Notebook lento e mouse com bolinha girando o tempo todo

Meu notebook ficou lento e com o mouse com a bolinha girando o tempo todo depois que eu tentei instalar o HD Vdeck, como não consegui desinstalei fiz a restauração do sistema mas eu continua lento e com o mouse com a bolinha girando o tempo todo.

/!\ Bom Dia! Danilo Marsaro /!\

> Creio estar cheia a memória! E a Restauração pode não ter sido efetiva.
> Se conseguir acessar o Modo Seguro com rede,baixe a adwcleaner e a execute.

> Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > ( ... par Xplode )

> Ou daqui: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] >
> Ao acessar,clique em "Download Now".

> Salve-o no desktop!

< [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem] >

> Clique direito em adwcleaner.exe,e escolha sua execução como administrador.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Abra a ferramenta e na guia "Opções",assinale todas as Restaurações.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Ps: Dê início ao scan,clicando em "Verificar" ou "Examinar".

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Ao concluir,clique "Limpar" ou "Cleaning" >> Ok >> Ok >> Ok.
> Copie o log ou clique "Relatorio".
> Poste: < C:\AdwCleaner\AdwCleaner[S0].txt >

A+

Eata dando erro no adwcleaner ao limpar.

/!\ Bom Dia! Danilo Marsaro /!\

> Execute o adwcleaner em Modo de Segurança.

Abs!

Meu notebook ainda continua meio lento, e o som dele agora está estourando será que é vírus?

Relatório adw cleaner

# AdwCleaner v5.023 - Relatório criado 04/12/2015 às 10:38:10
# Atualizado 30/11/2015 por Xplode
# Banco de dados : 2015-12-03.1 [Servidor]
# Sistema operacional : Windows 8.1 Connected (x64)
# Usuário : pc - PCPC
# Executando de : C:\Users\pc\Desktop\AdwCleaner.exe
# Opção : Limpar
# Apoio : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

***** [ Serviços ] *****


***** [ Pastas ] *****


***** [ Arquivos ] *****


***** [ DLLs ] *****


***** [ Atalhos ] *****


***** [ Tarefas agendadas ] *****


***** [ Registro ] *****

[-] Valor Excluída : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [AppsHat]
[-] Chave Excluída : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
[-] Chave Excluída : HKCU\Software\Mozilla\Extends
[-] Valor Excluída : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [sweetsearch@gmail.com]
[-] Valor Excluída : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [searchffv2@gmail.com]
[-] Chave Excluída : HKCU\Software\PIP
[-] Chave Excluída : HKCU\Software\simplytech
[-] Chave Excluída : HKCU\Software\Webplayer
[-] Chave Excluída : HKCU\Software\TNT2
[!] Chave Não Excluída : HKCU\Software\Mozilla\Extends
[-] Chave Excluída : HKLM\SOFTWARE\istartsurfSoftware
[-] Chave Excluída : HKLM\SOFTWARE\PIP
[-] Chave Excluída : HKLM\SOFTWARE\supWindowsMangerProtect
[-] Chave Excluída : HKLM\SOFTWARE\oursurfingSoftware
[-] Chave Excluída : HKLM\SOFTWARE\FFPluginHp
[-] Chave Excluída : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\AppsHat Mobile Apps
[-] Chave Excluída : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
[-] Chave Excluída : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar
[-] Chave Excluída : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
[-] Chave Excluída : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
[-] Chave Excluída : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com
[-] Chave Excluída : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
[-] Chave Excluída : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{D01A33E2-0A34-4659-82AA-8A90C51C0D21}
[-] Chave Excluída : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP
[-] Chave Excluída : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar
[-] Chave Excluída : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\istartsurf uninstall
[-] Chave Excluída : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
[-] Chave Excluída : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance
[-] Chave Excluída : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com
[-] Chave Excluída : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Linkey
[-] Chave Excluída : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D01A33E2-0A34-4659-82AA-8A90C51C0D21}
[-] Dados Restaurar : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
[-] Dados Restaurar : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
[-] Dados Restaurar : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
[-] Dados Restaurar : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
[-] Dados Restaurar : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
[-] Dados Restaurar : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
[-] Dados Restaurar : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
[-] Dados Restaurar : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
[-] Dados Restaurar : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
[-] Chave Excluída : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
[-] Chave Excluída : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
[-] Dados Restaurar : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes [DefaultScope]
[-] Dados Restaurar : HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command []
[-] Dados Restaurar : HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command []

***** [ Navegadores ] *****

[-] [C:\Users\pc\AppData\Roaming\Mozilla\Firefox\Profiles\rq1v32qz.default\prefs.js] [Preference] Excluída : user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");
[-] [C:\Users\pc\AppData\Roaming\Mozilla\Firefox\Profiles\rq1v32qz.default\prefs.js] [Preference] Excluída : user_pref("browser.search.defaultenginename", "istartsurf");
[-] [C:\Users\pc\AppData\Roaming\Mozilla\Firefox\Profiles\rq1v32qz.default\prefs.js] [Preference] Excluída : user_pref("browser.search.selectedEngine", "istartsurf");
[-] [C:\Users\pc\AppData\Roaming\Mozilla\Firefox\Profiles\rq1v32qz.default\prefs.js] [Preference] Excluída : user_pref("extensions.quick_start.enable_search1", false);
[-] [C:\Users\pc\AppData\Roaming\Mozilla\Firefox\Profiles\rq1v32qz.default\prefs.js] [Preference] Excluída : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);
[-] [C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Default_Search_Provider] Excluído : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
[-] [C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Default_Search_Provider_Data] Excluído : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

*************************

:: Chaves "Tracing" excluídas
:: Configurações Proxy restauradas
:: Configurações Winsock restauradas
:: Configurações TCP/IP restauradas
:: Configurações do Firewall restauradas
:: Configurações IPSec restauradas
:: Políticas do Chrome excluídas

########## EOF - C:\AdwCleaner\AdwCleaner[C2].txt - [6007 bytes] ##########

/!\ Boa Tarde! Danilo Marsaro /!\

> Siga na ordem dada,estas ferramentas!

> Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > ( ... by Malwarebytes.org )

> Salve-o no desktop!
> Desabilite seu antivírus!
> Para Windows 7,clique direito em JRT.exe e execute-o ... 

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

> Aguarde a conclusão e poste o relatório. ( JRT.txt )

> Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > ( ... by smeenk )
> Salve a ferramenta ZA-Scan,no desktop! ( Área de trabalho )
> Feche o navegador! << Importante!
> Desabilite seu antivírus,para que não detecte a ferramenta,como maliciosa.
> Execute-a e aguarde sua conclusão!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Poste o relatório! ( C:\ZA-Scan.txt )

Abs!

não consigo baixar smeenk, desabilitei o anti vírus mais quando tento baixar cai numa página e site malicioso .

/!\ Boa Tarde! Danilo Marsaro /!\

> Execute primeiramente a JRT,depois irei dispor a ferramenta ZA-Scan em um host-servidor.
> Poste o log da JRT.

A+

Relatório JRT:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.1 (11.24.2015)
Operating System: Windows 8.1 Connected x64
Ran by pc (Administrator) on 06/12/2015 at 14:34:47,74
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 5

Successfully deleted: C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdalhedleemkkdjddjgfjmcnbpejpapp (Folder)
Successfully deleted: C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\icpgjfneehieebagbmdbhnlpiopdcmna (Folder)
Successfully deleted: C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gdalhedleemkkdjddjgfjmcnbpejpapp_0.localstorage-journal (File)
Successfully deleted: C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_gdalhedleemkkdjddjgfjmcnbpejpapp_0.localstorage (File)
Successfully deleted: C:\Users\pc\AppData\Roaming\sp_data.sys (File)

Deleted the following from C:\Users\pc\AppData\Roaming\Mozilla\Firefox\Profiles\rq1v32qz.default\prefs.js
user_pref(browser.search.searchengine.alias, istartsurf);
user_pref(browser.search.searchengine.desc, this is my first firefox searchEngine);
user_pref(browser.search.searchengine.iconURL, [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
user_pref(browser.search.searchengine.name, istartsurf);
user_pref(browser.search.searchengine.ptid, smt);
user_pref(browser.search.searchengine.uid, WDCXWD5000LPVX-80V0TT0_WD-WX91A64C8Z0LC8Z0L);
user_pref(browser.search.searchengine.url, [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
user_pref(extensions.xpiState, {\app-profile\:{\searchffv2@gmail.com\:{\d\:\C:\\\\Users\\\\pc\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\rq1v32qz.def



Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06/12/2015 at 14:40:56,78
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

/!\ Boa Tarde! Danilo Marsaro /!\

< [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] >

> Ao baixar este arquivo (abc.exe),ao desktop,procure renomeá-lo para ZA-Scan.
> Execute-o e ao concluir,poste o relatório! (ZA-Scan.txt)

A+

Relatório ZA-Scan:


ZA-Scan V1.0.0.5 Updated 05-December-2015
Tool run by pc on 06/12/2015 at 15:45:15,28.
Microsoft Windows 8.1 com o Bing 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\pc\Desktop\ZA-Scan.exe [Z-Analyse Scan]

==== Running Processes ======================

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\avp.exe
C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
C:\Program Files (x86)\Nero\Update\NASvc.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\avpui.exe
C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\cmd.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\plugin-nm-server.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\klwtblfs.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\pc\Desktop\ZA-Scan.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
C:\Users\pc\AppData\Local\Temp\ZAScan.exe

==== Services(whitelist) ======================
Powered by [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

R2 - [AdobeARMservice] - Adobe Acrobat Update Service - c:\program files (x86)\common files\adobe\arm\1.0\armsvc.exe
R2 - [ASLDRService] - ASLDR Service - c:\program files (x86)\asus\atk package\atk hotkey\asldrsrv.exe
R2 - [Asus WebStorage Windows Service] - Asus WebStorage Windows Service - c:\program files (x86)\asus\webstorage\2.1.2.301\asuswswinservice.exe
R2 - [ATKGFNEXSrv] - ATKGFNEX Service - c:\program files (x86)\asus\atk package\atkgfnex\gfnexsrv.exe
R2 - [AVP15.0.0] - Serviço do Kaspersky Anti-Virus 15.0.0 - c:\program files (x86)\kaspersky lab\kaspersky anti-virus 15.0.0\avp.exe
R2 - [c2cautoupdatesvc] - Skype Click to Call Updater - c:\program files (x86)\skype\toolbars\autoupdate\skypec2cautoupdatesvc.exe
R2 - [c2cpnrsvc] - Skype Click to Call PNR Service - c:\program files (x86)\skype\toolbars\pnrsvc\skypec2cpnrsvc.exe
R2 - [Intel(R) Capability Licensing Service Interface] - Intel(R) Capability Licensing Service Interface - c:\program files\intel\txe components\tcs\heciserver.exe
R2 - [NAUpdate] - Nero Update - c:\program files (x86)\nero\update\nasvc.exe
R2 - [WMPNetworkSvc] - Serviço de Compartilhamento de Rede do Windows Media Player - c:\program files\windows media player\wmpnetwk.exe
R2 - [WSearch] - Windows Search - c:\windows\system32\searchindexer.exe
S2 - [gupdate] - Serviço do Google Update (gupdate) - c:\program files (x86)\google\update\googleupdate.exe
S2 - [SkypeUpdate] - Skype Updater - c:\program files (x86)\skype\updater\updater.exe
S2 - [sppsvc] - Proteção de Software - c:\windows\system32\sppsvc.exe
S3 - [AdobeFlashPlayerUpdateSvc] - Adobe Flash Player Update Service - c:\windows\syswow64\macromed\flash\flashplayerupdateservice.exe
S3 - [ALG] - Serviço Gateway de Camada de Aplicativo - c:\windows\system32\alg.exe
S3 - [COMSysApp] - COM+ System Application - c:\windows\system32\dllhost.exe
S3 - [cphs] - Intel(R) Content Protection HECI Service - c:\windows\syswow64\intelcphecisvc.exe
S3 - [Fax] - Fax - c:\windows\system32\fxssvc.exe
S3 - [FontCache3.0.0.0] - Windows Presentation Foundation Font Cache 3.0.0.0 - c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe
S3 - [gupdatem] - Serviço do Google Update (gupdatem) - c:\program files (x86)\google\update\googleupdate.exe
S3 - [ICCS] - Intel(R) Integrated Clock Controller Service - Intel(R) ICCS - c:\program files (x86)\intel\intel(r) integrated clock controller service\iccproxy.exe
S3 - [IEEtwCollectorService] - Serviço Coletor ETW do Internet Explorer - c:\windows\system32\ieetwcollector.exe
S3 - [Intel(R) Capability Licensing Service TCP IP Interface] - Intel(R) Capability Licensing Service TCP IP Interface - c:\program files\intel\txe components\tcs\socketheciserver.exe
S3 - [MozillaMaintenance] - Mozilla Maintenance Service - c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe
S3 - [MSDTC] - Coordenador de transações distribuídas - c:\windows\system32\msdtc.exe
S3 - [msiserver] - Windows Installer - c:\windows\system32\msiexec.exe
S3 - [ose64] - Office 64 Source Engine - c:\program files\common files\microsoft shared\source engine\ose.exe
S3 - [PerfHost] - Host de DLL de Contador de Desempenho - c:\windows\syswow64\perfhost.exe
S3 - [RpcLocator] - Alocador Remote Procedure Call (RPC) - c:\windows\system32\locator.exe
S3 - [SNMPTRAP] - Interceptação SNMP - c:\windows\system32\snmptrap.exe
S3 - [Steam Client Service] - Steam Client Service - c:\program files (x86)\common files\steam\steamservice.exe
S3 - [TrustedInstaller] - Instalador de Módulos do Windows - c:\windows\servicing\trustedinstaller.exe
S3 - [vds] - Disco Virtual - c:\windows\system32\vds.exe
S3 - [VSS] - Cópia de Sombra de Volume - c:\windows\system32\vssvc.exe
S3 - [wbengine] - Serviço de Mecanismo de Backup em Nível de Bloco - c:\windows\system32\wbengine.exe
S3 - [WdNisSvc] - Serviço de Inspeção de Rede do Windows Defender - c:\program files\windows defender\nissrv.exe
S3 - [WinDefend] - Serviço Windows Defender - c:\program files\windows defender\msmpeng.exe
S3 - [wmiApSrv] - Adaptador de Desempenho WMI - c:\windows\system32\wbem\wmiapsrv.exe

==== Drivers(whitelist) ======================
Powered by [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

R0 - [FileInfo] - File Information FS MiniFilter - C:\Windows\system32\Drivers\FileInfo.sys
R0 - [FltMgr] - FltMgr - C:\Windows\system32\Drivers\FltMgr.sys
R0 - [Mup] - Mup - C:\Windows\system32\Drivers\Mup.sys
R0 - [Wof] - Windows Overlay File System Filter Driver - C:\Windows\system32\Drivers\Wof.sys
R1 - [NetBIOS] - NetBIOS Interface - C:\Windows\system32\Drivers\NetBIOS.sys
R2 - [srv] - Driver SMB 1.xxx do Servidor - C:\Windows\system32\Drivers\srv.sys
R3 - [srv2] - Driver SMB 2.xxx do Servidor - C:\Windows\system32\Drivers\srv2.sys
R0 - [ACPI] - Microsoft ACPI Driver - C:\Windows\system32\Drivers\ACPI.sys
R0 - [acpiex] - Microsoft ACPIEx Driver - C:\Windows\system32\Drivers\acpiex.sys
R0 - [CLFS] - Common Log (CLFS) - C:\Windows\system32\Drivers\CLFS.sys
R0 - [CNG] - CNG - C:\Windows\system32\Drivers\CNG.sys
R0 - [disk] - Driver de disco - C:\Windows\system32\Drivers\disk.sys
R0 - [EhStorClass] - Enhanced Storage Filter Driver - C:\Windows\system32\Drivers\EhStorClass.sys
R0 - [fvevol] - Driver de Filtro de Criptografia de Unidade de Disco BitLocker - C:\Windows\system32\Drivers\fvevol.sys
R0 - [intelpep] - Driver Intel(R) Power Engine Plug-in - C:\Windows\system32\Drivers\intelpep.sys
R0 - [kl1] - kl1 - C:\Windows\system32\Drivers\kl1.sys
R0 - [KSecDD] - KSecDD - C:\Windows\system32\Drivers\KSecDD.sys
R0 - [KSecPkg] - KSecPkg - C:\Windows\system32\Drivers\KSecPkg.sys
R0 - [MBI] - Intel(R) Sideband Fabric Device Service - C:\Windows\system32\Drivers\MBI.sys
R0 - [mountmgr] - Gerenciador de Pontos de Montagem - C:\Windows\system32\Drivers\mountmgr.sys
R0 - [msisadrv] - msisadrv - C:\Windows\system32\Drivers\msisadrv.sys
R0 - [NDIS] - Driver do Sistema NDIS - C:\Windows\system32\Drivers\NDIS.sys
R0 - [partmgr] - Gerenciador de Partições - C:\Windows\system32\Drivers\partmgr.sys
R0 - [pci] - PCI Bus Driver - C:\Windows\system32\Drivers\pci.sys
R0 - [pcw] - Performance Counters for Windows Driver - C:\Windows\system32\Drivers\pcw.sys
R0 - [pdc] - pdc - C:\Windows\system32\Drivers\pdc.sys
R0 - [rdyboost] - ReadyBoost - C:\Windows\system32\Drivers\rdyboost.sys
R0 - [spaceport] - Driver de Espaços de Armazenamento - C:\Windows\system32\Drivers\spaceport.sys
R0 - [storahci] - Driver AHCI SATA Padrão da Microsoft - C:\Windows\system32\Drivers\storahci.sys
R0 - [Tcpip] - Driver de Protocolo TCP/IP - C:\Windows\system32\Drivers\Tcpip.sys
R0 - [vdrvroot] - Enumerador de Unidade Virtual Microsoft - C:\Windows\system32\Drivers\vdrvroot.sys
R0 - [volmgr] - Driver de Gerenciador de Volumes - C:\Windows\system32\Drivers\volmgr.sys
R0 - [volmgrx] - Gerenciador de Volume Dinâmico - C:\Windows\system32\Drivers\volmgrx.sys
R0 - [volsnap] - Volumes de armazenamento - C:\Windows\system32\Drivers\volsnap.sys
R0 - [Wdf01000] - Serviço de Estruturas de Driver em Modo Kernel - C:\Windows\system32\Drivers\Wdf01000.sys
R0 - [WFPLWFS] - Plataforma para Filtros do Microsoft Windows - C:\Windows\system32\Drivers\WFPLWFS.sys
R1 - [AFD] - Ancillary Function Driver for Winsock - C:\Windows\system32\Drivers\AFD.sys
R1 - [Beep] - Beep - C:\Windows\system32\Drivers\Beep.sys
R1 - [tdx] - Driver de Suporte a TDI Herdado de NetIO - C:\Windows\system32\Drivers\tdx.sys
R2 - [tcpipreg] - TCP/IP Registry Compatibility - C:\Windows\system32\Drivers\tcpipreg.sys
S0 - [hwpolicy] - Hardware Policy Driver - C:\Windows\system32\Drivers\hwpolicy.sys
S0 - [klelam] - klelam - C:\Windows\system32\Drivers\klelam.sys
S3 - [atapi] - Canal de IDE - C:\Windows\system32\Drivers\atapi.sys

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-21-3258406523-349525713-1930050920-1001\Software\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="C:\Program Files (x86)\CyberLink\Power2Go\Power2GoExpress.exe"
"msnmsgr"="C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe /background"
"Skype"="C:\Program Files (x86)\Skype\Phone\Skype.exe /minimized /regrun"
"Steam"="C:\Program Files (x86)\Steam\steam.exe -silent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ASUSPRP"="C:\Program Files (x86)\ASUS\APRP\APRP.EXE"
"WebStorage"="C:\Program Files (x86)\ASUS\WebStorage\2.1.2.301\ASUSWSLoader.exe"
"CLMLServer"="C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"
"SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="C:\Program Files (x86)\CyberLink\Power2Go\Power2GoExpress.exe"
"msnmsgr"="C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe /background"
"Skype"="C:\Program Files (x86)\Skype\Phone\Skype.exe /minimized /regrun"
"Steam"="C:\Program Files (x86)\Steam\steam.exe -silent"

==== Startup Registry Enabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\Windows\system32\igfxtray.exe"
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe"
"Classic Start Menu"="C:\Program Files\Classic Shell\ClassicStartMenu.exe -autorun"

==== Startup Folders ======================

2015-05-20 16:17:13 1174 ----a-w- C:\Users\pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Enviar para o OneNote.lnk

==== Task Scheduler Jobs ======================

C:\Windows\tasks\Adobe Flash Player Updater.job --a-------- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [11/11/2015 10:30]
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a-------- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [04/12/2015 16:55]
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a-------- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [04/12/2015 16:55]

==== Other Scheduled Tasks ======================

"C:\Windows\SysNative\tasks\Adobe Acrobat Update Task" [C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe]
"C:\Windows\SysNative\tasks\Adobe Flash Player Updater" [C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe]
"C:\Windows\SysNative\tasks\ASUS Live Update1" [C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe]
"C:\Windows\SysNative\tasks\ASUS Live Update2" [C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe]
"C:\Windows\SysNative\tasks\ASUS Smart Gesture Launcher" [C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe]
"C:\Windows\SysNative\tasks\ASUS Splendid ACMON" [C:\Program Files (x86)\ASUS\Splendid\ACMON.exe]
"C:\Windows\SysNative\tasks\ASUS Splendid ColorU" [C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe]
"C:\Windows\SysNative\tasks\ASUS USB Charger Plus" ["C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe"]
"C:\Windows\SysNative\tasks\CCleanerSkipUAC" ["C:\Program Files\CCleaner\CCleaner.exe"]
"C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe]
"C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe]
"C:\Windows\SysNative\tasks\RtHDVBg" ["C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe"]
"C:\Windows\SysNative\tasks\RTKCPL" ["C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe"]
"C:\Windows\SysNative\tasks\Update Checker" [C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe]
"C:\Windows\SysNative\tasks\User_Feed_Synchronization-{B5EE2EB1-FB03-4E82-9E39-BECF38F7249B}" [C:\Windows\system32\msfeedssync.exe]
"C:\Windows\SysNative\tasks\Nero\Nero Info" [C:\Program Files (x86)\Common Files\Nero\Nero Info\NeroInfo.exe]

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\pc\AppData\Roaming\Mozilla\Firefox\Profiles\rq1v32qz.default
user_pref("browser.startup.homepage", "[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"url_advisor@kaspersky.com"="C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\url_advisor@kaspersky.com" [20/05/2015 21:53]

==== Firefox Extensions ======================

ProfilePath: C:\Users\pc\AppData\Roaming\Mozilla\Firefox\Profiles\rq1v32qz.default
- Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
- Skype Click to Call - %AppDir%\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi

==== Firefox Plugins ======================


==== Chromium Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
dbhjdbfgekjfcfkkfjjmlmojhbllhbho - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx[12/10/2015 10:31]

Google Slides - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek
Google Docs - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake
Google Drive - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf
YouTube - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Google Search - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
Kaspersky Protection - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho
ChromeTheme - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhmopeaogdigpkonhpckeokkcaedodi
Facebook - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dihbebhmaoagdpbcnfedokpfkkgmmpgc
Google Sheets - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap
Facebook for Chrome - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdalhedleemkkdjddjgfjmcnbpejpapp
Google Docs Offline - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi
NTR - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\icpgjfneehieebagbmdbhnlpiopdcmna
Skype Click to Call - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl
Chrome Web Store Payments - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Outlook.com - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfpeapihoiogbcmdmnibeplnikfnhoge
Gmail - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== IE Start and Search Settings ======================

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com.br/"
"Default_Page_URL"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{33BB0A4E-99AF-4226-BDF6-49120163DE86}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
HKLM\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

==== HijackThis Entries ======================

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Skype for Business Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O2 - BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
O2 - BHO: ContentBlockerBrowserHelperObject - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll
O2 - BHO: VirtualKeyboardBrowserHelperObject - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_65\bin\ssv.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_65\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll
O2 - BHO: ClassicIEBHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIEDLL_32.dll
O3 - Toolbar: Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll

==== EOF on 06/12/2015 at 15:55:22,26 ======================

/!\ Boa Tarde! Danilo Marsaro /!\

> Copie este script,que está em vermelho,incluindo o hiperlink, para o Bloco de Notas.
> Salve-o no desktop,com o nome ZAScript. << Texto!

[-HKLM\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
{33BB0A4E-99AF-4226-BDF6-49120163DE86};c
shortcutfix;
emptytemp;
autoclean;
istartsurf;a
istartsurf;z

> Feche o navegador! << Importante!
> Desabilite seu antivírus,para que não detecte a ferramenta.
> Abra a ferramenta ZA-Scan.
> Execute-a e aguarde sua conclusão!
> Confirme o reboot e poste o relatório ao concluir! ( C:\zoek-results.txt )

Abs!

Relatório ZA-Scan:


ZA-Scan V1.0.0.5 Updated 05-December-2015
Tool run by pc on 06/12/2015 at 16:56:26,63.
Microsoft Windows 8.1 com o Bing 6.3.9600 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\pc\Desktop\abc.exe [Deep Scan]

==== Older Logs ======================

C:\zoek-results2015-12-06-175522.log 21038 bytes

==== System Restore Info ======================

06/12/2015 16:57:30 Zoek.exe System Restore Point Created Successfully.

==== Running Processes ======================

C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\avp.exe
C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe
C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\avpui.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Nero\Update\NASvc.exe
C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
C:\Users\pc\Desktop\abc.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
C:\Users\pc\AppData\Local\Temp\ZAScan.exe

==== Drivers(whitelist) ======================
Powered by [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

R0 - [FileInfo] - File Information FS MiniFilter - C:\Windows\system32\Drivers\FileInfo.sys
R0 - [FltMgr] - FltMgr - C:\Windows\system32\Drivers\FltMgr.sys
R0 - [Mup] - Mup - C:\Windows\system32\Drivers\Mup.sys
R0 - [Wof] - Windows Overlay File System Filter Driver - C:\Windows\system32\Drivers\Wof.sys
R1 - [NetBIOS] - NetBIOS Interface - C:\Windows\system32\Drivers\NetBIOS.sys
R2 - [srv] - Driver SMB 1.xxx do Servidor - C:\Windows\system32\Drivers\srv.sys
R3 - [srv2] - Driver SMB 2.xxx do Servidor - C:\Windows\system32\Drivers\srv2.sys
R0 - [ACPI] - Microsoft ACPI Driver - C:\Windows\system32\Drivers\ACPI.sys
R0 - [acpiex] - Microsoft ACPIEx Driver - C:\Windows\system32\Drivers\acpiex.sys
R0 - [CLFS] - Common Log (CLFS) - C:\Windows\system32\Drivers\CLFS.sys
R0 - [CNG] - CNG - C:\Windows\system32\Drivers\CNG.sys
R0 - [disk] - Driver de disco - C:\Windows\system32\Drivers\disk.sys
R0 - [EhStorClass] - Enhanced Storage Filter Driver - C:\Windows\system32\Drivers\EhStorClass.sys
R0 - [fvevol] - Driver de Filtro de Criptografia de Unidade de Disco BitLocker - C:\Windows\system32\Drivers\fvevol.sys
R0 - [intelpep] - Driver Intel(R) Power Engine Plug-in - C:\Windows\system32\Drivers\intelpep.sys
R0 - [kl1] - kl1 - C:\Windows\system32\Drivers\kl1.sys
R0 - [KSecDD] - KSecDD - C:\Windows\system32\Drivers\KSecDD.sys
R0 - [KSecPkg] - KSecPkg - C:\Windows\system32\Drivers\KSecPkg.sys
R0 - [MBI] - Intel(R) Sideband Fabric Device Service - C:\Windows\system32\Drivers\MBI.sys
R0 - [mountmgr] - Gerenciador de Pontos de Montagem - C:\Windows\system32\Drivers\mountmgr.sys
R0 - [msisadrv] - msisadrv - C:\Windows\system32\Drivers\msisadrv.sys
R0 - [NDIS] - Driver do Sistema NDIS - C:\Windows\system32\Drivers\NDIS.sys
R0 - [partmgr] - Gerenciador de Partições - C:\Windows\system32\Drivers\partmgr.sys
R0 - [pci] - PCI Bus Driver - C:\Windows\system32\Drivers\pci.sys
R0 - [pcw] - Performance Counters for Windows Driver - C:\Windows\system32\Drivers\pcw.sys
R0 - [pdc] - pdc - C:\Windows\system32\Drivers\pdc.sys
R0 - [rdyboost] - ReadyBoost - C:\Windows\system32\Drivers\rdyboost.sys
R0 - [spaceport] - Driver de Espaços de Armazenamento - C:\Windows\system32\Drivers\spaceport.sys
R0 - [storahci] - Driver AHCI SATA Padrão da Microsoft - C:\Windows\system32\Drivers\storahci.sys
R0 - [Tcpip] - Driver de Protocolo TCP/IP - C:\Windows\system32\Drivers\Tcpip.sys
R0 - [vdrvroot] - Enumerador de Unidade Virtual Microsoft - C:\Windows\system32\Drivers\vdrvroot.sys
R0 - [volmgr] - Driver de Gerenciador de Volumes - C:\Windows\system32\Drivers\volmgr.sys
R0 - [volmgrx] - Gerenciador de Volume Dinâmico - C:\Windows\system32\Drivers\volmgrx.sys
R0 - [volsnap] - Volumes de armazenamento - C:\Windows\system32\Drivers\volsnap.sys
R0 - [Wdf01000] - Serviço de Estruturas de Driver em Modo Kernel - C:\Windows\system32\Drivers\Wdf01000.sys
R0 - [WFPLWFS] - Plataforma para Filtros do Microsoft Windows - C:\Windows\system32\Drivers\WFPLWFS.sys
R1 - [AFD] - Ancillary Function Driver for Winsock - C:\Windows\system32\Drivers\AFD.sys
R1 - [Beep] - Beep - C:\Windows\system32\Drivers\Beep.sys
R1 - [tdx] - Driver de Suporte a TDI Herdado de NetIO - C:\Windows\system32\Drivers\tdx.sys
R2 - [tcpipreg] - TCP/IP Registry Compatibility - C:\Windows\system32\Drivers\tcpipreg.sys
S0 - [hwpolicy] - Hardware Policy Driver - C:\Windows\system32\Drivers\hwpolicy.sys
S0 - [klelam] - klelam - C:\Windows\system32\Drivers\klelam.sys
S3 - [atapi] - Canal de IDE - C:\Windows\system32\Drivers\atapi.sys

==== System Specs ======================

Windows: Windows Version 6.2 (Build 9200)
Memory (RAM): 3983 MB
CPU Info: Intel(R) Celeron(R) CPU N2930 @ 1.83GHz
CPU Speed: 1854,9 MHz
Sound Card: Speakers (Realtek High Definiti |
Display Adapters: Intel(R) HD Graphics | Intel(R) HD Graphics | Intel(R) HD Graphics
Monitors: 1x; Generic PnP Monitor |
Screen Resolution: 1366 X 768 - 32 bit
Network: Network Present
Network Adapters: Microsoft Wi-Fi Direct Virtual Adapter | Qualcomm Atheros AR9485 Wireless Network Adapter | Realtek PCIe FE Family Controller
CD / DVD Drives: 1x (E: | ) E: SlimtypeDVD A DS8ABSH
Ports: COM Ports NOT Present. LPT Port NOT Present.
Mouse: 5 Button Wheel Mouse Present
Hard Disks: C: 186,3GB | D: 258,3GB
Hard Disks - Free: C: 125,3GB | D: 77,4GB
Manufacturer *: American Megatrends Inc.
BIOS Info: AT/AT COMPATIBLE | | _ASUS_ - 1072009
Time Zone: Hora oficial do Brasil
Motherboard *: ASUSTeK COMPUTER INC. X451MA
Country: Brasil
Language: PTB

==== System Specs (Software) ======================

AV: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Kaspersky Anti-Virus *Disabled/Updated* {B41C7598-35F6-4D89-7D0E-7ADE69B4047B}
SP: Kaspersky Anti-Virus *Disabled/Updated* {0F7D947C-13CC-4207-47BE-41AC12334EC6}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
Internet Explorer Version: 11.0.9600.18098
Mozilla Firefox version: 38.0.1 (x86 pt-BR)
Google Chrome version: 47.0.2526.73
Adobe Reader version: 15.9.20077.160923
Flash Player version: 19.0.0.245

==== Files Recently Created / Modified ======================

====== C:\Windows ====
2015-12-04 15:19:25 692CA5EBC9E0CEF0A8D0BE4DF7400CEE 9528 ----a-w- C:\Windows\diagwrn.xml
2015-12-04 15:19:25 692CA5EBC9E0CEF0A8D0BE4DF7400CEE 9528 ----a-w- C:\Windows\diagerr.xml
====== C:\Users\pc\AppData\Local\Temp ====
2015-12-06 18:56:17 8377C99BF813BE986D07730F5C433382 68096 ----a-w- C:\Users\pc\AppData\Local\Temp\ZAScan.exe
====== Java Cache =====
====== C:\Windows\SysWOW64 =====
====== C:\Windows\SysWOW64\drivers =====
====== C:\Windows\Sysnative =====
====== C:\Windows\Sysnative\drivers =====
2015-11-11 13:17:40 EE16457030175F449BAB0ABD279F4B6A 202240 ----a-w- C:\Windows\Sysnative\drivers\mrxsmb20.sys
2015-11-11 13:17:40 89DE71940A0E7F5BA617AE08321EF5C3 401408 ----a-w- C:\Windows\Sysnative\drivers\mrxsmb.sys
2015-11-11 13:17:40 35C19AF2116F67914712D7C4CBE47B8C 177496 ----a-w- C:\Windows\Sysnative\drivers\ksecpkg.sys
2015-11-11 13:17:40 0DE32A0BB1FE2A773666572F79584520 561952 ----a-w- C:\Windows\Sysnative\drivers\cng.sys
2015-11-11 13:17:39 80A2FC1A089A71F2DBE5D8394FFB009F 155480 -c--a-w- C:\Windows\Sysnative\drivers\tpm.sys
2015-11-11 13:16:11 E85916632CD3B9E9B546968DB950BF42 154112 ----a-w- C:\Windows\Sysnative\drivers\tunnel.sys
2015-11-11 13:11:37 E0BD2D83875464FEEEB242CBA8B7E073 108032 ----a-w- C:\Windows\Sysnative\drivers\tdx.sys
2015-11-11 13:11:37 A460C3AF3755A2A79A3C8EFE72E147B5 559616 ----a-w- C:\Windows\Sysnative\drivers\afd.sys
2015-11-11 13:09:41 715ABA3DD164D06457A2A3C92F6EA9D5 136512 ----a-w- C:\Windows\Sysnative\drivers\wfplwfs.sys
====== C:\Windows\Tasks ======
2015-12-04 18:55:30 B8E2987E36DE6EDDBD9ED596FAF1447C 1070 ----a-w- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-04 18:55:30 A68B747CDB1EAAF83138AA60C83E9CB5 3806 ----a-w- C:\Windows\Sysnative\Tasks\GoogleUpdateTaskMachineCore
2015-12-04 18:55:30 8102D08A7D5F0F947798A8F73BB798BA 1066 ----a-w- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-04 18:55:30 744394B029815D7D840B42954B5907A6 4042 ----a-w- C:\Windows\Sysnative\Tasks\GoogleUpdateTaskMachineUA
====== C:\Windows\Temp ======
======= C:\Program Files =====
2015-12-03 13:17:21 -------- d-----w- C:\Program Files\SRS Labs
======= C:\PROGRA~2 =====
======= C: =====
====== C:\Users\pc\AppData\Roaming ======
2015-12-06 17:19:17 82EF2DE4683877BDAA860C0F69C10CE2 255056 ----a-w- C:\Windows\serviceprofiles\Localservice\AppData\Local\FontCache3.0.0.0.dat
2015-12-04 19:15:04 -------- d-----w- C:\Users\pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aplicativos do Google Chrome
2015-12-04 18:14:13 -------- d-----w- C:\Users\pc\AppData\Local\Deployment
2015-12-03 17:08:45 -------- d-----w- C:\Users\pc\AppData\Local\ElevatedDiagnostics
2015-11-10 01:44:12 -------- d-----w- C:\Users\pc\AppData\Local\CEF
====== C:\Users\pc ======
2015-12-06 18:50:37 67C4913CB3C8134F9E8A272454D1553D 1370112 ----a-w- C:\Users\pc\Desktop\n.exe
2015-12-06 17:20:08 -------- d-----w- C:\Windows\serviceprofiles\Localservice\winhttp
2015-12-04 18:57:05 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-12-04 11:54:17 3EAE90B1A0BB0A9B96A054BFAD2FCB50 1736704 ----a-w- C:\Users\pc\Desktop\AdwCleaner.exe
2015-12-04 01:47:56 0B0BE65BD628744360D020E196C0A022 95881896 ----a-w- C:\Users\pc\Downloads\KVRT (1).exe
2015-11-16 18:24:57 3DFEAC146A913E761CF6C7572E639A84 852 ----a-w- C:\Users\pc\Setilist Pearl Jam - São Paulo - 14 - 11 - 2015.txt

====== C: exe-files ==
2015-12-06 18:56:17 8377C99BF813BE986D07730F5C433382 68096 ----a-w- C:\Users\pc\AppData\Local\Temp\ZAScan.exe
2015-12-06 18:50:37 67C4913CB3C8134F9E8A272454D1553D 1370112 ----a-w- C:\Users\pc\Desktop\n.exe
2015-12-04 20:36:05 635DBF6CD989626ABEE812AF15948A8A 1369416 ----a-w- C:\Users\pc\AppData\Local\Google\Chrome\User Data\SwReporter\4.32.1\software_reporter_tool.exe
2015-12-04 18:56:37 9F76983EE43584A1A10B8B08B3BF1615 43870800 ----a-w- C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\47.0.2526.73\47.0.2526.73_chrome_installer.exe
2015-12-04 18:55:28 EC0FAADC62E1C1DADA953DE433BEFB01 88392 ----atw- C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateOnDemand.exe
2015-12-04 18:55:28 BA7396EF42213C0F84343C186610B851 88392 ----atw- C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateWebPlugin.exe
2015-12-04 18:55:28 AD8495335C1A605A4E0E32334DF52303 88392 ----atw- C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateBroker.exe
2015-12-04 18:55:27 88FBBB1C601A6BC42054E57C2897FA45 144200 ----atw- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
2015-12-04 18:55:27 1D652959033B873B77B8D5A12011FD85 927824 ----a-w- C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateSetup.exe
2015-12-04 18:55:26 73F542663FD48B49A798A56DAA18C136 307016 ----atw- C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler64.exe
2015-12-04 18:55:26 5424FDF3776F5458EAFAABFB87AA9285 130888 ----atw- C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdateComRegisterShell64.exe
2015-12-04 18:55:25 88FBBB1C601A6BC42054E57C2897FA45 144200 ----atw- C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleUpdate.exe
2015-12-04 18:55:25 7DC16FAEA44C8D96A1C113305A4059A2 245576 ----atw- C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler.exe
2015-12-04 18:54:59 EEDA7BC824BB91CE8AE98FDEF871C5D2 11080 ----a-w- C:\Users\pc\AppData\Local\Apps\2.0\Z6KJGQPM.0P4\0AZ9GV62.LOV\inst...app_86fd5b6b43e66935_0001.0003_c9bd0a0a5dbbbec4\clickonce_bootstrap.exe
2015-12-04 18:54:59 1D652959033B873B77B8D5A12011FD85 927824 ----a-w- C:\Users\pc\AppData\Local\Apps\2.0\Z6KJGQPM.0P4\0AZ9GV62.LOV\inst...app_86fd5b6b43e66935_0001.0003_c9bd0a0a5dbbbec4\GoogleUpdateSetup.exe
2015-12-04 18:54:59 1D652959033B873B77B8D5A12011FD85 927824 ----a-w- C:\Users\pc\AppData\Local\Apps\2.0\Z6KJGQPM.0P4\0AZ9GV62.LOV\clic...exe_86fd5b6b43e66935_0001.0003_none_f26368b358f225e4\GoogleUpdateSetup.exe
2015-12-04 17:08:21 8930D704DC34BB6A8122D1330525FD5E 7904968 ----a-w- C:\Users\pc\AppData\Local\Microsoft\OneDrive\17.3.6201.1019_1\OneDriveSetup.exe
2015-12-04 17:08:21 8930D704DC34BB6A8122D1330525FD5E 7904968 ----a-w- C:\Users\pc\AppData\Local\Microsoft\OneDrive\17.3.6201.1019\OneDriveSetup.exe
2015-12-04 17:08:00 984BDA28B013EC426501CA40D365FDF0 160960 ----a-w- C:\Users\pc\AppData\Local\Microsoft\OneDrive\17.3.6201.1019_1\FileSyncConfig.exe
2015-12-04 17:07:37 96F76F943DF1974E4F08B5B3DE0C028F 175296 ----a-w- C:\Users\pc\AppData\Local\Microsoft\OneDrive\17.3.6201.1019_1\FileCoAuth.exe
2015-12-04 11:54:17 3EAE90B1A0BB0A9B96A054BFAD2FCB50 1736704 ----a-w- C:\Users\pc\Desktop\AdwCleaner.exe
2015-12-04 01:47:56 0B0BE65BD628744360D020E196C0A022 95881896 ----a-w- C:\Users\pc\Downloads\KVRT (1).exe
=== C: other files ==
2015-12-04 17:06:52 8CF4163521FDB8E53482003C7EFA7121 5850 ----a-w- C:\Users\pc\AppData\Local\Microsoft\OneDrive\17.3.6201.1019_1\CollectOneDriveLogs.bat

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-21-3258406523-349525713-1930050920-1001\Software\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="C:\Program Files (x86)\CyberLink\Power2Go\Power2GoExpress.exe"
"msnmsgr"="C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe /background"
"Skype"="C:\Program Files (x86)\Skype\Phone\Skype.exe /minimized /regrun"
"Steam"="C:\Program Files (x86)\Steam\steam.exe -silent"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ASUSPRP"="C:\Program Files (x86)\ASUS\APRP\APRP.EXE"
"WebStorage"="C:\Program Files (x86)\ASUS\WebStorage\2.1.2.301\ASUSWSLoader.exe"
"CLMLServer"="C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"
"SunJavaUpdateSched"="C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="C:\Program Files (x86)\CyberLink\Power2Go\Power2GoExpress.exe"
"msnmsgr"="C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe /background"
"Skype"="C:\Program Files (x86)\Skype\Phone\Skype.exe /minimized /regrun"
"Steam"="C:\Program Files (x86)\Steam\steam.exe -silent"

==== Startup Registry Enabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\Windows\system32\igfxtray.exe"
"HotKeysCmds"="C:\Windows\system32\hkcmd.exe"
"Classic Start Menu"="C:\Program Files\Classic Shell\ClassicStartMenu.exe -autorun"

==== Startup Folders ======================

2015-05-20 16:17:13 1174 ----a-w- C:\Users\pc\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Enviar para o OneNote.lnk

==== Task Scheduler Jobs ======================

C:\Windows\tasks\Adobe Flash Player Updater.job --a-------- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [11/11/2015 10:30]
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a-------- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [04/12/2015 16:55]
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a-------- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [04/12/2015 16:55]

==== Other Scheduled Tasks ======================

"C:\Windows\SysNative\tasks\Adobe Acrobat Update Task" [C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe]
"C:\Windows\SysNative\tasks\Adobe Flash Player Updater" [C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe]
"C:\Windows\SysNative\tasks\ASUS Live Update1" [C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe]
"C:\Windows\SysNative\tasks\ASUS Live Update2" [C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe]
"C:\Windows\SysNative\tasks\ASUS Smart Gesture Launcher" [C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe]
"C:\Windows\SysNative\tasks\ASUS Splendid ACMON" [C:\Program Files (x86)\ASUS\Splendid\ACMON.exe]
"C:\Windows\SysNative\tasks\ASUS Splendid ColorU" [C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe]
"C:\Windows\SysNative\tasks\ASUS USB Charger Plus" ["C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe"]
"C:\Windows\SysNative\tasks\CCleanerSkipUAC" ["C:\Program Files\CCleaner\CCleaner.exe"]
"C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe]
"C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe]
"C:\Windows\SysNative\tasks\RtHDVBg" ["C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe"]
"C:\Windows\SysNative\tasks\RTKCPL" ["C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe"]
"C:\Windows\SysNative\tasks\Update Checker" [C:\Program Files (x86)\ASUS\ASUS Live Update\UpdateChecker.exe]
"C:\Windows\SysNative\tasks\User_Feed_Synchronization-{B5EE2EB1-FB03-4E82-9E39-BECF38F7249B}" [C:\Windows\system32\msfeedssync.exe]
"C:\Windows\SysNative\tasks\Nero\Nero Info" [C:\Program Files (x86)\Common Files\Nero\Nero Info\NeroInfo.exe]

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\pc\AppData\Roaming\Mozilla\Firefox\Profiles\rq1v32qz.default
user_pref("browser.startup.homepage", "[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"url_advisor@kaspersky.com"="C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\url_advisor@kaspersky.com" [20/05/2015 21:53]

==== Firefox Extensions ======================

ProfilePath: C:\Users\pc\AppData\Roaming\Mozilla\Firefox\Profiles\rq1v32qz.default
- Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\FFExt\content_blocker@kaspersky.com

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
- Skype Click to Call - %AppDir%\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi

==== Firefox Plugins ======================


==== Chromium Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
dbhjdbfgekjfcfkkfjjmlmojhbllhbho - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx[12/10/2015 10:31]

Google Slides - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek
Google Docs - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake
Google Drive - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf
YouTube - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Google Search - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
Kaspersky Protection - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho
ChromeTheme - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhmopeaogdigpkonhpckeokkcaedodi
Facebook - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\dihbebhmaoagdpbcnfedokpfkkgmmpgc
Google Sheets - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap
Facebook for Chrome - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdalhedleemkkdjddjgfjmcnbpejpapp
Google Docs Offline - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi
NTR - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\icpgjfneehieebagbmdbhnlpiopdcmna
Skype Click to Call - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl
Chrome Web Store Payments - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Outlook.com - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfpeapihoiogbcmdmnibeplnikfnhoge
Gmail - pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== IE Start and Search Settings ======================

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com.br/"
"Default_Page_URL"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
"Start Page"="http://www.google.com"
"Search Page"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{33BB0A4E-99AF-4226-BDF6-49120163DE86}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
HKLM\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
HKCU\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

==== HijackThis Entries ======================

F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Skype for Business Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O2 - BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
O2 - BHO: ContentBlockerBrowserHelperObject - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll
O2 - BHO: VirtualKeyboardBrowserHelperObject - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_65\bin\ssv.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_65\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll
O2 - BHO: ClassicIEBHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIEDLL_32.dll
O3 - Toolbar: Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll
O4 - HKLM\..\Run: [ASUSPRP] "C:\Program Files (x86)\ASUS\APRP\APRP.EXE"
O4 - HKLM\..\Run: [WebStorage] C:\Program Files (x86)\ASUS\WebStorage\2.1.2.301\ASUSWSLoader.exe
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Power2GoExpress] "C:\Program Files (x86)\CyberLink\Power2Go\Power2GoExpress.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - Startup: Enviar para o OneNote.lnk = C:\Program Files\Microsoft Office\Office15\ONENOTEM.EXE
O8 - Extra context menu item: &Enviar para o OneNote - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O8 - Extra context menu item: E&xportar para o Microsoft Excel - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O9 - Extra button: Teclado Virtual - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra button: Clique para Telefonar do Lync - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Clique para Telefonar do Lync - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O9 - Extra button: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Verificação de URLs - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: ASLDR Service (ASLDRService) - ASUSTek Computer Inc. - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
O23 - Service: Asus WebStorage Windows Service - ASUS Cloud Corporation - C:\Program Files (x86)\ASUS\WebStorage\2.1.2.301\AsusWSWinService.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - ASUS - C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
O23 - Service: Serviço do Kaspersky Anti-Virus 15.0.0 (AVP15.0.0) - Kaspersky Lab ZAO - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\avp.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Serviço do Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) Integrated Clock Controller Service - Intel(R) ICCS (ICCS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @C:\Program Files (x86)\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files (x86)\Nero\Update\NASvc.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

==== C:\zoek_backup content ======================

C:\zoek_backup (files=0 folders=0 0 bytes)

==== EOF on 06/12/2015 at 17:10:03,38 ======================

Aguardando para como proceder

/!\ Boa Noite! Danilo Marsaro /!\

> Houve incorreção ao executar o script,onde a ferramenta abc.exe não foi renomeada para ZA-Scan.
> Desta forma,ela não pode ler o script.
> Portanto,repita o procedimento,mas com a ferramenta renomeada para ZA-Scan.
> Ps: Agora mesmo,editei o script para incluir uma GUI.
> Copie,novamente,para o Bloco de Notas e salve-o ao desktop. (ZAScript.txt)
> Poste o relatório!

Abs!

Aguardando para saber como proceder

Eu copio oque está em vermelho para executar o ZA-Scan novamente?

/!\ Boa Noite! Danilo Marsaro /!\

> Copie,novamente,o script para o Bloco de Notas,salvando-o ao desktop,com o nome zascript.
> Delete o anterior,já que este foi editado para inserir informações.
> Execute abc.exe,renomeado para ZA-Scan,que estando ao desktop,irá ler o script.
> Poste o relatório!

Abs!

Já faz meia hora que o Zas-Scan está verificando e não termina, está parado!

Tem alguma coisa errada! abc.exe (ZA-Scan) não termina a verificaçao.. oque fazer agora?

/!\ Olá! Danilo Marsaro /!\

{33BB0A4E-99AF-4226-BDF6-49120163DE86};c
shortcutfix;
emptytemp;
autoclean;

> Execute este script,mais simplificado,deletando o outro,e execute ZA-Scan.
> Se continuar o travamento,teremos que rodar outra ferramenta.

A+

Eu nomeio o bloco de notas como zascript ou ZAScript ?

/!\ Boa Noite! Danilo Marsaro /!\

Danilo Marsaro escreveu:Eu nomeio o bloco de notas como zascript ou ZAScript ?

> Tanto faz! ( zascript ou ZAScript ) 

Abs!

O ZA-Scan tá verificando com o novo script que vc passou já faz uns 10 minutos e até agora nada, estranho porque da outra vez que usei ele funcionou normal rapidinho.

/!\ Olá! Danilo Marsaro /!\

> Vc desabilitou o antivírus?

A+