROGRA~2\boost_interprocess deleted
C:\PROGRA~2\SetApp deleted
C:\PROGRA~2\InstallMate deleted
C:\Users\cliente\AppData\Local\BITE64F.tmp deleted
C:\Users\cliente\Searches deleted
C:\Users\cliente\Downloads\SoftonicDownloader_para_revealer-keylogger.exe deleted
C:\user.js deleted
C:\Windows\Launcher.exe deleted
C:\Windows\system32\dfrg deleted
C:\Users\cliente\AppData\Roaming\unins000.exe deleted
"C:\Windows\Installer\34414.msi" deleted
"C:\Users\cliente\AppData\Local\{25BBA8D8-5308-42CA-91A6-FF40F5A9F9C7}" deleted
"C:\Users\cliente\AppData\Local\{277D381F-AACD-4607-9A09-2EE2DABCA6B5}" deleted
"C:\Users\cliente\AppData\Local\{AB26F393-6F37-422B-A78B-993B68FBC032}" deleted
"C:\PROGRA~2\4A843558CA1EBC5F00004A83EADBC343\4A843558CA1EBC5F00004A83EADBC343.ico" deleted
"C:\PROGRA~2\ilnfgeajefoipalhicmamalakboljbll\ilnfgeajefoipalhicmamalakboljbll.crx" deleted
"C:\PROGRA~2\ilnfgeajefoipalhicmamalakboljbll\update.xml" deleted
"C:\PROGRA~2\pmkffiodnajoombhhabjbilmimkdbfja\pmkffiodnajoombhhabjbilmimkdbfja.crx" deleted
"C:\PROGRA~2\pmkffiodnajoombhhabjbilmimkdbfja\update.xml" deleted
"C:\PROGRA~2\4A843558CA1EBC5F00004A83EADBC343" deleted
"C:\PROGRA~2\ilnfgeajefoipalhicmamalakboljbll" deleted
"C:\PROGRA~2\pmkffiodnajoombhhabjbilmimkdbfja" deleted

==== Firefox Extensions ======================

ProfilePath: C:\Users\Alfeu-Pc\AppData\Roaming\Mozilla\Firefox\Profiles\adjfj1yt.default
- HomeTab - %ProfilePath%\extensions\{f9e764e5-f6cd-4643-8a4b-30d84c958e05}

AppDir: C:\Program Files\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================


==== Deleted Firefox Extensions ======================

C:\Users\Alfeu-Pc\AppData\Roaming\Mozilla\Firefox\Profiles\adjfj1yt.default\extensions\{f9e764e5-f6cd-4643-8a4b-30d84c958e05} deleted

==== Chrome Look ======================

websAvvEa - Administrador\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\cokeiljhnlocillecdbkagplifjkinif
webSaeve - Administrador\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\fmoplincmfccgajpmdhbamgpaokfkncg
weabSiave - Administrador\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\nfpkkefekchinnmekdmijcgigccflpdl
websAvvEa - Administrador\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\cokeiljhnlocillecdbkagplifjkinif
webSaeve - Administrador\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\fmoplincmfccgajpmdhbamgpaokfkncg
weabSiave - Administrador\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\nfpkkefekchinnmekdmijcgigccflpdl
websAvvEa - cliente\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\cokeiljhnlocillecdbkagplifjkinif
webSaeve - cliente\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\fmoplincmfccgajpmdhbamgpaokfkncg
weabSiave - cliente\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\nfpkkefekchinnmekdmijcgigccflpdl
Google Drive - cliente\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf
YouTube - cliente\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Google Search - cliente\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
GBBD Banco do Brasil - cliente\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkeabchhfifpaaoefpockjhaphjmoapp
Google Wallet - cliente\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Gmail - cliente\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia
websAvvEa - cliente\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\cokeiljhnlocillecdbkagplifjkinif
webSaeve - cliente\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\fmoplincmfccgajpmdhbamgpaokfkncg
weabSiave - cliente\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\nfpkkefekchinnmekdmijcgigccflpdl
websAvvEa - Convidado\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\cokeiljhnlocillecdbkagplifjkinif
webSaeve - Convidado\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\fmoplincmfccgajpmdhbamgpaokfkncg
weabSiave - Convidado\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\nfpkkefekchinnmekdmijcgigccflpdl
websAvvEa - Convidado\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\cokeiljhnlocillecdbkagplifjkinif
webSaeve - Convidado\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\fmoplincmfccgajpmdhbamgpaokfkncg
weabSiave - Convidado\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\nfpkkefekchinnmekdmijcgigccflpdl

==== Chrome Fix ======================

C:\Users\Administrador\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\cokeiljhnlocillecdbkagplifjkinif deleted successfully
C:\Users\Administrador\AppData\Local\Google\Chrome\User Data\Default\Extensions\cokeiljhnlocillecdbkagplifjkinif deleted successfully
C:\Users\Administrador\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\cokeiljhnlocillecdbkagplifjkinif deleted successfully
C:\Users\cliente\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\cokeiljhnlocillecdbkagplifjkinif deleted successfully
C:\Users\cliente\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\cokeiljhnlocillecdbkagplifjkinif deleted successfully
C:\Users\Convidado\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\cokeiljhnlocillecdbkagplifjkinif deleted successfully
C:\Users\Convidado\AppData\Local\Google\Chrome\User Data\Default\Extensions\cokeiljhnlocillecdbkagplifjkinif deleted successfully
C:\Users\Convidado\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\cokeiljhnlocillecdbkagplifjkinif deleted successfully
C:\Users\Administrador\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\fmoplincmfccgajpmdhbamgpaokfkncg deleted successfully
C:\Users\Administrador\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmoplincmfccgajpmdhbamgpaokfkncg deleted successfully
C:\Users\Administrador\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\fmoplincmfccgajpmdhbamgpaokfkncg deleted successfully
C:\Users\cliente\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\fmoplincmfccgajpmdhbamgpaokfkncg deleted successfully
C:\Users\cliente\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\fmoplincmfccgajpmdhbamgpaokfkncg deleted successfully
C:\Users\Convidado\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\fmoplincmfccgajpmdhbamgpaokfkncg deleted successfully
C:\Users\Convidado\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmoplincmfccgajpmdhbamgpaokfkncg deleted successfully
C:\Users\Convidado\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\fmoplincmfccgajpmdhbamgpaokfkncg deleted successfully
C:\Users\Administrador\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\nfpkkefekchinnmekdmijcgigccflpdl deleted successfully
C:\Users\Administrador\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfpkkefekchinnmekdmijcgigccflpdl deleted successfully
C:\Users\Administrador\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\nfpkkefekchinnmekdmijcgigccflpdl deleted successfully
C:\Users\cliente\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\nfpkkefekchinnmekdmijcgigccflpdl deleted successfully
C:\Users\cliente\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\nfpkkefekchinnmekdmijcgigccflpdl deleted successfully
C:\Users\Convidado\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\nfpkkefekchinnmekdmijcgigccflpdl deleted successfully
C:\Users\Convidado\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfpkkefekchinnmekdmijcgigccflpdl deleted successfully
C:\Users\Convidado\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\nfpkkefekchinnmekdmijcgigccflpdl deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com/"
"Default_Page_URL"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://www.google.com/"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6EFD4CC9-F9B4-04E4-E891-6184C5779252} Unknown Url="Not_Found"

==== Reset Google Chrome ======================

C:\Users\cliente\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\cliente\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-2346172771-2055397070-329482368-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6EFD4CC9-F9B4-04E4-E891-6184C5779252} deleted successfully

==== Deleting CLSID Registry Values ======================


==== shortcuts on Users Desktops ======================

C:\Users\cliente\Desktop\Downloads - Atalho.lnk - C:\Users\cliente\Downloads
C:\Users\cliente\Desktop\Enternet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\cliente\Desktop\Microsoft Office Excel 2007.lnk - C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
C:\Users\cliente\Desktop\K-Lite Codec Pack\Media Player Classic.lnk - C:\Program Files\K-Lite Codec Pack\Media Player Classic\mpc-hc.exe
C:\Users\cliente\Desktop\K-Lite Codec Pack\Codec Tweak Tool\All options.lnk - C:\Program Files\K-Lite Codec Pack\Tools\CodecTweakTool.exe
C:\Users\cliente\Desktop\K-Lite Codec Pack\Codec Tweak Tool\Generate log with system information.lnk - C:\Program Files\K-Lite Codec Pack\Tools\CodecTweakTool.exe /showsections=generate_log
C:\Users\cliente\Desktop\K-Lite Codec Pack\Codec Tweak Tool\Manage ACM and VFW codecs.lnk - C:\Program Files\K-Lite Codec Pack\Tools\CodecTweakTool.exe /showsections=codec_management
C:\Users\cliente\Desktop\K-Lite Codec Pack\Codec Tweak Tool\Manage DirectShow filters.lnk - C:\Program Files\K-Lite Codec Pack\Tools\CodecTweakTool.exe /showsections=dsfilter_management
C:\Users\cliente\Desktop\K-Lite Codec Pack\Codec Tweak Tool\Manage preferred DirectShow source filters.lnk - C:\Program Files\K-Lite Codec Pack\Tools\CodecTweakTool.exe /showsections=sourcefilters
C:\Users\cliente\Desktop\K-Lite Codec Pack\Configuration\DirectVobSub.lnk - C:\Windows\System32\rundll32.exe "C:\Program Files\K-Lite Codec Pack\Filters\vsfilter.dll",DirectVobSub
C:\Users\cliente\Desktop\K-Lite Codec Pack\Configuration\ffdshow audio decoder.lnk - C:\Windows\System32\rundll32.exe "C:\Program Files\K-Lite Codec Pack\ffdshow\ffdshow.ax",configureAudio
C:\Users\cliente\Desktop\K-Lite Codec Pack\Configuration\ffdshow DXVA video decoder.lnk - C:\Windows\System32\rundll32.exe "C:\Program Files\K-Lite Codec Pack\ffdshow\ffdshow.ax",configureDXVA
C:\Users\cliente\Desktop\K-Lite Codec Pack\Configuration\ffdshow video decoder.lnk - C:\Windows\System32\rundll32.exe "C:\Program Files\K-Lite Codec Pack\ffdshow\ffdshow.ax",configure
C:\Users\cliente\Desktop\K-Lite Codec Pack\Configuration\Haali Media Splitter.lnk - C:\Windows\System32\rundll32.exe "C:\Program Files\K-Lite Codec Pack\Filters\Haali\splitter.ax",Configure
C:\Users\cliente\Desktop\K-Lite Codec Pack\Configuration\Haali video renderer.lnk - C:\Program Files\K-Lite Codec Pack\Tools\dsconfig.exe {760A8F35-97E7-479D-AAF5-DA9EFF95D751}
C:\Users\cliente\Desktop\K-Lite Codec Pack\Configuration\LAV Audio.lnk - C:\Windows\system32\rundll32.exe "C:\Program Files\K-Lite Codec Pack\Filters\LAV\lavaudio.ax",OpenConfiguration
C:\Users\cliente\Desktop\K-Lite Codec Pack\Configuration\LAV Splitter.lnk - C:\Windows\system32\rundll32.exe "C:\Program Files\K-Lite Codec Pack\Filters\LAV\lavsplitter.ax",OpenConfiguration
C:\Users\cliente\Desktop\K-Lite Codec Pack\Configuration\LAV Video.lnk - C:\Windows\system32\rundll32.exe "C:\Program Files\K-Lite Codec Pack\Filters\LAV\lavvideo.ax",OpenConfiguration
C:\Users\cliente\Desktop\K-Lite Codec Pack\Configuration\madFLAC.lnk - C:\Program Files\K-Lite Codec Pack\Tools\dsconfig.exe {6B257121-CBB6-46B3-ABFA-B14DFA98C4A6}
C:\Users\cliente\Desktop\K-Lite Codec Pack\Configuration\Reset to recommended settings.lnk - C:\Program Files\K-Lite Codec Pack\Tools\CodecTweakTool.exe /showsections=reset_settings
C:\Users\cliente\Desktop\K-Lite Codec Pack\Configuration\VP7 decoder.lnk - C:\Program Files\K-Lite Codec Pack\Tools\dsconfig.exe {C204438D-6E1A-4309-B09C-0C0F749863AF}
C:\Users\cliente\Desktop\K-Lite Codec Pack\Help\Frequently Asked Questions.lnk - C:\Program Files\K-Lite Codec Pack\Info\faq.htm
C:\Users\cliente\Desktop\K-Lite Codec Pack\Tools\Codec Tweak Tool.lnk - C:\Program Files\K-Lite Codec Pack\Tools\CodecTweakTool.exe
C:\Users\cliente\Desktop\K-Lite Codec Pack\Tools\GraphStudioNext.lnk - C:\Program Files\K-Lite Codec Pack\Tools\GraphStudioNext.exe
C:\Users\cliente\Desktop\K-Lite Codec Pack\Tools\MediaInfo.lnk - C:\Program Files\K-Lite Codec Pack\Tools\mediainfo.exe
C:\Users\cliente\Desktop\K-Lite Codec Pack\Tools\VobSubStrip.lnk - C:\Program Files\K-Lite Codec Pack\Tools\VobSubStrip.exe
C:\Users\cliente\Desktop\K-Lite Codec Pack\Tools\Win7DSFilterTweaker.lnk - C:\Program Files\K-Lite Codec Pack\Tools\Win7DSFilterTweaker.exe

==== shortcuts on All Users Desktop ======================

C:\Users\Public\Desktop\CCleaner.lnk - C:\Program Files\CCleaner\CCleaner.exe
C:\Users\Public\Desktop\Foxit Reader 5.1.lnk - C:\Program Files\Foxit Software\Foxit Reader\Foxit Reader.exe
C:\Users\Public\Desktop\Google Chrome.lnk - C:\Program Files\Google\Chrome\Application
C:\Users\Public\Desktop\HD VDeck.lnk - C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe
C:\Users\Public\Desktop\iTunes.lnk - C:\Program Files\iTunes\iTunes.exe
C:\Users\Public\Desktop\Media Player Classic.lnk - C:\Program Files\K-Lite Codec Pack\Media Player Classic\mpc-hc.exe
C:\Users\Public\Desktop\Nero StartSmart.lnk - C:\Program Files\Nero\Nero 7\Nero StartSmart\NeroStartSmart.exe -ScParameter=8
C:\Users\Public\Desktop\RealFlight G2 Lite.lnk - C:\Program Files\RealFlight\RealFlight.exe
C:\Users\Public\Desktop\Skype.lnk - C:\Windows\Installer\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}\SkypeIcon.exe
C:\Users\Public\Desktop\Sound Forge 9.0.lnk - C:\Program Files\Sony\Sound Forge 9.0\Forge90.exe

==== shortcuts in Users Start Menu ======================

C:\Users\cliente\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\cliente\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk - C:\Program Files\Internet Explorer\iexplore.exe

==== shortcuts in All Users Start Menu ======================

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner.lnk - C:\Program Files\CCleaner\CCleaner.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\Uninstall CCleaner.lnk - C:\Program Files\CCleaner\uninst.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk - C:\Program Files\Google\Chrome\Application\chrome.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\About Java.lnk - C:\Program Files\Java\jre7\bin\javacpl.exe -tab about
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Check For Updates.lnk - C:\Program Files\Java\jre7\bin\javacpl.exe -tab update
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Configure Java.lnk - C:\Program Files\Java\jre7\bin\javacpl.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.lnk -
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.lnk -

==== shortcuts in Quick Launch ======================

C:\Users\Alfeu-Pc\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Alfeu-Pc\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Alfeu-Pc\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Alfeu-Pc\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk - C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Alfeu-Pc\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk - C:\Windows\explorer.exe
C:\Users\Alfeu-Pc\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk - C:\Program Files\Windows Media Player\wmplayer.exe /prefetch:1
C:\Users\cliente\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Foxit Reader 5.1.lnk - C:\Program Files\Foxit Software\Foxit Reader\Foxit Reader.exe
C:\Users\cliente\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Users\cliente\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\cliente\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart.lnk - C:\Program Files\Nero\Nero 7\Nero StartSmart\NeroStartSmart.exe -ScParameter=8
C:\Users\cliente\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\cliente\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\cliente\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\7e4dca80246863e3\pinned.lnk - C:\Windows\system32\control.exe
C:\Users\cliente\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Calculator.lnk - C:\Windows\system32\calc.exe
C:\Users\cliente\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Paint.lnk - C:\Windows\system32\mspaint.exe
C:\Users\cliente\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\cliente\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Users\cliente\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Office Word 2007.lnk - C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
C:\Users\cliente\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Sound Forge 9.0.lnk - C:\Program Files\Sony\Sound Forge 9.0\Forge90.exe
C:\Users\cliente\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk - C:\Windows\explorer.exe
C:\Users\cliente\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk - C:\Program Files\Windows Media Player\wmplayer.exe /prefetch:1
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -

==== Reset IE Proxy ======================

Value(s) before fix:
"ProxyEnable"=dword:00000000

Value(s) after fix:
"ProxyEnable"=dword:00000000

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\F60730A4A66673047777F5728467D401 deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\1bf6dd0b-3016-43cc-a10e-ce829942fefa deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\32494d7b-0d64-4b3d-8e85-01b31adf860e deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\32933b52-7c56-4bde-9669-1ae356321939 deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\6f2ce0c7-6aef-447c-9184-a10cadb54b3c deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\a6efea02-cb60-4b5a-9f73-174c09120c91 deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\ce0f8f1b-50f4-49aa-97b9-45e68c89b8b6 deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\d0104e71-e195-4746-9600-db5c06fd0789 deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\dbd2ce4f-6b29-45b1-8f96-a5760586566a deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\f61fbb93-3857-4a5f-a223-71e76e8f7d55 deleted successfully
HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\ExtensionInstallForcelist deleted successfully
HKEY_CURRENT_USER\Software\Policies\Google\Chrome\ExtensionInstallForcelist deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\F60730A4A66673047777F5728467D401 deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PlusService deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VDownloader deleted successfully

==== Empty IE Cache ======================

C:\Users\Alfeu-Pc\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\cliente\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\cliente\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

C:\Users\Alfeu-Pc\AppData\Local\Mozilla\Firefox\Profiles\adjfj1yt.default\Cache emptied successfully

==== Empty Chrome Cache ======================

C:\Users\cliente\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=228 folders=89 16953702 bytes)

==== Empty Temp Folders ======================

C:\Users\Alfeu-Pc\AppData\Local\Temp emptied successfully
C:\Users\cliente\AppData\Local\Temp will be emptied at reboot
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\USURIO~1\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\cliente\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied
C:\RECYCLER successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\cliente\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted

==== EOF on 25-Jul-14 at 2:22:32,94 ======================

Baixe o programa Junkware Removal Tool no link abaixo:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Para executar corretamente o programa acima é só seguir as dicas deste tutorial:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

* Na sua próxima resposta poste o log (relatório) do Junkware Removal Tool que estará salvo em sua área de trabalho com o nome de JRT.txt

Ficamos na espera.

Aki estar o relatorio.


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x86
Ran by cliente on 25-Jul-14 at 18:29:05,28
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2346172771-2055397070-329482368-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\baidu



~~~ Files



~~~ Folders



~~~ Chrome

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Policies\Google [Blacklisted Policy]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 25-Jul-14 at 18:30:32,73
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Faça o download do < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > < [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]> ( ... de Nicolas Coolman )

Obs: Ao acessar o link acima clique no botão Télécharger referente ao ZHPDiag para baixá-lo, tal como mostra a imagem abaixo:

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

Para instalá-lo e executá-lo corretamente siga as dicas deste artigo:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

* Assim que ele concluir a sua verificação, copie todo o conteúdo do seu relatório ZHPDiag.txt e poste em sua próxima resposta.

Aqui estar mais um Relatório.




~ Relatório do ZHPDiag v2014.7.24.108 - Nicolas Coolman (24-Jul-14)
~ Iniciado por cliente (25-Jul-14 9:37:51 PM)
~ Endereço do Website : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Endereço do Webforum : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Tradução pelo utilizador
~ Estatuto da versão : Versão atualizada.
~ Lista Branca : Ativado pelo programa
~ Elevação dos Privilégios : OK
~ Controle de Conta de Utilizador : Deactivate by user


---\\ Navegadores Internet
MSIE: Internet Explorer v8.0.7601.17514
GCIE: Google Chrome v35.0.1916.153

---\\ Informações sobre os produtos Windows
~ Langage: Portugais
Windows 7 Professional, 32-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
Software Protection Service (Protection logicielle) : OK
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ Softwares de proteçao do sistema
McAfee VirusScan Enterprise v8.7.0
Windows Defender W7 (Activate)

---\\ Softwares d'optimização do sistema
CCleaner v4.14

---\\ Softwares de partilha do PeerToPeer (P2P)

---\\ Monitoramento dos softwares
Adobe Flash Player 14 Plugin
Java 7 Update 51

---\\ Informações sobre o sistema
~ Processor: x86 Family 6 Model 42 Stepping 7, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3242 MB (49% free)
System Restore: Activé (Enable)
System drive C: has 417 GB (89%) free of 466 GB

---\\ Modo de conexão ao sistema
~ Computer Name: CLIENTE-PC
~ User Name: cliente
~ All Users Names: Convidado, cliente, Administrador,
~ Unselected Option: 045,061,O62,065,066,080,O82,089
Logged in as Administrator

---\\ As variáveis de ambiente
~ System Unit : C:\
~ %AppZHP% : C:\Users\cliente\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\cliente\AppData\Roaming\
~ %Desktop% : C:\Users\cliente\Desktop\
~ %Favorites% : C:\Users\cliente\Favorites\
~ %LocalAppData% : C:\Users\cliente\AppData\Local\
~ %StartMenu% : C:\Users\cliente\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumeração das unidades dos discos
C: Hard drive, Flash drive, Thumb drive (Free 417 Go of 466 Go)
D: CD-ROM drive (Not Inserted)
E: Floppy drive, Flash card reader, USB Key (Not Inserted)
F: Floppy drive, Flash card reader, USB Key (Not Inserted)
G: Floppy drive, Flash card reader, USB Key (Not Inserted)
H: Floppy drive, Flash card reader, USB Key (Not Inserted)



---\\ Estado do Centro de Segurança do Windows
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusOverride: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] AntiVirusDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] FirewallOverride: Modified
[HKLM\SOFTWARE\Microsoft\Security Center] UpdatesDisableNotify: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowMyGames: Modified
~ Security Center: 46 Legitimates Filtered in 00mn AMs



---\\ Pesquisa particular de ficheiros genéricos
[MD5.40D777B7A95E00593EB1568C68514493] - (.Microsoft Corporation - Windows Explorer.) (.20-Nov-10 - 2:17:10 AM.) -- C:\Windows\Explorer.exe [2616320]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Aplicativo de Inicialização do Windows.) (.13-Jul-09 - 9:14:45 PM.) -- C:\Windows\System32\Wininit.exe [96256]
[MD5.7CCA8574A3B9BB41A4150739E21F1B23] - (.Microsoft Corporation - Internet Extensions para Win32.) (.28-Feb-12 - 1:38:52 AM.) -- C:\Windows\System32\wininet.dll [981504]
[MD5.6D13E1406F50C66E2A95D97F22C47560] - (.Microsoft Corporation - Aplicativo de Logon do Windows.) (.20-Nov-10 - 2:17:56 AM.) -- C:\Windows\System32\Winlogon.exe [286720]
[MD5.E3AE23569749DE12D45BA3B489A036AE] - (.Microsoft Corporation - Biblioteca de Licenciamento de Software.) (.20-Nov-10 - 2:21:26 AM.) -- C:\Windows\System32\sppcomapi.dll [193536]
[MD5.9EBBBA55060F786F0FCAA3893BFA2806] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.24-Apr-11 - 10:18:03 PM.) -- C:\Windows\system32\Drivers\AFD.sys [338944]
[MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.13-Jul-09 - 9:26:15 PM.) -- C:\Windows\system32\Drivers\atapi.sys [21584]
[MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13-Jul-09 - 7:11:15 PM.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656]
[MD5.BE167ED0FDB9C1FA1133953C18D5A6C9] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.19-Nov-10 - 10:38:12 PM.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544]
[MD5.F024449C97EC1E464AAFFDA18593DB88] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.19-Nov-10 - 10:42:34 PM.) -- C:\Windows\system32\Drivers\DfsC.sys [78336]
[MD5.9036377B8A6C15DC2EEC53E489D159B5] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.19-Nov-10 - 11:59:30 PM.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544]
[MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - Driver de porta i8042.) (.13-Jul-09 - 7:11:24 PM.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896]
[MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.13-Jul-09 - 7:54:29 PM.) -- C:\Windows\system32\Drivers\IpNat.sys [101888]
[MD5.5D16C921E3671636C0EBA3BBAAC5FD25] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.26-Apr-11 - 10:17:22 PM.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123904]
[MD5.280122DDCF04B378EDD1AD54D71C1E54] - (.Microsoft Corporation - MBT Transport driver.) (.19-Nov-10 - 10:39:46 PM.) -- C:\Windows\system32\Drivers\netBT.sys [187904]
[MD5.33C3093D09017CFE2E219F2472BFF6EB] - (.Microsoft Corporation - Driver do Sistema de Arquivos NT.) (.20-Nov-10 - 2:30:08 AM.) -- C:\Windows\system32\Drivers\ntfs.sys [1211264]
[MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - Driver de porta paralela.) (.13-Jul-09 - 7:45:35 PM.) -- C:\Windows\system32\Drivers\Parport.sys [79360]
[MD5.D9F91EAFEC2815365CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13-Jul-09 - 7:54:34 PM.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848]
[MD5.B973FCFC50DC1434E1970A146F7E3885] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.20-Nov-10 - 12:24:48 AM.) -- C:\Windows\system32\Drivers\rdpdr.sys [133632]
[MD5.3E21C083B8A01CB70BA1F09303010FCE] - (.Microsoft Corporation - SMB Transport driver.) (.13-Jul-09 - 7:53:41 PM.) -- C:\Windows\system32\Drivers\smb.sys [71168]
[MD5.B459575348C20E8121D6039DA063C704] - (.Microsoft Corporation - TDI Translation Driver.) (.19-Nov-10 - 10:39:18 PM.) -- C:\Windows\system32\Drivers\tdx.sys [74752]
[MD5.F497F67932C6FA693D7DE2780631CFE7] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.20-Nov-10 - 2:30:18 AM.) -- C:\Windows\system32\Drivers\volsnap.sys [245632]
~ Generic Processes: Scanned in 00mn AMs



---\\ Estatuto dos ficheiros ocultos (Oculto/Total)
~ Mes images (My Pictures) : 1/1628
~ Mes musiques (My Musics) : 1/1216
~ Mes Videos (My Videos) : 1/54
~ Mes Favoris (My Favorites) : 1/20
~ Mes Documents (My Documents) : 1/64
~ Mon Bureau (My Desktop) : 1/1126
~ Menu demarrer (Programs) : 1/25
~ Hidden Files: Scanned in 03mn AMs



---\\ Processos lançados
[MD5.43B1125D14E8797FDA9D5E167EB50AE3] - (.GAS Tecnologia - G-Buster Browser Defense - Service.) -- C:\Program Files\GbPlugin\gbpsv.exe [528424] [PID.736]
[MD5.4FE5C6D40664AE07BE5105874357D2ED] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [57008] [PID.1588]
[MD5.C3D7E3DCC470D0A5230A485549F21908] - (.McAfee, Inc. - Common Shell3 - Scanners' interface to the.) -- C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe [19456] [PID.1684]
[MD5.4CD3EE64736B4D156DAC5C1D6EB60C24] - (.McAfee, Inc. - Framework Service.) -- C:\Program Files\McAfee\Common Framework\FrameworkService.exe [103744] [PID.1736]
[MD5.9DF3A434657512B31549F8D20AFFAD5F] - (.McAfee, Inc. - Task Manager.) -- C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe [62800] [PID.1912]
[MD5.B87B41F2C05788F04A3B487902803FD2] - (.McAfee, Inc. - McAfee Process Validation Service.) -- C:\Windows\system32\mfevtps.exe [67904] [PID.1976]
[MD5.9916F961341557B3ED2D39CA3C5C8C09] - (.McAfee, Inc. - NAI Product Manager.) -- C:\Program Files\McAfee\Common Framework\naPrdMgr.exe [226624] [PID.2028]
[MD5.506708142BC63DABA64F2D3AD1DCD5BF] - (.Google Inc. - Google Installer.) -- C:\Program Files\Google\Update\GoogleUpdate.exe [116648] [PID.624]
[MD5.19DFA4463D9FBA9E7046E8264D0656D8] - (.McAfee, Inc. - Common User Interface.) -- C:\Program Files\McAfee\Common Framework\UdaterUI.exe [136512] [PID.2244]
[MD5.825A1841A76429732BC6C03BD5C656AA] - (.McAfee, Inc. - VirusScan tray icon.) -- C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe [124240] [PID.2260]
[MD5.CE42DFE915F78246364D464902E47360] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe [152392] [PID.2296]
[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336] [PID.2304]
[MD5.7A2FAB25EDDC6B2C6AA19BA3EB5E0A04] - (.McAfee, Inc. - McAfee Security Agent Taskbar Extension.) -- C:\Program Files\McAfee\Common Framework\McTray.exe [91456] [PID.2400]
[MD5.D8B8B5A8FE57CF4F307A540D9A153C23] - (.Apple Inc. - iPodService Module (32-bit).) -- C:\Program Files\iPod\bin\iPodService.exe [553288] [PID.3016]
[MD5.7DCE7A74764EB7C67D21A32BC579453D] - (.Oracle Corporation - Java(TM) Update Checker.) -- C:\Program Files\Common Files\Java\Java Update\jucheck.exe [507264] [PID.3896]
[MD5.291ADFCB72658349A929B903BC47F8EA] - (.McAfee, Inc. - On-Access Scanner service.) -- C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe [143088] [PID.3848]
[MD5.576FC5ADADEC22F5EF1BDF01F5982606] - (.McAfee, Inc. - VSCore Announcer.) -- C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe [26672] [PID.4092]
[MD5.A5FCD42334CCC682DA1882A54338686C] - (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe [860488] [PID.2232]
[MD5.80E04F074334739C96E1C08C331FB82D] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [8080384] [PID.404]
[MD5.CF87A1DE791347E75B98885214CED2B8] - (.Microsoft Corporation - Serviço da Plataforma de Proteção de Softwa.) -- C:\Windows\system32\sppsvc.exe [3179520] [PID.3540]
~ Processes Running: Scanned in 00mn AMs



---\\ Google Chrome, Arranque,Pesquisa,Extensões (G0,G1,G2)
C:\Users\cliente\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [ahfgeienlihckogmohjhadlkjgocpleb] Loja v.0.2 (Activé)
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [pafkbggdmjlpgkdkcbjmhmfcdpncadgh] Google Now v.1.2.0.1 (Activé)

---\\ Pasta de extensão do Google Chrome
~ Google Lines Browser: 16 Legitimates Filtered in 01mn AMs



---\\ Mozilla Firefox, Plugins,Arranque,Pesquisa,Extensões (P2,M0,M1,M2,M3)
P2 - FPN: [HKLM] [@Google.com/GoogleEarthPlugin] - (...) -- C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (.not file.) =>.Google Inc
P2 - FPN: [HKCU] [gastecnologia.com.br/sf/bb] - (.GAS Tecnologia - Internet Banking Helper.) -- C:\Users\cliente\AppData\Local\GAS Tecnologia\GBBD\npsf_bb.dll
~ Firefox Browser: 12 Legitimates Filtered in 00mn AMs



---\\ Internet Explorer, Arranque, Pesquisa, URLSearchHook( gancho de URL), Phishing (R0,R1,R3,R4)
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.GAS Tecnologia - Internet Banking Helper.) (No version) -- (.not file.)
~ IE Browser: 12 Legitimates Filtered in 00mn AMs



---\\ Internet Explorer, Gestão do Proxy (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn AMs



---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn AMs



---\\ Redireção do ficheiro Hosts (01)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn AMs
~ Nombre de lignes (Lines number): 21



---\\ Browser Helper Objects do navegador (02)
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} . (.Banco do Brasil - Gbieh Module.) -- C:\PROGRAM FILES\GBPLUGIN\gbieh.dll
~ BHO: 10 Legitimates Filtered in 00mn AMs



---\\ Aplicações iniciadas por registo & pastas (04)
O4 - HKLM\..\Run: [McAfeeUpdaterUI] . (.McAfee, Inc. - Common User Interface.) -- C:\Program Files\McAfee\Common Framework\udaterui.exe
O4 - HKLM\..\Run: [ShStatEXE] . (.McAfee, Inc. - VirusScan tray icon.) -- C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe
O4 - HKLM\..\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe
O4 - HKLM\..\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
~ Application: Scanned in 00mn AMs



---\\ Boutões da barra de ferramentas principal do Internet Explorer (09)
O9 - Extra button: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft Office OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO
~ IE Extra Buttons: Scanned in 00mn AMs



---\\ Site na zona confiavél do Internet Explorer (05)
O15 - Trusted Zone: [HKCU\...\Domains\www] *.bancobrasil.com.br
O15 - Trusted Zone: [HKCU\...\Domains\www] http.bb.com.br
~ IE Zone Confiance: Scanned in 00mn AMs



---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} ((no name)) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Objets ActiveX: Scanned in 00mn AMs



---\\ Alteração Dominio/Clientes DNS (017)
O17 - HKLM\System\CCS\Services\Tcpip\..\{0551AB6D-4705-4A17-A9A9-6731BBF28B2E}: NameServer = 8.8.8.8,8.8.4.4 =>.Google DNS Redirections
O17 - HKLM\System\CCS\Services\Tcpip\..\{8C479026-D5F8-4F19-A24B-E94FA312594A}: NameServer = 192.168.3.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{0551AB6D-4705-4A17-A9A9-6731BBF28B2E}: DhcpNameServer = 10.1.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{0551AB6D-4705-4A17-A9A9-6731BBF28B2E}: NameServer = 8.8.8.8,8.8.4.4 =>.Google DNS Redirections
O17 - HKLM\System\CS1\Services\Tcpip\..\{8C479026-D5F8-4F19-A24B-E94FA312594A}: NameServer = 192.168.3.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{0551AB6D-4705-4A17-A9A9-6731BBF28B2E}: DhcpNameServer = 10.1.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{0551AB6D-4705-4A17-A9A9-6731BBF28B2E}: NameServer = 8.8.8.8,8.8.4.4 =>.Google DNS Redirections
O17 - HKLM\System\CS2\Services\Tcpip\..\{8C479026-D5F8-4F19-A24B-E94FA312594A}: NameServer = 192.168.3.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{0551AB6D-4705-4A17-A9A9-6731BBF28B2E}: DhcpNameServer = 10.1.1.1
~ Domain: Scanned in 00mn AMs



---\\ Protocolo adicional (018)
O18 - Handler: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visualizador de HTML da Microsoft (R).) -- C:\Windows\System32\mshtml.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn AMs



---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: GbPluginBb . (.Banco do Brasil - Gbieh Module.) -- C:\Program Files\GbPlugin\gbieh.dll
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn AMs



---\\ Lista dos serviços NT não Microsoft e não desativados (023)
O23 - Service: Gbp Service (GbpSv) . (.GAS Tecnologia - G-Buster Browser Defense - Service.) - C:\Program Files\GbPlugin\gbpsv.exe
~ Services: 9 Legitimates Filtered in 02mn AMs



---\\ Tarefas planificadas automaticamente (039)
[MD5.00000000000000000000000000000000] [APT] [{0A525A8E-2531-4E7D-AC96-DC14AF5EE79F}] (...) -- C:\Program Files\crawler\ssaver\cssaver.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{18A742B7-629D-4275-9122-AB8F37A77FE9}] (...) -- C:\Users\cliente\Downloads\WarS1024Premium.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{578672A0-E65D-48AD-A2C9-3546B7CE5E69}] (...) -- C:\Users\cliente\AppData\Roaming\webssearches\UninstallManager.exe (.not file.) [0] =>Hijacker.WebsSearches
O39 - APT: - (..) -- C:\Windows\System32\Tasks\Adobe Flash Player Updater [902]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2346172771-2055397070-329482368-1000Core [914]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2346172771-2055397070-329482368-1000UA [936]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore [1054]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA [1058]
~ Scheduled Task: 16 Legitimates Filtered in 03mn AMs



---\\ Drivers lançados ao arranque do sistema (041)
O41 - Driver: (360FileOem) . (.360.cn - 360FileOem.) - C:\Windows\system32\drivers\360FileOem.sys
O41 - Driver: (Bfilter) . (. - .) - C:\Windows\system32\drivers\Bfilter.sys (.not file.)
O41 - Driver: (Bfmon) . (. - .) - C:\Windows\system32\drivers\Bfmon.sys (.not file.)
O41 - Driver: (Bprotect) . (. - .) - C:\Windows\system32\drivers\Bprotect.sys (.not file.)
O41 - Driver: (ndisrd) . (.GAS Tecnologia - GAS Tecnologia - LWF Helper Driver.) - C:\Windows\System32\DRIVERS\gbpndisrdn.sys
~ Drivers: 84 Legitimates Filtered in 00mn AMs



---\\ Software instalados (042)
O42 - Logiciel: Módulo de Segurança - Banco do Brasil - (...) [HKLM] -- {36386dc9-8543-4b12-ae6b-220fd52f19f3}_is1
~ Logic: 12 Legitimates Filtered in 00mn AMs



---\\ HKCU & HKLM Software Keys
[HKCU\Software\AutoHelpDesk]
[HKCU\Software\Baidu Security]
[HKCU\Software\GbAs]
[HKCU\Software\Install]
[HKLM\Software\360Safe]
[HKLM\Software\Baidu Security]
[HKLM\Software\Baidu_Drp_pos]
[HKLM\Software\Great Planes]
[HKLM\Software\MegaJogos]
~ Key Software: 174 Legitimates Filtered in 00mn AMs



---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 27-Mar-13 - 10:13:08 AM - [] --H-D C:\Program Files\NSPro
O43 - CFD: 13-Jan-13 - 9:58:29 PM - [] -SH-D C:\Program Files\Viky
O43 - CFD: 05-May-14 - 10:23:29 PM - [] ----D C:\ProgramData\Baidu Security
O43 - CFD: 05-May-14 - 10:24:02 PM - [] ----D C:\Users\cliente\AppData\Roaming\Baidu Security
O43 - CFD: 27-Mar-13 - 10:13:03 AM - [] ----D C:\Users\cliente\AppData\Roaming\WTS
O43 - CFD: 06-Jun-14 - 10:57:48 PM - [] ----D C:\Users\cliente\AppData\Local\com
~ Program Folder: 146 Legitimates Filtered in 00mn AMs



---\\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044)
O44 - LFC:[MD5.0DC5AF80D059DEC792B665ED598C6567] - 22-Jul-14 - 4:52:46 PM ---A- . (.SQLite Development Team - SQLite Dynamic Link Library (No TCL).) -- C:\Windows\System32\sqlite3.dll [536576]
O44 - LFC:[MD5.63516B5B00EFC1DF0EAA76DC8E0C884D] - 25-Jul-14 - 11:42:30 AM ---A- . (...) -- C:\Windows\System32\prfc0416.dat [124572]
O44 - LFC:[MD5.4F1A0CC3A6B1CEF10726AC796D9578A7] - 25-Jul-14 - 11:42:30 AM ---A- . (...) -- C:\Windows\System32\prfh0416.dat [655514]
O44 - LFC:[MD5.CC7AA7B42CF418FC3D926913490048F8] - 25-Jul-14 - 2:05:21 AM ---A- . (...) -- C:\Windows\zoek-delete.exe [24064]
O44 - LFC:[MD5.93E5201EE7505F1048D9CE306B213935] - 25-Jul-14 - 2:22:32 AM ---A- . (...) -- C:\zoek-results.log [29864]
~ Files: 16 Legitimates Filtered in 01mn AMs



---\\ Operações e funções ao arranque do Windows Explorer (046)
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O46 - SEH:ShellExecuteHooks - GbPlugin ShlObj - {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\PROGRAM FILES\GBPLUGIN\gbieh.dll
~ ShellExecuteHooks: Scanned in 00mn AMs



---\\ Chave do registo Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{09c892ff-b596-11e3-aa48-1078d2b12292}\AutoRun\command. (...) -- I:\LGAutoRun.exe (.not file.)
~ Keys: Scanned in 00mn AMs



---\\ Enumeração das chaves do registo PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 20 Legitimates Filtered in 00mn AMs



---\\ Enumeração das chaves do registo PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "HideSCAHealth"=1
~ MWPE Keys: 1 Legitimates Filtered in 00mn AMs



---\\ Lista dos drivers do sistema (SDL) (O58)
O58 - SDL:31-May-12 - 8:21:04 PM R--A- . (.360.cn - 360FileOem.) -- C:\Windows\System32\Drivers\360FileOem.sys [146304]
O58 - SDL:31-May-12 - 8:21:04 PM R--A- . (.360安全中心 - 360HookOem.) -- C:\Windows\System32\Drivers\360HookOem.sys [54912]
O58 - SDL:31-May-12 - 8:21:04 PM R--A- . (.360安全中心 - 360RegOem.) -- C:\Windows\System32\Drivers\360RegOem.sys [23168]
O58 - SDL:21-Aug-12 - 6:12:18 PM R--A- . (.360安全中心 - 360安全卫士 - SelfProtection.) -- C:\Windows\System32\Drivers\360SpOEM.sys [64048]
O58 - SDL:10-Mar-14 - 11:14:02 PM ---A- . (.Baidu, Inc. - Baidu Antivirus Hook Base.) -- C:\Windows\System32\Drivers\Bhbase.sys [47456]
O58 - SDL:13-Jul-09 - 9:20:28 PM ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [453712]
O58 - SDL:14-Mar-14 - 8:27:24 PM ---A- . (.GAS Tecnologia - GbPlugin Device Driver.) -- C:\Windows\System32\Drivers\gbpkm.sys [47192]
O58 - SDL:16-May-14 - 11:48:08 PM ---A- . (.GAS Tecnologia - GAS Tecnologia - LWF Helper Driver.) -- C:\Windows\System32\Drivers\gbpndisrdn.sys [29400]
O58 - SDL:13-Jul-09 - 6:54:14 PM ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [26624]
O58 - SDL:13-Jul-09 - 9:19:04 PM ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [21072]
O58 - SDL:13-Dec-12 - 1:50:38 PM ---A- . (.Apple, Inc. - Apple Mobile Device USB Driver.) -- C:\Windows\System32\Drivers\usbaapl.sys [45056]
O58 - SDL:13-Jul-09 - 5:40:41 PM ---A- . (...) -- C:\Windows\System32\ANSI.SYS [9029]
O58 - SDL:13-Jul-09 - 5:40:44 PM ---A- . (...) -- C:\Windows\System32\country.sys [27097]
O58 - SDL:13-Jul-09 - 5:40:40 PM ---A- . (...) -- C:\Windows\System32\HIMEM.SYS [4768]
O58 - SDL:13-Jul-09 - 5:40:43 PM ---A- . (...) -- C:\Windows\System32\KEY01.SYS [42809]
O58 - SDL:13-Jul-09 - 5:40:43 PM ---A- . (...) -- C:\Windows\System32\KEYBOARD.SYS [42537]
O58 - SDL:13-Jul-09 - 5:40:23 PM ---A- . (...) -- C:\Windows\System32\NTDOS.SYS [27866]
O58 - SDL:13-Jul-09 - 5:40:31 PM ---A- . (...) -- C:\Windows\System32\NTDOS404.SYS [29146]
O58 - SDL:13-Jul-09 - 5:40:35 PM ---A- . (...) -- C:\Windows\System32\NTDOS411.SYS [29370]
O58 - SDL:13-Jul-09 - 5:40:39 PM ---A- . (...) -- C:\Windows\System32\NTDOS412.SYS [29274]
O58 - SDL:13-Jul-09 - 5:40:27 PM ---A- . (...) -- C:\Windows\System32\NTDOS804.SYS [29146]
O58 - SDL:13-Jul-09 - 5:40:11 PM ---A- . (...) -- C:\Windows\System32\NTIO.SYS [33952]
O58 - SDL:13-Jul-09 - 5:40:15 PM ---A- . (...) -- C:\Windows\System32\NTIO404.SYS [34672]
O58 - SDL:13-Jul-09 - 5:40:17 PM ---A- . (...) -- C:\Windows\System32\NTIO411.SYS [35776]
O58 - SDL:13-Jul-09 - 5:40:19 PM ---A- . (...) -- C:\Windows\System32\NTIO412.SYS [35536]
O58 - SDL:13-Jul-09 - 5:40:13 PM ---A- . (...) -- C:\Windows\System32\NTIO804.SYS [34672]
~ Drivers: 83 Legitimates Filtered in 10mn AMs



---\\ Lista das ferramentas de remoção de vírus (LAT) (063)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn AMs



---\\ Lista dos serviços Legacy du registo (064)
O64 - Services: CurCS - 31-May-12 - C:\Windows\system32\drivers\360FileOem.sys (360FileOem) .(.360.cn - 360FileOem.) - LEGACY_360FILEOEM
O64 - Services: CurCS - 10-Mar-14 - C:\Windows\System32\drivers\Bhbase.sys (Bhbase) .(.Baidu, Inc. - Baidu Antivirus Hook Base.) - LEGACY_BHBASE
O64 - Services: CurCS - 14-Mar-14 - C:\Windows\System32\drivers\gbpkm.sys (GbpKm) .(.GAS Tecnologia - GbPlugin Device Driver.) - LEGACY_GBPKM
~ Legacy: 90 Legitimates Filtered in 00mn AMs



---\\ Menu de inicialização Internet (068)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn AMs



---\\ Pesquisa de infeção nos navegadores da Internet (SBI) (069)
O69 - SBI: SearchScopes [HKCU] {012E1000-F331-11DB-8314-0800200C9A66} [DefaultScope] - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Keys: Scanned in 00mn AMs



---\\ Pesquisa adicional à raiz do sistema (radicular) (SPRF) (O84)
[MD5.0D7A5A14498D1A6B7F8F81E1E1946716] [SPRF][22-Jul-14] (...) -- C:\Users\cliente\AppData\Roaming\unins000.dat [15971]
~ Files: 2 Legitimates Filtered in 00mn AMs



---\\ Search Tracing Registry Key (O100)
HKLM\SOFTWARE\Microsoft\Tracing\BearShareSetup-r1116-n-bc_RASAPI32 =>PUP.BearShare
HKLM\SOFTWARE\Microsoft\Tracing\BearShareSetup-r1116-n-bc_RASMANCS =>PUP.BearShare
HKLM\SOFTWARE\Microsoft\Tracing\funmoods_RASAPI32 =>PUP.Funmoods
HKLM\SOFTWARE\Microsoft\Tracing\funmoods_RASMANCS =>PUP.Funmoods
HKLM\SOFTWARE\Microsoft\Tracing\IminentUninstall_RASAPI32 =>Adware.IMBooster
HKLM\SOFTWARE\Microsoft\Tracing\IminentUninstall_RASMANCS =>Adware.IMBooster
HKLM\SOFTWARE\Microsoft\Tracing\LollipopInstaller_somoto_14693_RASAPI32 =>Adware.Lollipop
HKLM\SOFTWARE\Microsoft\Tracing\LollipopInstaller_somoto_14693_RASMANCS =>Adware.Lollipop
HKLM\SOFTWARE\Microsoft\Tracing\Media_Play_AIR+_1_RASAPI32 =>PUP.CrossRider
HKLM\SOFTWARE\Microsoft\Tracing\Media_Play_AIR+_1_RASMANCS =>PUP.CrossRider
HKLM\SOFTWARE\Microsoft\Tracing\MovieModeService_RASAPI32 =>PUP.MovieMode
HKLM\SOFTWARE\Microsoft\Tracing\MovieModeService_RASMANCS =>PUP.MovieMode
HKLM\SOFTWARE\Microsoft\Tracing\MovieMode_RASAPI32 =>PUP.MovieMode
HKLM\SOFTWARE\Microsoft\Tracing\MovieMode_RASMANCS =>PUP.MovieMode
HKLM\SOFTWARE\Microsoft\Tracing\ViewPasswordFIX_RASAPI32 =>PUP.ViewPassword
HKLM\SOFTWARE\Microsoft\Tracing\ViewPasswordFIX_RASMANCS =>PUP.ViewPassword
~ BTK: 368 Legitimates Filtered in 00mn AMs



---\\ Search CLSID Registry Key (O101)
[HKCR\CLSID\{F4B8D46C-4EEE-401B-8607-DC03025F34B1}] (SaveSenseLive Core Class) =>PUP.SaveSense
~ BCK: 6721 Legitimates Filtered in 06mn AMs



---\\ Estado general dos serviços não Microsoft (EGS) (SR=Executados, SS=Parados)
SS - | Demand 09-Jul-14 262320 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Auto 12-Jul-14 116648 | (gupdate1cf9de63f6cbdc3) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Demand 12-Jul-14 116648 | (gupdatem1cf9de63fc00dec) . (.Google Inc..) - C:\Program Files\Google\Update\GoogleUpdate.exe
SS - | Disabled 20-Dec-10 325656 | (LMS) . (.Intel Corporation.) - C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
SS - | Disabled 16-May-07 271920 | (NMIndexingService) . (.Nero AG.) - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
SS - | Auto 23-Oct-13 172192 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files\Skype\Updater\Updater.exe
SS - | Disabled 20-Dec-10 2656280 | (UNS) . (.Intel Corporation.) - C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
SS - | Disabled 14-Dec-10 27760 | (VIAKaraokeService) . (.VIA Technologies, Inc..) - C:\Windows\System32\viakaraokesrv.exe
SS - | Disabled 13-Jul-09 20992 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SR - | Auto 21-Dec-12 57008 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 06-May-14 528424 | (GbpSv) . (.GAS Tecnologia.) - C:\Program Files\GbPlugin\gbpsv.exe
SR - | Demand 16-Aug-13 553288 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SR - | Auto 29-Sep-08 19456 | (McAfeeEngineService) . (.McAfee, Inc..) - C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe
SR - | Auto 14-Mar-08 103744 | (McAfeeFramework) . (.McAfee, Inc..) - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
SR - | Auto 29-Sep-08 143088 | (McShield) . (.McAfee, Inc..) - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
SR - | Auto 29-Sep-08 62800 | (McTaskManager) . (.McAfee, Inc..) - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
SR - | Auto 29-Sep-08 67904 | (mfevtp) . (.McAfee, Inc..) - C:\Windows\system32\mfevtps.exe
SR - | Auto 13-Jul-09 20992 | C:\Program Files\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 07mn AMs



---\\ Scâner Aditional (088)
Database Version : 13026 - (24-Jul-14)
Clés trouvées (Keys found) : 3
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 1

[HKCU\Software\USyndication] =>Trojan.USyndication
[HKCU\Software\usyndication.com] =>Trojan.USyndication
[HKLM\Software\360Safe] =>Trojan.Lozavita
[HKCR\CLSID\{F4B8D46C-4EEE-401B-8607-DC03025F34B1}] (SaveSenseLive Core Class) =>PUP.SaveSense^
~ Additionnel Scan: 232683 Items scanned in 18mn AMs



---\\ Informações complémentaires do módulos
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>.Google Chrome, Arranque,Pesquisa,Extensões (G0,G1,G2)
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>.Internet Explorer, Gestão do Proxy (R5)
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>.Browser Helper Objects do navegador (02)
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>.Aplicações iniciadas por registo & pastas (04)
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>.Chave do registo Shell MountPoints2 (MPKS) (O51)
~ AMI: 5 Legitimates Filtered in 00mn AMs



---\\ Sumário das deteções encontradas na sua estação
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Hijacker.WebsSearches
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.BearShare
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Funmoods
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Adware.IMBooster
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Adware.Lollipop
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.CrossRider
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.ViewPassword
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.SaveSense
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Trojan.USyndication
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Trojan.Lozavita
~ MSI: 10 link(s) detected in 00mn AMs



~ 716 Legitimates filtered by white list
End of the scan (519 lines in 16mn AMs)(0)

 Há programas desnecessários iniciando junto com o Windows, o que torna o seu PC mais lento. Para corrigir isto, siga as dicas deste tutorial:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

De preferência deixe apenas os programas de segurança (anti-vírus/anti-spywares/firewall) iniciarem junto com o Windows.

Use também o programa Ccleaner, indicado neste tutorial acima, para fazer uma limpeza e otimização do PC.
________________________________________________________________________________________

 Selecione e copie todo o texto destacado em vermelho que te passei.
_____________________________________________________________________________________________________________

 Vá no menu: Iniciar > Todos os programas > ZHP > Clique com o botão direito do mouse sobre o Zhpfix e escolha a opção de Executar como administrador > Clique em Importação > Clique no botão GO > Clique em Oui > Caso queira que os arquivos da lixeira sejam excluídos clique em Oui novamente > Um relatório aparecerá no bloco de notas.

Copie este relatório e poste em sua próxima resposta.

TÓPICO ARQUIVADO

Como o autor não respondeu por mais de 15 dias, o tópico foi arquivado. Caso o autor do tópico necessite, o mesmo será reaberto, para isso deverá entrar em contato com um dos membros da [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] solicitando o desbloqueio.