pc infectado

Rapport de ZHPFix 2015.2.12.2 par Nicolas Coolman, Update du 12/02/2015
Fichier d'export Registre :
Run by emle at 15/02/2015 12:26:14
High Elevated Privileges : OK
Windows 8 Home Premium Edition, 64-bit Service Pack 1 (9600)

Reciclagem vazia (00mn 02s)
Reparação de atalhos do navegador

========== Chaves do Registo ==========
ELIMINÉ: Service: Stpro
ELIMINÉ: HKCU\Software\AppDataLow\Software\CheckMeUp
ELIMINÉ: HKCU\Software\Baidu Security
ELIMINÉ: HKCU\Software\UpdateYTD
ELIMINÉ:* HKLM\Software\Baidu Security
ELIMINÉ: HKLM\Software\Wow6432Node\Ssearch
ELIMINÉ: HKLM\Software\Wow6432Node\baidu

========== Valores do Registo ==========
ELIMINÉ RunValue: SynTPEnh

========== Pastas ==========
Nenhuma pasta CLSID local utilizador vazia

========== Ficheiros ==========
ELIMINA REINICIAR: c:\program files (x86)\stpro\stpro.exe
ELIMINA REINICIAR: c:\windows\system32\drivers\msft_kernel_webtinst_01009.wdf
ELIMINA REINICIAR: c:\windows\system32\bdsandboxdll64.dll
ELIMINÉ Temporários windows (0) (0 octets)
ELIMINÉ Flash Cookies (0) (0 octets)

========== Tarefa planificada ==========
ELIMINÉ: DriverAssist.Autostart
ELIMINÉ: DriverAssist.Scanning
ELIMINÉ: DriverAssist.Scanning
ELIMINÉ: DriverAssist.ScanningFull
ELIMINÉ: XQPMJO

========== Restauração Sistema ==========
Ponto de restauro do sistema criado com sucesso


========== Recapitulativo ==========
7 : Chaves do Registo
1 : Valores do Registo
1 : Pastas
5 : Ficheiros
5 : Tarefa planificada
1 : Restauração Sistema


End of clean in 00mn 20s

========== Caminho do ficheiro do relatório ==========
C:\Users\emle\AppData\Roaming\ZHP\ZHPFix[R1].txt - 15/02/2015 12:26:17 [1622]

Zoek.exe v5.0.0.0 Updated 15-February-2015
Tool run by emle on 15/02/2015 at 11:54:38,61.
Microsoft Windows 8.1 Single Language com o Bing 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\emle\Desktop\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2015-02-14-224237.log 21242 bytes

==== System Restore Info ======================

15/02/2015 11:55:20 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

==== Empty Folders Check ======================

C:\PROGRA~3\cfb7e34302e345f9a579b07a7bc32829 deleted successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\emle\AppData\Roaming\Mozilla\Firefox\Profiles\ubh3992b.default\prefs.js:
user_pref("browser.startup.homepage", "[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
user_pref("browser.search.defaulturl", "[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "(Google)");
user_pref("keyword.URL", "https://www.google.com/search?q=");

Added to C:\Users\emle\AppData\Roaming\Mozilla\Firefox\Profiles\ubh3992b.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Deleting Files \ Folders ======================

C:\PROGRA~3\cfb7e34302e345f9a579b07a7bc32829 not found
C:\Users\emle\AppData\Roaming\Baidu deleted
C:\PROGRA~3\Baidu deleted
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\ICSharpCode.net deleted
C:\windows\SysNative\tasks\060184C3-9766-46a0-B258-F4518A0B2633 deleted
C:\windows\SysNative\tasks\94A46359-5537-4201-BEFD-1EC63DFD0943 deleted
C:\windows\SysNative\GroupPolicy\Machine deleted
C:\windows\SysNative\GroupPolicy\User deleted
C:\Windows\Syswow64\GroupPolicy\gpt.ini deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\emle\AppData\Roaming\Mozilla\Firefox\Profiles\ubh3992b.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions ======================

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================


==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms}"
{2254C728-66FF-4FD6-9070-E03F6A9C088E} Unknown Url="Not_Found"

==== Reset Google Chrome ======================

Nothing found to reset

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-956575514-692205280-2611169239-1001\Software\Microsoft\Internet Explorer\SearchScopes\{2254C728-66FF-4FD6-9070-E03F6A9C088E} deleted successfully

==== Deleting CLSID Registry Values ======================


==== shortcuts on Users Desktops ======================

C:\Users\emle\Desktop\ZHPCleaner.lnk - C:\Users\emle\AppData\Roaming\ZHP\ZHPCleaner.exe
C:\Users\emle\Desktop\ZHPDiag.lnk - C:\Program Files (x86)\ZHPDiag\ZHPhep.exe
C:\Users\emle\Desktop\ZHPFix.lnk - C:\Program Files (x86)\ZHPDiag\ZHPFix\ZHPhep.exe

==== shortcuts on All Users Desktop ======================

C:\Users\Public\Desktop\Adobe Reader XI.lnk - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
C:\Users\Public\Desktop\Fotor.lnk - C:\Fabricante\Positivo Store Apps Atalhos\CallMetroApp.exe EverimagingCo.Limited.Fotor
C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
C:\Users\Public\Desktop\Manual do Usuário.lnk -
C:\Users\Public\Desktop\Microsoft Office.lnk - C:\Program Files (x86)\Microsoft Office\Office15\FIRSTRUN.EXE /OEM
C:\Users\Public\Desktop\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Public\Desktop\Mundo Positivo.lnk - C:\Fabricante\Positivo Store Apps Atalhos\CallMetroApp.exe 908F1E4E.MundoPositivo
C:\Users\Public\Desktop\Positivo 3D Incrível.lnk -
C:\Users\Public\Desktop\Positivo Dicas.lnk - C:\Fabricante\Positivo Store Apps Atalhos\CallMetroApp.exe 908F1E4E.PositivoAjudante
C:\Users\Public\Desktop\Positivo Horóscopo.lnk -
C:\Users\Public\Desktop\Positivo Jogos.lnk - C:\Fabricante\Positivo Jogos Atalhos
C:\Users\Public\Desktop\Positivo Mulher.lnk - C:\Fabricante\Positivo Store Apps Atalhos\CallMetroApp.exe 908F1E4E.PositivoMulher
C:\Users\Public\Desktop\Positivo Músicas DJ.lnk -
C:\Users\Public\Desktop\Positivo Verde e Amarelo.lnk - C:\Fabricante\Positivo Store Apps Atalhos\CallMetroApp.exe 908F1E4E.PositivoVerdeeAmarelo
C:\Users\Public\Desktop\Promoção Vivo.lnk -
C:\Users\Public\Desktop\Skype.lnk - C:\Fabricante\Positivo Store Apps Atalhos\CallMetroApp.exe Microsoft.SkypeApp
C:\Users\Public\Desktop\Windows Live Movie Maker.lnk - C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.exe
C:\Users\Public\Desktop\xbmc.lnk - C:\Program Files (x86)\XBMC\XBMC.exe

==== shortcuts in Users Start Menu ======================

C:\Users\emle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe

==== shortcuts in All Users Start Menu ======================

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Desinstalar Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Malwarebytes Anti-Malware Notifications.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\Chameleon\Windows\chameleon.chm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP\ZHPDiag.lnk - C:\Program Files (x86)\ZHPDiag\ZHPhep.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP\ZHPFix.lnk - C:\Program Files (x86)\ZHPDiag\ZHPFix\ZHPhep.exe

==== shortcuts in Quick Launch ======================

C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\emle\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\emle\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\emle\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\emle\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk -
C:\Users\emle\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -

==== Reset IE Proxy ======================

Value(s) before fix:
"ProxyEnable"=dword:00000000

Value(s) after fix:
"ProxyEnable"=dword:00000000

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\emle\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\emle\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\emle\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Users\emle\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

C:\Users\emle\AppData\Local\Mozilla\Firefox\Profiles\ubh3992b.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\emle\AppData\Local\Google\Chrome\User Data\Default\Cache will be emptied at reboot

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=61 folders=30 22049583 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\emle\AppData\Local\Temp will be emptied at reboot
C:\Users\USURIO~1\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\emle\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\emle\AppData\Local\Google\Chrome\User Data\Default\Cache\data_0" deleted
"C:\Users\emle\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1" deleted
"C:\Users\emle\AppData\Local\Google\Chrome\User Data\Default\Cache\data_2" deleted
"C:\Users\emle\AppData\Local\Google\Chrome\User Data\Default\Cache\data_3" deleted
"C:\Users\emle\AppData\Local\Google\Chrome\User Data\Default\Cache\index" deleted

==== EOF on 15/02/2015 at 12:23:16,18 ======================

Quanto ao Zoek faça exatamente como te pedi, por gentileza, colocando este script abaixo nele:

C:\ProgramData\SmartProtect\SmartProtect.exe;virustotal
C:\Users\emle\AppData\Local\Ap\MTResources\spdrmn.dll;virustotal
C:\Users\emle\AppData\Local\Ap\Updater.exe;virustotal
C:\Windows\System32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat;virustotal
C:\Fabricante\psvxbmc.exe;virustotal

Depois poste o novo log que ele irá gerar.

Zoek.exe v5.0.0.0 Updated 15-February-2015
Tool run by emle on 15/02/2015 at 13:19:41,31.
Microsoft Windows 8.1 Single Language com o Bing 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\emle\Desktop\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2015-02-14-224237.log 21242 bytes
C:\zoek-results2015-02-15-142316.log 12450 bytes

==== VirusTotal Scan ======================

C:\ProgramData\SmartProtect\SmartProtect.exe not found
C:\Users\emle\AppData\Local\Ap\MTResources\spdrmn.dll [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
C:\Users\emle\AppData\Local\Ap\Updater.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
C:\Windows\System32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
C:\Fabricante\psvxbmc.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

==== C:\zoek_backup content ======================

C:\zoek_backup (files=61 folders=30 22049583 bytes)

==== EOF on 15/02/2015 at 13:21:48,68 ======================

como está o computador?

100% max !!! tudo certinho navegando corretamente baidu e aquelas tranqueiras sumiram tudo obrigado mais uma vez pela ajuda !!!

Fico feliz que o problema tenha sido resolvido.

Só para finalizar siga estes tutoriais abaixo, por gentileza:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
_______________________________________________________________________________________________________________________

Para remover os programas usados na limpeza deste PC e criar um novo ponto de restauração seguro e sem problemas, utilize o DelFix seguindo as dicas [Tens de ter uma conta e sessão iniciada para poderes visualizar este link].
_______________________________________________________________________________________________________________________

Foi um prazer ajudar. Conte sempre conosco!

CASO RESOLVIDO

Necessitando nova verificação para este computador, basta abrir um Novo Tópico e relatar o problema.