http://pthacker.no.ip.org8080/is-ready

Olá!
Abaixo segue o relatório aberto no bloco de notas

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 16:22:26, on 28/11/2013
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v10.0 (10.00.9200.16537)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe
C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\diogo\Downloads\HijackThis.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\Program Files (x86)\GbPlugin\gbieh.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O2 - BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll
O3 - Toolbar: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [BtTray] "C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe"
O4 - HKLM\..\Run: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
O4 - HKLM\..\Run: [RemoteControl10] "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"
O4 - HKLM\..\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
O4 - HKLM\..\Run: [HP CoolSense] C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe -byrunkey
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [EaseUS EPM tray] C:\Program Files (x86)\EaseUS\EaseUS Partition Master 9.2.2\bin\EpmNews.exe
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\RunOnce: [aswAhAScr.dll] "C:\Program Files\AVAST Software\Avast\aswRegSvr.exe" "C:\Program Files\AVAST Software\Avast\AhAScr.dll"
O4 - HKLM\..\RunOnce: [aswasOutExt.dll] "C:\Program Files\AVAST Software\Avast\aswRegSvr.exe" "C:\Program Files\AVAST Software\Avast\asOutExt.dll"
O4 - HKLM\..\RunOnce: [aswasOutExt64.dll] "C:\Program Files\AVAST Software\Avast\aswRegSvr64.exe" "C:\Program Files\AVAST Software\Avast\asOutExt64.dll"
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Facebook Update] "C:\Users\diogo\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
O4 - HKCU\..\Run: [ares] "C:\Program Files (x86)\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Microsoft] wscript.exe //B "C:\Users\diogo\AppData\Local\Temp\Microsoft.vbe"
O4 - Startup: Microsoft.vbe
O4 - Startup: Recorte de tela e Iniciador do OneNote 2007.lnk = C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xportar para o Microsoft Excel - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O15 - Trusted Zone: www14.bancobrasil.com.br
O15 - Trusted Zone: www2.bancobrasil.com.br
O15 - Trusted Zone: [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Windows\SysWow64\skype4com.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O20 - Winlogon Notify:  GbPluginBb - C:\Program Files (x86)\GbPlugin\gbieh.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: BlueSoleilCS - IVT Corporation - C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
O23 - Service: Serviço do Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BsHelpCS - IVT Corporation - C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: Easybits Services for Windows (ezSharedSvc) - EasyBits Software AS - C:\Windows\System32\ezSharedSvcHost.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: GamesAppService - WildTangent, Inc. - C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe
O23 - Service: Gbp Service (GbpSv) - GAS Tecnologia - C:\PROGRA~2\GbPlugin\GbpSv.exe
O23 - Service: Serviço do Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: HP Support Assistant Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: @oem23.inf,%hpservice_desc%;HP Service (hpsrv) - Unknown owner - C:\Windows\system32\Hpservice.exe (file missing)
O23 - Service: HPWMISVC - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
O23 - Service: IconMan_R - Realsil Microelectronics Inc. - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
O23 - Service: Intel(R) Capability Licensing Service Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service: Intel(R) Capability Licensing Service TCP IP Interface - Intel(R) Corporation - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service: Intel(R) ME Service - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
O23 - Service: Intel(R) Rapid Start Technology Service (irstrtsv) - Intel Corporation - C:\Windows\SysWOW64\irstrtsv.exe
O23 - Service: Intel(R) Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\stlang64.dll,-10102 (STacSV) - IDT, Inc. - C:\Program Files\IDT\WDM\STacSV64.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 13274 bytes

Olá digsabatino


Baixe o [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] (...de El desaparecido) e salve-o no Desktop (Área de Trabalho)

*Conecte o pen drive no PC

*Clique com o botão direito do mouse no UsbFix e selecione [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

*Clique [Pesquisa] e cole o relatório apresentado

############################## | UsbFix V 7.152 | [Pesquisa]

Usuário: diogo (Administrador) # INSULANO
Atualizado em 20/11/2013 por El Desaparecido - Team SosVirus
Começou em 21:02:28 | 28/11/2013

Site : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Forum : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Upload Malware : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Contato : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

PC: Hewlett-Packard (18FA)
CPU: Intel(R) Core(TM) i3-3217U CPU @ 1.80GHz
RAM -> [Total : 3988 | Free : 2351]
Bios: Insyde
Boot: Normal boot

OS: Microsoft Windows 8 Single Language (6.2.9200 64-Bit)
WB: Windows Internet Explorer : 10.0.9200.16736
WB: Google Chrome : 31.0.1650.57

SC: Security Center Service [Enabled]
WU: Windows Update Service [(!) Disabled]
AV: avast! Antivirus [Enabled | Updated]
AS: Windows Defender : 4.3.0215.0
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disco fixo # 196 Gb (121 Mb livre - 62%) [OS] # NTFS
D:\ -> Disco fixo # 17 Gb (2 Mb livre - 13%) [RECOVERY] # NTFS
E:\ -> Disco fixo # 251 Gb (251 Mb livre - 100%) [Diogo] # NTFS
G:\ -> CD-ROM
I:\ -> Disco removível # 4 Gb (4 Mb livre - 100%) [MEUPENDRIVE] # FAT32

################## | Processos Ativos |

C:\Windows\system32\csrss.exe (ID: 524 |ParentID: 468)
C:\Windows\system32\wininit.exe (ID: 580 |ParentID: 468)
C:\Windows\system32\csrss.exe (ID: 596 |ParentID: 588)
C:\Windows\system32\winlogon.exe (ID: 652 |ParentID: 588)
C:\Windows\system32\services.exe (ID: 684 |ParentID: 580)
C:\Windows\system32\lsass.exe (ID: 692 |ParentID: 580)
C:\Windows\system32\svchost.exe (ID: 800 |ParentID: 684)
C:\PROGRA~2\GbPlugin\GbpSv.exe (ID: 860 |ParentID: 684)
C:\Windows\system32\svchost.exe (ID: 912 |ParentID: 684)
C:\Windows\System32\svchost.exe (ID: 960 |ParentID: 684)
C:\Windows\system32\svchost.exe (ID: 996 |ParentID: 684)
C:\Windows\system32\dwm.exe (ID: 516 |ParentID: 652)
C:\Windows\system32\svchost.exe (ID: 536 |ParentID: 684)
C:\Windows\System32\svchost.exe (ID: 892 |ParentID: 684)
C:\Program Files\IDT\WDM\STacSV64.exe (ID: 1048 |ParentID: 684)
C:\Windows\system32\Hpservice.exe (ID: 1264 |ParentID: 684)
C:\Windows\system32\svchost.exe (ID: 1336 |ParentID: 684)
C:\Program Files\AVAST Software\Avast\AvastSvc.exe (ID: 1420 |ParentID: 684)
C:\Windows\System32\spoolsv.exe (ID: 1700 |ParentID: 684)
C:\Windows\system32\svchost.exe (ID: 1736 |ParentID: 684)
C:\Windows\system32\svchost.exe (ID: 1884 |ParentID: 684)
C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe (ID: 1904 |ParentID: 684)
C:\Program Files\Bonjour\mDNSResponder.exe (ID: 2004 |ParentID: 684)
C:\Windows\SysWOW64\ezSharedSvcHost.exe (ID: 2044 |ParentID: 684)
C:\Windows\system32\dashost.exe (ID: 372 |ParentID: 892)
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (ID: 1812 |ParentID: 684)
C:\Program Files\Intel\iCLS Client\HeciServer.exe (ID: 1980 |ParentID: 684)
C:\Windows\SysWOW64\irstrtsv.exe (ID: 2032 |ParentID: 684)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (ID: 2072 |ParentID: 684)
C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe (ID: 2104 |ParentID: 684)
C:\Windows\system32\svchost.exe (ID: 2172 |ParentID: 684)
C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe (ID: 2444 |ParentID: 684)
C:\Windows\system32\svchost.exe (ID: 2504 |ParentID: 684)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 3228 |ParentID: 800)
C:\Windows\system32\taskhostex.exe (ID: 3488 |ParentID: 684)
C:\Windows\Explorer.EXE (ID: 3592 |ParentID: 3544)
C:\Program Files (x86)\Intel\irstrt\RapidStartConfig.exe (ID: 3668 |ParentID: 684)
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (ID: 3676 |ParentID: 684)
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE (ID: 3844 |ParentID: 3696)
C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe (ID: 3904 |ParentID: 800)
C:\Windows\system32\SearchIndexer.exe (ID: 3872 |ParentID: 684)
C:\Windows\System32\RuntimeBroker.exe (ID: 3784 |ParentID: 800)
C:\Windows\System32\hkcmd.exe (ID: 4128 |ParentID: 3592)
C:\Windows\System32\igfxpers.exe (ID: 4152 |ParentID: 3592)
C:\Program Files\IDT\WDM\sttray64.exe (ID: 4184 |ParentID: 3592)
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (ID: 4228 |ParentID: 3592)
C:\Windows\System32\wscript.exe (ID: 4344 |ParentID: 3592)
C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (ID: 4416 |ParentID: 3592)
C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe (ID: 4444 |ParentID: 4408)
C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (ID: 4520 |ParentID: 4408)
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (ID: 4548 |ParentID: 4408)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 4564 |ParentID: 800)
C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe (ID: 4596 |ParentID: 4408)
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (ID: 4688 |ParentID: 684)
C:\Program Files\AVAST Software\Avast\AvastUI.exe (ID: 4696 |ParentID: 4408)
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (ID: 4892 |ParentID: 4408)
C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (ID: 5108 |ParentID: 684)
C:\Windows\system32\svchost.exe (ID: 2576 |ParentID: 684)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 4872 |ParentID: 4116)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 2908 |ParentID: 4872)
C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe (ID: 5580 |ParentID: 684)
C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (ID: 5660 |ParentID: 684)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (ID: 5688 |ParentID: 684)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (ID: 5796 |ParentID: 684)
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (ID: 5980 |ParentID: 684)
C:\Program Files\Windows Media Player\wmpnetwk.exe (ID: 6020 |ParentID: 684)
C:\Windows\system32\taskhost.exe (ID: 3780 |ParentID: 684)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 6192 |ParentID: 4872)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 4216 |ParentID: 4872)
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 4236 |ParentID: 4872)
C:\Windows\system32\SearchProtocolHost.exe (ID: 1760 |ParentID: 3872)
C:\Windows\explorer.exe (ID: 6352 |ParentID: 800)
C:\Windows\System32\WUDFHost.exe (ID: 3856 |ParentID: 892)
C:\UsbFix\Go.exe (ID: 6948 |ParentID: 4144)

################## | Regedit Run |

04 - HKLM\SOFTWARE | Run : [BtTray] - "C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe"
04 - HKLM\SOFTWARE | Run : [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
04 - HKLM\SOFTWARE | Run : [RemoteControl10] - "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"
04 - HKLM\SOFTWARE | Run : [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
04 - HKLM\SOFTWARE | Run : [HP CoolSense] - C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe -byrunkey
04 - HKLM\SOFTWARE | Run : [GrooveMonitor] - "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
04 - HKLM\SOFTWARE | Run : [EaseUS EPM tray] - C:\Program Files (x86)\EaseUS\EaseUS Partition Master 9.2.2\bin\EpmNews.exe
04 - HKLM\SOFTWARE | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
04 - HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [BtTray] - "C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [RemoteControl10] - "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [HP CoolSense] - C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe -byrunkey
04 - HKLM\SOFTWARE\wow6432Node | Run : [GrooveMonitor] - "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [EaseUS EPM tray] - C:\Program Files (x86)\EaseUS\EaseUS Partition Master 9.2.2\bin\EpmNews.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
04 - HKLM\SOFTWARE\wow6432Node | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
04 - HKLM\SOFTWARE | RunOnce : [aswAhAScr.dll] - "C:\Program Files\AVAST Software\Avast\aswRegSvr.exe" "C:\Program Files\AVAST Software\Avast\AhAScr.dll"
04 - HKLM\SOFTWARE | RunOnce : [aswasOutExt.dll] - "C:\Program Files\AVAST Software\Avast\aswRegSvr.exe" "C:\Program Files\AVAST Software\Avast\asOutExt.dll"
04 - HKLM\SOFTWARE | RunOnce : [aswasOutExt64.dll] - "C:\Program Files\AVAST Software\Avast\aswRegSvr64.exe" "C:\Program Files\AVAST Software\Avast\asOutExt64.dll"
04 - HKLM\SOFTWARE | RunOnce : [] -
04 - HKLM\SOFTWARE\wow6432Node | RunOnce : [aswAhAScr.dll] - "C:\Program Files\AVAST Software\Avast\aswRegSvr.exe" "C:\Program Files\AVAST Software\Avast\AhAScr.dll"
04 - HKLM\SOFTWARE\wow6432Node | RunOnce : [aswasOutExt.dll] - "C:\Program Files\AVAST Software\Avast\aswRegSvr.exe" "C:\Program Files\AVAST Software\Avast\asOutExt.dll"
04 - HKLM\SOFTWARE\wow6432Node | RunOnce : [aswasOutExt64.dll] - "C:\Program Files\AVAST Software\Avast\aswRegSvr64.exe" "C:\Program Files\AVAST Software\Avast\asOutExt64.dll"
04 - HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
04 - HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\SOFTWARE | Run : [Steam] - "C:\Program Files (x86)\Steam\Steam.exe" -silent
04 - HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\SOFTWARE | Run : [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
04 - HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\SOFTWARE | Run : [Facebook Update] - "C:\Users\diogo\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
04 - HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\SOFTWARE | Run : [ares] - "C:\Program Files (x86)\Ares\Ares.exe" -h
04 - HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\SOFTWARE | Run : [Microsoft] - wscript.exe //B "C:\Users\diogo\AppData\Local\Temp\Microsoft.vbe"

################## | Procura genérica |

Presente ! C:\Users\diogo\AppData\Roaming\unins000.exe
Presente ! C:\Users\diogo\AppData\Local\Temp\Microsoft.vbe
Presente ! C:\Users\diogo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.vbe
Presente ! I:\Microsoft.vbe

################## | Referência de comparação MD5 |

Md5 : D052FDF9CFFCAA72B3CBC131B97ADCF3 -> C:\Users\diogo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.vbe
Md5 : D052FDF9CFFCAA72B3CBC131B97ADCF3 -> C:\Users\diogo\AppData\Local\Temp\Microsoft.vbe
Md5 : D052FDF9CFFCAA72B3CBC131B97ADCF3 -> I:\Microsoft.vbe
Md5 : AD6E810B9CE3D8C0C1FF0203C68C6FA6 -> C:\Users\diogo\AppData\Roaming\unins000.exe
Md5 : D052FDF9CFFCAA72B3CBC131B97ADCF3 -> C:\Users\diogo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.vbe

################## | Comparação MD5 |

Presente ! Md5 : D052FDF9CFFCAA72B3CBC131B97ADCF3 -> C:\Users\diogo\AppData\Local\Temp\Microsoft.vbe
Presente ! Md5 : D052FDF9CFFCAA72B3CBC131B97ADCF3 -> C:\Users\diogo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.vbe
Presente ! Md5 : AD6E810B9CE3D8C0C1FF0203C68C6FA6 -> C:\Users\diogo\AppData\Roaming\unins000.exe
Presente ! Md5 : D052FDF9CFFCAA72B3CBC131B97ADCF3 -> I:\Microsoft.vbe

################## | Registro |

Presente ! HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|EnableShellExecuteHooks -> 1
Presente ! HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoActiveDesktop -> 1
Presente ! HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoActiveDesktopChanges -> 1
Presente ! HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\Software\Microsoft\Windows\CurrentVersion\Run|MICROSOFT
Presente ! HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\Software\Microsoft\Windows\CurrentVersion\Run|Microsoft
Presente ! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|MICROSOFT
Presente ! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Microsoft
Presente ! HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\Software\Microsoft\Windows\CurrentVersion\Run|Microsoft
Presente ! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Microsoft

################## | Vaccin |

(!) Este computador não é vacinada!

################## | E.O.F | [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] |

Mantenha conectado o pen drive no PC

*Clique com o botão direito do mouse no UsbFix e selecione [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

*Clique [Supressão] e cole o relatório apresentado

############################## | UsbFix V 7.152 | [Supressão]

Usuário: diogo (Administrador) # INSULANO
Atualizado em 20/11/2013 por El Desaparecido - Team SosVirus
Começou em 21:41:50 | 28/11/2013

Site : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Forum : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Upload Malware : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Contato : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

PC: Hewlett-Packard (18FA)
CPU: Intel(R) Core(TM) i3-3217U CPU @ 1.80GHz
RAM -> [Total : 3988 | Free : 2185]
Bios: Insyde
Boot: Normal boot

OS: Microsoft Windows 8 Single Language (6.2.9200 64-Bit)
WB: Windows Internet Explorer : 10.0.9200.16736
WB: Google Chrome : 31.0.1650.57

SC: Security Center Service [Enabled]
WU: Windows Update Service [(!) Disabled]
AV: avast! Antivirus [Enabled | Updated]
AS: Windows Defender : 4.3.0215.0
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Disco fixo # 196 Gb (121 Mb livre - 62%) [OS] # NTFS
D:\ -> Disco fixo # 17 Gb (2 Mb livre - 13%) [RECOVERY] # NTFS
E:\ -> Disco fixo # 251 Gb (251 Mb livre - 100%) [Diogo] # NTFS
G:\ -> CD-ROM
I:\ -> Disco removível # 4 Gb (4 Mb livre - 100%) [MEUPENDRIVE] # FAT32

################## | Processos parados |

Parado! C:\Program Files\AVAST Software\Avast\AvastSvc.exe (ID: 1420 |ParentID: 684)
Parado! C:\Program Files\AVAST Software\Avast\AvastUI.exe (ID: 4696 |ParentID: 4408)
Parado! C:\Windows\explorer.exe (ID: 4596 |ParentID: 652)
Parado! C:\Program Files\Intel\iCLS Client\HeciServer.exe (ID: 7132 |ParentID: 684)
Parado! C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe (ID: 3332 |ParentID: 684)
Parado! C:\Windows\System32\WUDFHost.exe (ID: 5568 |ParentID: 892)
Parado! C:\PROGRA~2\GbPlugin\GbpSv.exe (ID: 6856 |ParentID: 684)
Parado! C:\Windows\system32\DllHost.exe (ID: 4408 |ParentID: 800)
Parado! C:\Windows\system32\SearchIndexer.exe (ID: 1636 |ParentID: 684)
Parado! C:\Windows\System32\spoolsv.exe (ID: 3648 |ParentID: 684)
Parado! C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (ID: 5652 |ParentID: 684)
Parado! C:\Program Files\Windows Media Player\wmpnetwk.exe (ID: 1100 |ParentID: 684)
Parado! C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (ID: 5536 |ParentID: 684)
Parado! C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe (ID: 2760 |ParentID: 684)
Parado! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 6588 |ParentID: 4720)
Parado! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 3772 |ParentID: 6588)
Parado! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 392 |ParentID: 6588)
Parado! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 6672 |ParentID: 6588)
Parado! C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe (ID: 5140 |ParentID: 800)
Parado! C:\Windows\System32\RuntimeBroker.exe (ID: 3192 |ParentID: 800)
Parado! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 6164 |ParentID: 6588)
Parado! C:\Windows\system32\taskeng.exe (ID: 5988 |ParentID: 996)
Parado! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 1980 |ParentID: 6588)
Parado! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 2252 |ParentID: 6588)
Parado! C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (ID: 5748 |ParentID: 6588)
Parado! C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe (ID: 4416 |ParentID: 684)
Parado! C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe (ID: 6744 |ParentID: 684)

################## | Regedit Run |

04 - HKLM\SOFTWARE | Run : [BtTray] - "C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe"
04 - HKLM\SOFTWARE | Run : [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
04 - HKLM\SOFTWARE | Run : [RemoteControl10] - "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"
04 - HKLM\SOFTWARE | Run : [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
04 - HKLM\SOFTWARE | Run : [HP CoolSense] - C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe -byrunkey
04 - HKLM\SOFTWARE | Run : [GrooveMonitor] - "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
04 - HKLM\SOFTWARE | Run : [EaseUS EPM tray] - C:\Program Files (x86)\EaseUS\EaseUS Partition Master 9.2.2\bin\EpmNews.exe
04 - HKLM\SOFTWARE | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
04 - HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [BtTray] - "C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [RemoteControl10] - "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [HP CoolSense] - C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe -byrunkey
04 - HKLM\SOFTWARE\wow6432Node | Run : [GrooveMonitor] - "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
04 - HKLM\SOFTWARE\wow6432Node | Run : [EaseUS EPM tray] - C:\Program Files (x86)\EaseUS\EaseUS Partition Master 9.2.2\bin\EpmNews.exe
04 - HKLM\SOFTWARE\wow6432Node | Run : [avast] - "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
04 - HKLM\SOFTWARE\wow6432Node | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
04 - HKLM\SOFTWARE | RunOnce : [aswAhAScr.dll] - "C:\Program Files\AVAST Software\Avast\aswRegSvr.exe" "C:\Program Files\AVAST Software\Avast\AhAScr.dll"
04 - HKLM\SOFTWARE | RunOnce : [aswasOutExt.dll] - "C:\Program Files\AVAST Software\Avast\aswRegSvr.exe" "C:\Program Files\AVAST Software\Avast\asOutExt.dll"
04 - HKLM\SOFTWARE | RunOnce : [aswasOutExt64.dll] - "C:\Program Files\AVAST Software\Avast\aswRegSvr64.exe" "C:\Program Files\AVAST Software\Avast\asOutExt64.dll"
04 - HKLM\SOFTWARE | RunOnce : [] -
04 - HKLM\SOFTWARE\wow6432Node | RunOnce : [aswAhAScr.dll] - "C:\Program Files\AVAST Software\Avast\aswRegSvr.exe" "C:\Program Files\AVAST Software\Avast\AhAScr.dll"
04 - HKLM\SOFTWARE\wow6432Node | RunOnce : [aswasOutExt.dll] - "C:\Program Files\AVAST Software\Avast\aswRegSvr.exe" "C:\Program Files\AVAST Software\Avast\asOutExt.dll"
04 - HKLM\SOFTWARE\wow6432Node | RunOnce : [aswasOutExt64.dll] - "C:\Program Files\AVAST Software\Avast\aswRegSvr64.exe" "C:\Program Files\AVAST Software\Avast\asOutExt64.dll"
04 - HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
04 - HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\SOFTWARE | Run : [Steam] - "C:\Program Files (x86)\Steam\Steam.exe" -silent
04 - HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\SOFTWARE | Run : [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
04 - HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\SOFTWARE | Run : [Facebook Update] - "C:\Users\diogo\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
04 - HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\SOFTWARE | Run : [ares] - "C:\Program Files (x86)\Ares\Ares.exe" -h
04 - HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\SOFTWARE | Run : [Microsoft] - wscript.exe //B "C:\Users\diogo\AppData\Local\Temp\Microsoft.vbe"

################## | Procura genérica |

Supprimido ! C:\Users\diogo\AppData\Roaming\unins000.exe
Supprimido ! C:\Users\diogo\AppData\Local\Temp\Microsoft.vbe
Supprimido ! C:\Users\diogo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.vbe
Supprimido ! I:\Microsoft.vbe

(!) Ficheiros temporários suprimido.

################## | Referência de comparação MD5 |

Md5 : D052FDF9CFFCAA72B3CBC131B97ADCF3 -> C:\Users\diogo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.vbe
Md5 : D052FDF9CFFCAA72B3CBC131B97ADCF3 -> C:\Users\diogo\AppData\Local\Temp\Microsoft.vbe
Md5 : D052FDF9CFFCAA72B3CBC131B97ADCF3 -> C:\Users\diogo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.vbe
Md5 : D052FDF9CFFCAA72B3CBC131B97ADCF3 -> I:\Microsoft.vbe
Md5 : AD6E810B9CE3D8C0C1FF0203C68C6FA6 -> C:\Users\diogo\AppData\Roaming\unins000.exe
Md5 : D052FDF9CFFCAA72B3CBC131B97ADCF3 -> C:\Users\diogo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.vbe

################## | Comparação MD5 |


################## | Registro |

Reparado ! HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|EnableShellExecuteHooks -> 0
Reparado ! HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoActiveDesktop -> 0
Reparado ! HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoActiveDesktopChanges -> 0
Supprimido ! HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\Software\Microsoft\Windows\CurrentVersion\Run|MICROSOFT
Supprimido ! HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\Software\.\.\.\.\Mountpoints2\{2455f717-0c0b-11e3-be8a-f4b7e2d348b6}
Supprimido ! HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\Software\.\.\.\.\Mountpoints2\{64c4e5ee-01dc-11e3-be87-f4b7e2d348b6}
Supprimido ! HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\Software\.\.\.\.\Mountpoints2\{6b07c3df-2a08-11e3-be95-f4b7e2d348b6}
Supprimido ! HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\Software\.\.\.\.\Mountpoints2\{91dda931-fea1-11e2-be86-f4b7e2d348b6}
Supprimido ! HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\Software\.\.\.\.\Mountpoints2\{db7832dc-fbcf-11e2-be85-f4b7e2d348b6}
Supprimido ! HKU\S-1-5-21-1743113137-3031855012-3322223103-1001\Software\.\.\.\.\Mountpoints2\{db783376-fbcf-11e2-be85-f4b7e2d348b6}

################## | Listing |

[25/08/2013 - 10:57:34 | SHD ] C:\$Recycle.Bin
[05/07/2013 - 17:16:22 | D ] C:\Arquivos de Programas
[08/10/2013 - 16:36:31 | D ] C:\Arquivos de Programas RFB
[03/08/2012 - 21:21:36 | SHD ] C:\Boot
[26/07/2012 - 01:44:30 | RASH | 398156] C:\bootmgr
[02/06/2012 - 12:30:55 | N | 1] C:\BOOTNXT
[03/08/2012 - 21:21:37 | RASH | 8192] C:\BOOTSECT.BAK
[27/11/2013 - 21:58:28 | SHD ] C:\Config.Msi
[26/07/2012 - 05:22:08 | SHD ] C:\Documents and Settings
[28/11/2013 - 15:51:21 | ASH | 3345600512] C:\hiberfil.sys
[05/07/2013 - 20:37:22 | D ] C:\HP
[03/08/2012 - 20:39:51 | D ] C:\inetpub
[14/02/2013 - 22:54:53 | D ] C:\Intel
[15/07/2013 - 16:29:02 | RHD ] C:\MSOCache
[15/07/2013 - 16:26:49 | D ] C:\Office
[08/11/2013 - 17:44:34 | D ] C:\output
[28/11/2013 - 15:51:22 | ASH | 872415232] C:\pagefile.sys
[26/07/2012 - 05:33:46 | D ] C:\PerfLogs
[24/09/2013 - 16:20:38 | D ] C:\Program Files
[08/10/2013 - 16:36:38 | D ] C:\Program Files (x86)
[22/10/2013 - 19:11:05 | HD ] C:\ProgramData
[28/11/2013 - 15:51:22 | ASH | 268435456] C:\swapfile.sys
[28/09/2013 - 13:21:26 | D ] C:\SWSetup
[28/11/2013 - 15:52:12 | SHD ] C:\System Volume Information
[05/07/2013 - 17:20:48 | D ] C:\SYSTEM.SAV
[28/11/2013 - 21:47:15 | D ] C:\UsbFix
[28/11/2013 - 21:47:22 | A | 11360] C:\UsbFix [Clean 1] INSULANO.txt
[28/11/2013 - 21:44:44 | N | 7218] C:\UsbFix [Clean 2] INSULANO.txt
[28/11/2013 - 21:11:46 | N | 13119] C:\UsbFix [Scan 1] INSULANO.txt
[28/11/2013 - 21:07:45 | N | 8229] C:\UsbFix [Scan 2] INSULANO.txt
[26/07/2013 - 03:26:21 | RD ] C:\Users
[28/11/2013 - 15:58:35 | D ] C:\Windows
[26/07/2013 - 03:29:17 | SHD ] D:\$RECYCLE.BIN
[15/02/2013 - 00:11:31 | RSHD ] D:\boot
[26/07/2012 - 01:44:32 | RASH | 398156] D:\bootmgr
[26/07/2012 - 02:57:10 | N | 1350896] D:\bootmgr.efi
[15/02/2013 - 00:11:31 | D ] D:\EFI
[15/02/2013 - 00:11:31 | D ] D:\FactoryUpdate
[15/02/2013 - 00:11:31 | D ] D:\hp
[15/02/2013 - 00:11:32 | RSHD ] D:\preload
[18/07/2013 - 05:35:03 | RSD ] D:\recovery
[15/02/2013 - 00:11:31 | D ] D:\RM_Reserve
[24/09/2013 - 16:19:00 | SHD ] D:\System Volume Information
[26/07/2013 - 03:29:17 | SHD ] E:\$RECYCLE.BIN
[24/09/2013 - 16:19:00 | SHD ] E:\System Volume Information

################## | Vaccin |

I:\Autorun.inf -> Vacina criada por UsbFix (El Desaparecido)

################## | E.O.F | [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] |

Execute o UsbFix, clique [Uninstall] > [OK] e delete a pasta C:\UsbFix

O PC está limpo.

Um abraço...

CASO RESOLVIDO

Caso o(a) autor(a) do tópico necessite, o mesmo será reaberto, para isso deverá entrar em contato com um dos membros da [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] solicitando o desbloqueio.