Estou tendo um sério problema com o " wscript.exe "

Não sei o que esta acontecendo, mas estou tendo um sério problema com o " wscript.exe ".

Toda vez que eu tento ligar meu PC, ele aparece e pede para mim estala-lo. No mesmo tempo que o mesmo apareceu, não consegue mais usar meu ante vírus e a opção "Mudar Configuração do Computador" não abre.

Isso tem concerto?

Boa noite ViniciusDorneles,

• Baixe: <[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] ><[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]> ( ...Nicolas Coolman)
  
• Salve-o no Disco local (C ou D).
  
• Desabilite seu antivírus, e execute ZHPDiag.exe para instalar.
  
  [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
  
• Execute o ícone do pergaminho!
  
  [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
  
• Clique na opção "COMPLETA" e aguarde a conclusão.
  
• Clique OK e,ao concluir, poste o relatório! ( ZHPDiag.txt )
  
• Obs: O relatório por ser extenso deve ser postado em um desses sites:
  
• Acesse: <[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]>
  
• Ou acesse:<[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]>
  
• Ou anexe-o <[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]> << Link
  
• Maiores informações:<[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]> << Hospedagem !
  

Um grande abraço.  

Boa noite ViniciusDorneles,

• Execute este script na ferramenta ZHPFix.
  
• Copie estas informações que estão em vermelho para o Bloco de notas.
  
• Com o Bloco de notas aberto, faça: ctrl+a >> ctrl+c.
  
• À seguir, minimize o Bloco de notas.
  
  Script ZHPFix
  FirewallRaz
  EmptyPrefetch
  EmptyTemp
  EmptyFlash
  ShortcutFix
  R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
  R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
  O2 - BHO: IESpeakDoc [64Bits] - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} Chave orfã    
  [HKCU\Software\Baixaki]    
  O43 - CFD: 22/03/2014 - 14:26:02 - [] ----D C:\ProgramData\Log    
  O43 - CFD: 04/03/2013 - 15:32:42 - [] ----D C:\ProgramData\PSafe    
  O43 - CFD: 23/11/2014 - 18:56:44 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hao123-Brazil
  O43 - CFD: 23/11/2014 - 18:56:44 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Loaris Trojan Remover    
  O45 - LFCP:[MD5.472DD12583E0C0AECC4B1042A304B4FA] - 24/01/2015 - 12:09:42 ---A- - C:\Windows\Prefetch\WINUPDATE.EXE-E295B6C7.pf   =>PUP.WinRST
  O69 - SBI: SearchScopes [HKCU] {DCE479FA-F99E-4534-8E15-4F8CC122861E} [DefaultScope] - (Pesquisa segura) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
  Proxyfix
  sysrestore
  
  
  
• Abra a ferramenta ZHPFix. <[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]>
  
• Clique em IMPORTAÇÃO > OK
  
• Clique "GO".
  
• Poste o Relatório!
  

Um grande abraço.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
< Peço aos visitantes que não utilizem este script em outros computadores,sob risco de danos irreparáveis aos mesmos! >

Rapport de ZHPFix 2015.1.15.1 par Nicolas Coolman, Update du 15/01/2015
Fichier d'export Registre :
Run by 7Heaven at 26/01/2015 22:12:16
High Elevated Privileges : OK
Windows 8 Home Premium Edition, 64-bit Service Pack 1 (9600)

Reciclagem vazia (00mn 06s)
Prefetcher vazio
Reparação de atalhos do navegador

========== Chaves do Registo ==========
ELIMINÉ: HKCU\Software\Baixaki
ELIMINÉ: SearchScopes :{DCE479FA-F99E-4534-8E15-4F8CC122861E}

========== Valores do Registo ==========
Ausente Valor Perfil Padrão: FirewallRaz :
Ausente Valor Perfil Domínio FirewallRaz :
ELIMINÉ: FirewallRaz (Domain) : {9E3D57FC-7C37-4424-9352-4831E97D029D}
ELIMINÉ: FirewallRaz (Domain) : {548DCF8C-BFF2-4BA4-AA88-FBAF9AC8BCC6}
ELIMINÉ: FirewallRaz (Domain) : NetPres-In-TCP-NoScope
ELIMINÉ: FirewallRaz (Domain) : NetPres-Out-TCP-NoScope
ELIMINÉ: FirewallRaz (None) : NetPres-WSD-In-UDP
ELIMINÉ: FirewallRaz (None) : NetPres-WSD-Out-UDP
ELIMINÉ: FirewallRaz (Public) : NetPres-In-TCP
ELIMINÉ: FirewallRaz (Public) : NetPres-Out-TCP
ELIMINÉ: FirewallRaz (None) : MCX-Prov-Out-TCP
ELIMINÉ: FirewallRaz (None) : MCX-McrMgr-Out-TCP
ELIMINÉ: FirewallRaz (Private) : {85709EA1-B78D-4114-A1CC-D9FB1D277BFF}
ELIMINÉ: FirewallRaz (Private) : {AC9C0F61-2BBF-4E2A-8702-3098AB88DF2D}
ELIMINÉ: FirewallRaz (Private) : {D95055BD-AE92-4D86-B15E-0BDEE350FD2B}
ELIMINÉ: FirewallRaz (Private) : {1B210A4B-9E47-4AEE-8A10-5C4B4D15B4D5}
ELIMINÉ: FirewallRaz (Private) : {AA4589ED-CBC4-4823-AA98-EDC07FF99177}
ELIMINÉ: FirewallRaz (Private) : {A9C34B5C-33FC-498C-9E34-DD42A812DF06}
ELIMINÉ: FirewallRaz (None) : {180F9504-0C23-4105-8C1A-98EA72A473DF}
ELIMINÉ: FirewallRaz (None) : {48335F1B-D152-4643-9DDB-569FF277A432}
ELIMINÉ: FirewallRaz (None) : {6E853463-EC88-46DF-B36B-64EB3C098A23}
ELIMINÉ: FirewallRaz (Public) : {7491931B-A7F8-46CB-AAB2-B6910FCED578}
ELIMINÉ: FirewallRaz (Public) : {6B13FB0F-17AA-4A4B-9D8A-D65AF0BCB3AC}
ELIMINÉ: FirewallRaz (Public) : {86D557BF-B04B-4879-80E8-CDBCA53EA579}
ELIMINÉ: FirewallRaz (Public) : {96153007-3D7E-4C25-B240-12441D919C31}
ELIMINÉ: FirewallRaz (Public) : UDP Query User{831D42C6-409B-4ED9-9BD8-D44649B89A19}E:\fun and work\!-jogos\sierra\empire earth\empire earth.exe
ELIMINÉ: FirewallRaz (Public) : TCP Query User{1A821D78-5E60-4221-9BA5-92AF333B8AFE}E:\fun and work\!-jogos\sierra\empire earth\empire earth.exe
ELIMINÉ: FirewallRaz (Domain) : {0EDDEB1A-984B-4185-BB56-A80A19FF4306}
ELIMINÉ: FirewallRaz (Domain) : {F7632685-EB0D-4B4B-908C-A932E111A709}
ELIMINÉ: FirewallRaz (Public) : {8D76D558-D1AD-463D-8D5E-6C86EC508316}
ELIMINÉ: FirewallRaz (Public) : {2749AE26-896F-4A72-80BB-52E264DB41D1}
ELIMINÉ: FirewallRaz (Domain) : {E7985E1D-C36F-4787-80A8-6350D07E9266}
ELIMINÉ: FirewallRaz (None) : {808F1451-4108-46FD-ADBB-F17324B5F0BD}
ProxyFix : Configuração proxy removida com sucesso
ELIMINÉ ProxyServer Value
ELIMINÉ ProxyEnable Value
ELIMINÉ EnableHttp1_1 Value
ELIMINÉ ProxyHttp1.1 Value
ELIMINÉ ProxyOverride Value

========== Elementos dos dados do Registo ==========
ELIMINÉ: R0 - Main,Start Page = KCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page
ELIMINÉ: R1 Search Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

========== Pastas ==========
ELIMINÉ Temporários windows (0)
ELIMINÉ Flash Cookies (0)
ELIMINÉ: C:\ProgramData\Log
ELIMINÉ: C:\ProgramData\PSafe
ELIMINÉ: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hao123-Brazil
ELIMINÉ: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Loaris Trojan Remover

========== Ficheiros ==========
ELIMINÉ Temporários windows (0) (0 octets)
ELIMINÉ Flash Cookies (0) (0 octets)
ELIMINÉ: c:\windows\prefetch\winupdate.exe-e295b6c7.pf

========== Restauração Sistema ==========
Ponto de restauro do sistema criado com sucesso


========== Recapitulativo ==========
2 : Chaves do Registo
39 : Valores do Registo
2 : Elementos dos dados do Registo
6 : Pastas
3 : Ficheiros
1 : Restauração Sistema


End of clean in 00mn 50s

========== Caminho do ficheiro do relatório ==========
C:\Users\7Heaven\AppData\Roaming\ZHP\ZHPFix[R1].txt - 26/01/2015 22:12:23 [4046]

Boa noite ViniciusDorneles,

• Baixe:<[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem][Tens de ter uma conta e sessão iniciada para poderes visualizar este link]><(...by Smeenk)>
  
• Salve na sua área de trabalho!
  
• Execute o arquivo Zoek.exe.
  
• Usuários do Windows Vista ou Windows 7 clique com o direito sobre o arquivo Zoek.exe, depois clique em
  [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
  
• Selecione as linhas em vermelho, clique com o direito sobre a seleção e escolha a opção copiar!
  
  quickscan;
  autoclean;
  emptyalltemp;
  emptyfolderscheck;delete
  ipconfig /flushdns;b
  
  
  
• Clique com o direito em qualquer parte branca do Zoek e escolha a opção colar.
  
• Clique Run Script!
  
• Aguarde o scan. Ao final abrirá o bloco de notas com o relatório.
  
• Uma cópia também será salva no seu disco local com o nome zoek-results.txt.
  
• Anexe o zoek-results.txt na sua próxima resposta.
  

Um grande abraço.

Z-Analyse V1.0.0.3 Updated 18-01-2015
Tool run by 7Heaven on 26/01/2015 at 22:35:52,88.
Microsoft Windows 8.1 Single Language 6.3.9600 x64
Running in: Normal Mode Internet Access Detected

==== System Restore Info ======================

26/01/2015 22:36:18 Zoek.exe System Restore Point Created Succesfully.

==== C:\zoek_backup content ======================

C:\zoek_backup (files=0 folders=0 0 bytes)

==== After Reboot ======================

==== EOF on 26/01/2015 at 22:57:13,00 ======================

Boa noite ViniciusDorneles, você utilizou a ZA-Scan, mesmo assim o relatório está incompleto. Você deve utilizar a ferramenta Zoek, cujo link para download se encontra no canned acima. Logo depois é só inserir o script proposto na ferramenta, e esperar pelo término. Fico aguardando, um grande abraço.

Zoek.exe v5.0.0.0 Updated 18-01-2015
Tool run by 7Heaven on 26/01/2015 at 23:23:25,15.
Microsoft Windows 8.1 Single Language 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\7Heaven\Documents\[ Atalhos Programas ]\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2015-01-27-015713.log 528 bytes

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1945482154-598400869-252928238-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2cf1e217-9a9a-435d-91f5-42fb3c65719b} deleted successfully
HKEY_USERS\S-1-5-21-1945482154-598400869-252928238-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{38CDEC75-CF04-4324-A53C-7DC623F8A485} deleted successfully
HKEY_USERS\S-1-5-21-1945482154-598400869-252928238-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{38D1F34F-21DF-4949-B9BE-DE961C3C6E92} deleted successfully
HKEY_USERS\S-1-5-21-1945482154-598400869-252928238-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{61a43d0b-f9ac-4ea7-a709-b2f4634b4742} deleted successfully
HKEY_USERS\S-1-5-21-1945482154-598400869-252928238-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{92CDB169-9B95-4327-9299-8EA5A8742DBF} deleted successfully
HKEY_USERS\S-1-5-21-1945482154-598400869-252928238-1002\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F92E1BA5-9269-4218-B884-408088F85E26} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2cf1e217-9a9a-435d-91f5-42fb3c65719b} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{61a43d0b-f9ac-4ea7-a709-b2f4634b4742} deleted successfully

==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== Batch Command(s) Run By Tool======================


==== Deleting Files \ Folders ======================

C:\Users\7Heaven\AppData\Roaming\WB.CFG deleted
C:\Users\7Heaven\AppData\Roaming\StormFall deleted
C:\Users\7Heaven\AppData\Roaming\cdr.ini deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\7Heaven\AppData\Local\StormFall deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted
C:\WINDOWS\SysNative\config\systemprofile\Searches deleted
C:\windows\SysNative\GroupPolicy\Machine deleted
C:\windows\SysNative\GroupPolicy\User deleted
C:\WINDOWS\Syswow64\GroupPolicy\gpt.ini deleted
C:\Users\7Heaven\AppData\Roaming\Mozilla\Firefox\Profiles\ho5TL9ME.default\extensions\abs@avira.com deleted

==== Files Recently Created / Modified ======================

====== C:\WINDOWS ====
====== C:\Users\7Heaven\AppData\Local\Temp ====
====== Java Cache =====
====== C:\WINDOWS\SysWOW64 =====
2015-01-13 20:59:27 DCE9FD22B136C127C85F285E083B928B 65536 ----a-w- C:\WINDOWS\SysWOW64\nlaapi.dll
2015-01-13 20:59:25 D9F17FC61102D89A67A2AA3DD21231F5 33584 ----a-w- C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2015-01-13 20:59:25 BFFD9961B29DAB8084278DB2314D6027 33280 ----a-w- C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2015-01-13 20:59:25 B5867FF96CD0F7712CB4985EAC9F9147 370424 ----a-w- C:\WINDOWS\SysWOW64\AudioSes.dll
2015-01-13 20:59:25 7C36A441C73F079781ABA8F3DAEDFB37 136296 ----a-w- C:\WINDOWS\SysWOW64\wermgr.exe
2015-01-13 20:59:25 7B2643AE85322EA168B0E760B73258FF 424544 ----a-w- C:\WINDOWS\SysWOW64\AudioEng.dll
2015-01-13 20:59:25 4B07B24705A9225EB565650569BDA26B 344536 ----a-w- C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-01-13 20:59:25 1F9C1925A85C6CC592C2FF612A610412 372408 ----a-w- C:\WINDOWS\SysWOW64\Faultrep.dll
2015-01-13 20:59:25 1EB1C1E43C1901865C5AE34A9771C069 448792 ----a-w- C:\WINDOWS\SysWOW64\wer.dll
2015-01-13 20:59:25 1275462A4337DBC5518859316BEF262C 413136 ----a-w- C:\WINDOWS\SysWOW64\WerFault.exe
====== C:\WINDOWS\SysWOW64\drivers =====
====== C:\WINDOWS\Sysnative =====
2015-01-22 01:45:51 DD14C7B54A8C81DDC6E0404CA9817724 1800588 ----a-w- C:\WINDOWS\Sysnative\PerfStringBackup.INI
2015-01-13 20:59:30 29A888F3136B2643E22113B5422B46F9 87040 ----a-w- C:\WINDOWS\Sysnative\TSWbPrxy.exe
2015-01-13 20:59:30 19424364D8C03B990C4281BE53963FD0 225280 ----a-w- C:\WINDOWS\Sysnative\profsvc.dll
2015-01-13 20:59:27 FE11972797DED38CA55E88BD3579F6A2 360448 ----a-w- C:\WINDOWS\Sysnative\ncsi.dll
2015-01-13 20:59:27 E94EB2A95D7D016E119C4D6868788831 391680 ----a-w- C:\WINDOWS\Sysnative\nlasvc.dll
2015-01-13 20:59:27 6319232C1CE39AC35316CF51910EEEB5 86016 ----a-w- C:\WINDOWS\Sysnative\nlaapi.dll
2015-01-13 20:59:25 E24D3259769A0218FE19BB306821C2E5 394120 ----a-w- C:\WINDOWS\Sysnative\AUDIOKSE.dll
2015-01-13 20:59:25 A41B72F81B389786805CC4D5767B5FBC 531616 ----a-w- C:\WINDOWS\Sysnative\ci.dll
2015-01-13 20:59:25 9404704666256045F5BA9B290953B4D0 38264 ----a-w- C:\WINDOWS\Sysnative\WerFaultSecure.exe
2015-01-13 20:59:25 8EBC741DDE9409038262E2F317ED7CCE 535640 ----a-w- C:\WINDOWS\Sysnative\wer.dll
2015-01-13 20:59:25 8779FDAE68BC948B0FE152E758CC8DA7 229888 ----a-w- C:\WINDOWS\Sysnative\AudioEndpointBuilder.dll
2015-01-13 20:59:25 770BAA636F3B61DA7E414421444F84FD 272248 ----a-w- C:\WINDOWS\Sysnative\audiodg.exe
2015-01-13 20:59:25 6F237EE5DDA34EAF3D9C79D4A283E250 482872 ----a-w- C:\WINDOWS\Sysnative\AudioEng.dll
2015-01-13 20:59:25 6DCD12586353DC6307AC781045CA13A4 465320 ----a-w- C:\WINDOWS\Sysnative\WerFault.exe
2015-01-13 20:59:25 428F083690D7AAA012338FD5A0663EE3 500016 ----a-w- C:\WINDOWS\Sysnative\AudioSes.dll
2015-01-13 20:59:25 41C501FD9D42F3F04A8532C73E09F356 108944 ----a-w- C:\WINDOWS\Sysnative\EncDump.dll
2015-01-13 20:59:25 2C354FA91EF605007FD11BB89EED2266 413248 ----a-w- C:\WINDOWS\Sysnative\Faultrep.dll
2015-01-13 20:59:25 0BCDEB035B9346D3C3C6C8BB1AA7F38C 139984 ----a-w- C:\WINDOWS\Sysnative\wermgr.exe
2015-01-13 20:59:24 D1E3B8D9130C70F6A3D4FDB52373FF34 37888 ----a-w- C:\WINDOWS\Sysnative\werdiagcontroller.dll
2015-01-13 20:59:24 61EA45A645854FE81D8A924E2D93DFFE 911360 ----a-w- C:\WINDOWS\Sysnative\audiosrv.dll
====== C:\WINDOWS\Sysnative\drivers =====
2015-01-13 20:59:29 F0CB6DB513CAC393D04A0FCE0A59E1BF 75776 ----a-w- C:\WINDOWS\Sysnative\drivers\ahcache.sys
2015-01-13 20:59:28 DB32958F0E704EFBF7F15161A569E39F 140800 ----a-w- C:\WINDOWS\Sysnative\drivers\mrxdav.sys
====== C:\WINDOWS\Tasks ======
====== C:\WINDOWS\Temp ======
======= C:\Program Files =====
======= C:\PROGRA~2 =====
2015-01-27 00:13:37 -------- d-----w- C:\PROGRA~2\ZHPDiag
======= C: =====
2015-01-27 00:25:03 75F7B6830B469F5C9410AB041E9E9BD7 512 ----a-w- C:\PhysicalDisk0_MBR.bin
2015-01-14 01:54:23 3359C0D472B2F951ECE56E4CAE4A986C 20422 ----a-w- C:\PureRa.txt
====== C:\Users\7Heaven\AppData\Roaming ======
2015-01-27 01:31:01 -------- d-----w- C:\Users\7Heaven\AppData\Local\Temp
2015-01-27 00:13:37 -------- d-----w- C:\Users\7Heaven\AppData\Roaming\ZHP
2015-01-20 12:53:12 -------- d--h--w- C:\Users\7Heaven\AppData\Roaming\nraiqbgic
2015-01-06 12:39:15 -------- d-sh--w- C:\Users\7Heaven\AppData\Local\EmieUserList
2015-01-06 12:39:15 -------- d-sh--w- C:\Users\7Heaven\AppData\Local\EmieSiteList
2015-01-06 12:39:15 -------- d-sh--w- C:\Users\7Heaven\AppData\Local\EmieBrowserModeList
====== C:\Users\7Heaven ======
2015-01-27 00:13:38 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP
2014-12-28 03:02:36 -------- d---a-r- C:\Users\7Heaven\OneDrive

====== C: exe-files ==
2015-01-27 00:16:21 7F2E44CF5671925468D106F1DEBA667F 6872006 ----a-w- C:\Users\7Heaven\Documents\[ Atalhos Programas ]\ZHPDiag2.exe
2015-01-27 00:15:01 685813F39484A95FA2996E6FD32C7C8F 544 ----a-w- C:\$Recycle.Bin\S-1-5-21-1945482154-598400869-252928238-1002\$IRGB0DH.exe
2015-01-27 00:13:38 F3A37421DBD1AAA36558C97572C91C5A 147456 ----a-w- C:\Program Files (x86)\ZHPDiag\catchme.exe
2015-01-27 00:13:38 CB2D120A4B72422A8141192831B1F500 80384 ----a-w- C:\Program Files (x86)\ZHPDiag\mbrcheck.exe
2015-01-27 00:13:38 C155A13687144076286989EF078112C2 1917440 ----a-w- C:\Program Files (x86)\ZHPDiag\ZHPFix\ZHPhep.exe
2015-01-27 00:13:38 9DAA7218961710008D7385B01BD3F386 89088 ----a-w- C:\Program Files (x86)\ZHPDiag\mbr.exe
2015-01-27 00:13:38 6B8AF3A2A3D9059008B55C444461CA00 61952 ----a-w- C:\Program Files (x86)\ZHPDiag\Lads.exe
2015-01-27 00:13:38 5DAF7081A4BB112FA3F1915819330A3E 61440 ----a-w- C:\Program Files (x86)\ZHPDiag\pv.exe
2015-01-27 00:13:38 5BBF2A0351E336646022D09009560CEF 143360 ----a-w- C:\Program Files (x86)\ZHPDiag\FileInfos.exe
2015-01-27 00:13:38 53CDBB093B0AEE9FD6CF1CBD25A95077 290304 ----a-w- C:\Program Files (x86)\ZHPDiag\subinacl.exe
2015-01-27 00:13:38 451AE03D3C92777F09840CA56F08AB62 454056 ----a-w- C:\Program Files (x86)\ZHPDiag\setacl32.exe
2015-01-27 00:13:38 3E350EB5DF15C06DEC400A39DD1C6F29 559528 ----a-w- C:\Program Files (x86)\ZHPDiag\setacl64.exe
2015-01-27 00:13:38 3972143EE1A3AD5C732BE7B96A239BC1 3060224 ----a-w- C:\Program Files (x86)\ZHPDiag\ZHPFix\ZHPFix.exe
2015-01-27 00:13:38 2312A38B8B003330DB919FA818C48449 231048 ----a-w- C:\Program Files (x86)\ZHPDiag\sigcheck.exe
2015-01-27 00:13:37 C155A13687144076286989EF078112C2 1917440 ----a-w- C:\Program Files (x86)\ZHPDiag\ZHPhep.exe
2015-01-27 00:13:37 B2C418B16792E227BF6D18C7261ABCD9 8161792 ----a-w- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe
2015-01-27 00:13:37 8AE13B97BFCAD6C7D3B8C8A1C298EFB4 694736 ----a-w- C:\Program Files (x86)\ZHPDiag\unins000.exe
2015-01-26 23:46:52 C15B3FE9B7AB65A984B7BFD1382DE43E 161280 ----a-w- C:\Users\7Heaven\AppData\Roaming\nraiqbgic\winproc.exe
2015-01-26 23:46:52 C15B3FE9B7AB65A984B7BFD1382DE43E 161280 ----a-w- C:\Users\7Heaven\AppData\Roaming\nraiqbgic\udphost32.exe
2015-01-26 23:46:52 C15B3FE9B7AB65A984B7BFD1382DE43E 161280 ----a-w- C:\Users\7Heaven\AppData\Roaming\nraiqbgic\hpprocess32.exe
2015-01-26 23:46:52 C15B3FE9B7AB65A984B7BFD1382DE43E 161280 ----a-w- C:\Users\7Heaven\AppData\Roaming\nraiqbgic\dllsys32.exe
2015-01-26 23:46:52 C15B3FE9B7AB65A984B7BFD1382DE43E 161280 ----a-w- C:\Users\7Heaven\AppData\Roaming\nraiqbgic\cmdmon.exe
2015-01-26 23:43:18 C15B3FE9B7AB65A984B7BFD1382DE43E 161280 ----a-w- C:\Users\7Heaven\AppData\Roaming\nraiqbgic\intelprocess64.exe
2015-01-23 00:36:23 F1A2E9146124E17D752AAACAE7D8F6EC 7265872 ----a-w- C:\Program Files (x86)\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\40.0.2214.91\40.0.2214.91_39.0.2171.99_chrome_updater.exe
=== C: other files ==

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-21-1945482154-598400869-252928238-1002\Software\Microsoft\Windows\CurrentVersion\Run]
"ares"="C:\Program Files (x86)\Ares\Ares.exe -h"
"HW_OPENEYE_OUC_VIVO INTERNET"="C:\Program Files (x86)\VIVO INTERNET\UpdateDog\ouc.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe 60"
"CLMLServer_For_P2G8"="C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe"
"CLVirtualDrive"="C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe /R"
"RemoteControl10"="C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"
"mcui_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey"
"GSMEjector"="C:\Program Files (x86)\Oi\Oi3G\GSMCliEjector.exe"
"Avira Systray"="C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe"
"avgnt"="C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe /min"
"iTunesHelper"="C:\Program Files (x86)\iTunes\iTunesHelper.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ares"="C:\Program Files (x86)\Ares\Ares.exe -h"
"HW_OPENEYE_OUC_VIVO INTERNET"="C:\Program Files (x86)\VIVO INTERNET\UpdateDog\ouc.exe"

==== Startup Registry Enabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\DellTPad\Apoint.exe"
"QuickSet"="c:\Program Files\Dell\QuickSet\QuickSet.exe"
"IntelTBRunOnce"="wscript.exe //b //nologo C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
"SmartAudio"="C:\Program Files\CONEXANT\SA3\SACpl.exe /sa3 /nv:3.0+ /dne /s"
"BtTray"="C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtTray.exe"
"BtvStack"="C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe"
"IgfxTray"="C:\Windows\system32\igfxtray.exe"
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe"
"Persistence"="C:\Windows\system32\igfxpers.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" ,C:\\Windows\\system32\\nvinitx.dll "

==== Startup Folders ======================

2014-12-09 15:14:32 1207 ----a-w- C:\Users\7Heaven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
2014-09-01 02:09:14 1311 ----a-w- C:\Users\7Heaven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk
2015-01-20 12:53:16 1078 ----a-w- C:\Users\7Heaven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Explorer.lnk
2014-10-08 13:58:14 2116 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
2015-01-21 12:23:38 1161 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Windows Explorer.lnk

==== Task Scheduler Jobs ======================

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job --a-------- [Undetermined Task]
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job --a-------- [Undetermined Task]

==== Other Scheduled Tasks ======================

"C:\WINDOWS\SysNative\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe]
"C:\WINDOWS\SysNative\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe]
"C:\WINDOWS\SysNative\tasks\PCDEventLauncherTask" ["C:\Program Files\My Dell\sessionchecker.exe"]
"C:\WINDOWS\SysNative\tasks\PCDoctorBackgroundMonitorTask" ["C:\Program Files\My Dell\uaclauncher.exe"]
"C:\WINDOWS\SysNative\tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1945482154-598400869-252928238-1002" [C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe]
"C:\WINDOWS\SysNative\tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1945482154-598400869-252928238-1002" [C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe]
"C:\WINDOWS\SysNative\tasks\SystemToolsDailyTest" ["uaclauncher.exe"]
"C:\WINDOWS\SysNative\tasks\Apple\AppleSoftwareUpdate" [C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe]
"C:\WINDOWS\SysNative\tasks\Dell\Dell System Registration" [C:\Program Files (x86)\System Registration\prodreg.exe]
"C:\WINDOWS\SysNative\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask" [%systemroot%\system32\sc.exe start osppsvc]

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"{4ED1F68A-5463-4931-9384-8FFF5ED91D92}"="C:\Program Files (x86)\McAfee\SiteAdvisor" [20/12/2014 15:34]

==== Firefox Extensions ======================

==== Firefox Plugins ======================


==== Fake Chromium Profiles Check ======================

Fake profile C:\Users\7Heaven\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\7Heaven\AppData\Local\Comodo\Dragon deleted
Fake profile C:\Users\Administrador\AppData\Local\Google\Chrome deleted
Fake profile C:\Users\Administrador\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\Administrador\AppData\Local\Comodo\Dragon deleted
Fake profile C:\Users\Convidado\AppData\Local\Google\Chrome deleted
Fake profile C:\Users\Convidado\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\Convidado\AppData\Local\Comodo\Dragon deleted
Fake profile C:\Users\F01\AppData\Local\Google\Chrome deleted
Fake profile C:\Users\UpdatusUser\AppData\Local\Google\Chrome deleted
Fake profile C:\Users\UpdatusUser\AppData\Local\Google\Chrome SxS deleted
Fake profile C:\Users\UpdatusUser\AppData\Local\Comodo\Dragon deleted

==== Chromium Look ======================

Google Chrome Version: 40.0.2214.91 (Possible outdated, latest Stable version: 40.0.2214.93)

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
fheoggkfdfchfphceeifdbepaooicaho - No path found[]
flliilndjeohchalpbbcdekjklbdgfkk - No path found[]
idhngdhcfkoamngbedgpaokgjbnpdiji - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx[16/04/2013 03:11]

Google Slides - 7Heaven\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek
Google Docs - 7Heaven\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake
Google Drive - 7Heaven\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf
YouTube - 7Heaven\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Adblock for Youtube - 7Heaven\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmedhionkhpnakcndndgjdbohmhepckk
Google Search - 7Heaven\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
Google Sheets - 7Heaven\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap
Avira Browser Safety - 7Heaven\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk
AdBlock - 7Heaven\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom
SmartVideo - 7Heaven\AppData\Local\Google\Chrome\User Data\Default\Extensions\lnkdbjbjpnpjeciipoaflmpcddinpjjp
Google Wallet - 7Heaven\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Gmail - 7Heaven\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://google.com"
"Search Page"="http://google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{DCE479FA-F99E-4534-8E15-4F8CC122861E}"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DCE479FA-F99E-4534-8E15-4F8CC122861E}] not found

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Start Page"="http://google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1945482154-598400869-252928238-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3049C3E9-B461-4BC5-8870-4C09146192CA} deleted successfully
HKEY_USERS\S-1-5-21-1945482154-598400869-252928238-1002\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3049C3E9-B461-4BC5-8870-4C09146192CA} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{3049C3E9-B461-4BC5-8870-4C09146192CA} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA} deleted successfully

==== Deleting CLSID Registry Values ======================


==== Empty IE Cache ======================

C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\7Heaven\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\F01\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\ISA\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\7Heaven\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

No FireFox Cache found

==== Empty Chrome Cache ======================

C:\Users\7Heaven\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=131 folders=36 7934016 bytes)

==== Empty Temp Folders ======================

C:\Users\7Heaven\AppData\Local\Temp will be emptied at reboot
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\ISA\AppData\Local\Temp emptied successfully
C:\Users\UpdatusUser\AppData\Local\Temp emptied successfully
C:\Users\USURIO~1\AppData\Local\Temp emptied successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp will be emptied at reboot
C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\WINDOWS\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied
C:\Users\7Heaven\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp\Low" not deleted

==== EOF on 26/01/2015 at 23:47:22,00 ======================

Boa noite ViniciusDorneles, como está o PC ? Você utilizou algum pendrive, ou alguma outra mídia removível em seu equipamento ?

meu PC esta bem melhor, mais rapido e não ta travando.

Coloquei um pendrive de um colega de trabalho no meu pc, depois ele começou a ficar assim;

Foi por causa dele?

Boa noite ViniciusDorneles, pode ter sido. Tem como ter acesso à esse pendrive ? Se não pode executar a ferramenta assim mesmo.

• Baixe: <[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]> (...por El Desaparecido)
  
• Salve-a na Desktop (Área de trabalho)
  
• Abra a ferramenta UsbFix >> Clique: Opções
  [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
  
• Marque a caixa "Desativar Autorun/AutoPlay".
  [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
  
• Clique "Aplicar".
  
• Insira,agora,seu pendrive infectado e na tela principal da ferramenta,clique "Limpar".
  
• Poste o relatório!
  

Um grande abraço. E amanhã nós continuamos, pois está ficando muito tarde.

Pegarei os pendrives amanha tambem.

Ate amanha o/

boa noite

Oi, desculpe, mas tava com uma semana muito cheia, só hoje consegui entrar na net.

Tentei baixar o arquivo, mas não consegui, alguma coisa aconteceu com meu PC que toda hora esta aparecendo que não conseguindo instalar um programa [ coloquei na imagem ] e meu antivirus não consegue deletar um vírus chamdo JS/05 e o mesmo esta deixando meu PC muito lento.

Não mexe nele desde aquele dia que eu postei o meu problema neste forum.

O que aconteceu?

Boa noite ViniciusDorneles, você não conseguiu executar a ferramenta, ou logo após utilizar a ferramenta USBFix ocorreu esse erro ?

Tópico Arquivado

Como o autor não respondeu por mais de 45 dias, o tópico foi arquivado. Caso o autor do tópico necessite, o mesmo será reaberto, para isso deverá entrar em contato com um dos membros da [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] solicitando o desbloqueio.