Como retirar Baidu Antivirus com a ajuda do FarBar?

Não consigo tirar os restos dele de jeito nenhum   
Vcs podem me ajudar, por favor?  

  Olá Preter. Seja bem vindo ao Fórum PC Brasil.

 Faça o download do < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] >  < [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]> ( ... de Nicolas Coolman )

|- Desabilite temporariamente seu antivírus para evitar conflitos e execute "ZHPDiag2.exe", para instalar a ferramenta.
 
|- Execute o ícone do pergaminho. ( ZHPDiag )

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
 
|- Clique "SEARCH" ou "PESQUISAR" e aguarde a conclusão!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]
 
|- Clique OK e, ao concluir, poste o relatório ZHPDiag.txt

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

~ Relatório do ZHPDiag v2014.3.2.6 - Nicolas Coolman (3/3/2014)
~ Iniciado por POSITIVO (3/3/2014 16:12:41)
~ Endereço do Website : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Fóruns de suporte gratuito para desinfecção : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Tradução pelo utilizador
~ Estatuto da versão :
~ Lista Branca : Ativado pelo programa
~ Elevação dos Privilégios : OK
~ Controle de Conta de Utilizador : Not Found


---\\ Navegadores Internet
MSIE: Internet Explorer v8.0.6001.18702
GCIE: Google Chrome v33.0.1750.117 (Defaut)

---\\ Informações sobre os produtos Windows
~ Langage: Portugais
Microsoft Windows XP, 32-bit Service Pack 3 (Build 2600)
Windows Automatic Updates : OK
Windows Genuine Advantage : KO

---\\ Softwares de proteçao do sistema
avast! Free Antivirus v9.0.2013

---\\ Softwares d'optimização do sistema
CCleaner v4.11 =>Piriform Ltd

---\\ Softwares de partilha do PeerToPeer (P2P)

---\\ Monitoramento dos softwares
Adobe Flash Player 12 Plugin
Adobe Reader 9.1 - Português
Java 7 Update 51

---\\ Informações sobre o sistema
~ Processor: x86 Family 15 Model 6 Stepping 5, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 446 MB (29% free)
System Restore: Activé (Enable)
System drive H: has 123 GB (82%) free of 149 GB

---\\ Modo de conexão ao sistema
~ Computer Name: XP-27D7E0411B01
~ User Name: POSITIVO
~ All Users Names: SUPPORT_388945a0, POSITIVO, HelpAssistant, Convidado, Administrador,
~ Unselected Option: 045,061,O62,065,066,080,O82,089
Logged in as Administrator

---\\ As variáveis de ambiente
~ System Unit : H:\
~ %AppZHP% : H:\Documents and Settings\POSITIVO\Dados de aplicativos\ZHP\
~ %AppData% : H:\Documents and Settings\POSITIVO\Dados de aplicativos\
~ %Desktop% : H:\Documents and Settings\POSITIVO\Desktop\
~ %Favorites% : H:\Documents and Settings\POSITIVO\Favoritos\
~ %LocalAppData% : H:\Documents and Settings\POSITIVO\Configurações locais\Dados de aplicativos\
~ %StartMenu% : H:\Documents and Settings\POSITIVO\Menu Iniciar\
~ %Windir% : H:\WINDOWS\
~ %System% : H:\WINDOWS\system32\

---\\ Enumeração das unidades dos discos
A: Floppy drive, Flash card reader, USB Key (Not Inserted)
C: Floppy drive, Flash card reader, USB Key (Not Inserted)
D: Floppy drive, Flash card reader, USB Key (Not Inserted)
E: Floppy drive, Flash card reader, USB Key (Not Inserted)
F: Floppy drive, Flash card reader, USB Key (Not Inserted)
G: CD-ROM drive (Not Inserted)
H: Hard drive, Flash drive, Thumb drive (Free 123 Go of 149 Go)



---\\ Estado do Centro de Segurança do Windows
~ Security Center: 44 Legitimates Filtered in 00mn 00s



---\\ Pesquisa particular de ficheiros genéricos
[MD5.064EC7FF5F58B928C3E119402977FA6D] - (.Microsoft Corporation - Windows Explorer.) (.13/4/2008 - 18:21:00.) -- H:\WINDOWS\Explorer.exe [1035776]
[MD5.6CE32F7778061CCC5814D5E0F282D369] - (.Microsoft Corporation - Internet Extensions for Win32.) (.8/3/2009 - 04:34:58.) -- H:\WINDOWS\system32\wininet.dll [914944]
[MD5.71D440F79B711627B12B567FB2EADB42] - (.Microsoft Corporation - Aplicativo de logon do Windows NT.) (.13/4/2008 - 18:21:24.) -- H:\WINDOWS\system32\Winlogon.exe [509952]
[MD5.322D0E36693D6E24A2398BEE62A268CD] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.13/4/2008 - 11:19:24.) -- H:\WINDOWS\system32\Drivers\AFD.sys [138112]
[MD5.9F3A2F5AA6875C72BF062C712CFA2674] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.13/4/2008 - 08:40:32.) -- H:\WINDOWS\system32\Drivers\atapi.sys [96512]
[MD5.C885B02847F5D2FD45A24E219ED93B32] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/4/2008 - 11:14:22.) -- H:\WINDOWS\system32\Drivers\Cdfs.sys [63744]
[MD5.1F4260CC5B42272D71F79E570A27A4FE] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.13/4/2008 - 10:40:48.) -- H:\WINDOWS\system32\Drivers\Cdrom.sys [62976]
[MD5.A8D31E836CCF2F51009CE7DFFECF6D51] - (.Microsoft Corporation - FIPS Crypto Driver.) (.13/4/2008 - 17:52:44.) -- H:\WINDOWS\system32\Drivers\Fips.sys [44672]
[MD5.573C7D0A32852B48F3058CFD8026F511] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.13/4/2008 - 08:36:06.) -- H:\WINDOWS\system32\Drivers\HDAudBus.sys [144384]
[MD5.485BC6BEB778B5E9702E6AA3D384C0CB] - (.Microsoft Corporation - Driver de porta i8042.) (.13/4/2008 - 17:55:20.) -- H:\WINDOWS\system32\Drivers\i8042prt.sys [53504]
[MD5.083A052659F5310DD8B6A6CB05EDCF8E] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.13/4/2008 - 10:41:00.) -- H:\WINDOWS\system32\Drivers\Imapi.sys [42112]
[MD5.CC748EA12C6EFFDE940EE98098BF96BB] - (.Microsoft Corporation - IP Network Address Translator.) (.13/4/2008 - 10:57:16.) -- H:\WINDOWS\system32\Drivers\IpNat.sys [152832]
[MD5.23C74D75E36E7158768DD63D92789A91] - (.Microsoft Corporation - IPSec Driver.) (.13/4/2008 - 11:19:44.) -- H:\WINDOWS\system32\Drivers\IPSec.sys [75264]
[MD5.68755F0FF16070178B54674FE5B847B0] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.13/4/2008 - 11:17:02.) -- H:\WINDOWS\system32\Drivers\MRxSmb.sys [456576]
[MD5.74B2B2F5BEA5E9A3DC021D685551BD3D] - (.Microsoft Corporation - MBT Transport driver.) (.13/4/2008 - 11:21:02.) -- H:\WINDOWS\system32\Drivers\netBT.sys [162816]
[MD5.78A08DD6A8D65E697C18E1DB01C5CDCA] - (.Microsoft Corporation - NT File System Driver.) (.13/4/2008 - 11:15:54.) -- H:\WINDOWS\system32\Drivers\ntfs.sys [574976]
[MD5.9BADEE6B698BF1AF36E25A1A64A89EAB] - (.Microsoft Corporation - Driver de porta paralela.) (.13/4/2008 - 18:34:10.) -- H:\WINDOWS\system32\Drivers\Parport.sys [80384]
[MD5.11B4A627BC9614B885C4969BFA5FF8A6] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13/4/2008 - 11:19:44.) -- H:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328]
[MD5.15CABD0F7C00C47C70124907916AF3F1] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.13/4/2008 - 11:32:52.) -- H:\WINDOWS\system32\Drivers\rdpdr.sys [196224]
[MD5.68D749B04BFBBD4D4D15CC5185AFA4DD] - (.Microsoft Corporation - Redbook Audio Filter Driver.) (.13/4/2008 - 15:53:18.) -- H:\WINDOWS\system32\Drivers\redbook.sys [58240]
[MD5.EB6B1E2C984D84470FF4FE7EF98CD44A] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.13/4/2008 - 17:53:02.) -- H:\WINDOWS\system32\Drivers\volsnap.sys [53248]
~ Generic Processes: Scanned in 00mn 03s



---\\ Estatuto dos ficheiros ocultos (Oculto/Total)
~ Mes images (My Pictures) : 3/191
~ Mes musiques (My Musics) : 1/49
~ Mes Favoris (My Favorites) : 1/11
~ Mes Documents (My Documents) : 1/13449
~ Mon Bureau (My Desktop) : 3/12
~ Menu demarrer (Programs) : 1/22
~ Hidden Files: Scanned in 00mn 21s



---\\ Processos lançados
[MD5.CC42F104172B4A62793083D380867317] - (.AVAST Software - avast! Service.) -- H:\Arquivos de programas\AVAST Software\Avast\AvastSvc.exe [50344] [PID.1324]
[MD5.D63797E8E7781EE1500A810CB6194FA6] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- H:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe [253816] [PID.124]
[MD5.A78AAB0D2D70EF7DD56B7328AC502059] - (.AVAST Software - avast! Antivirus.) -- H:\Arquivos de programas\AVAST Software\Avast\AvastUI.exe [3767096] [PID.156]
[MD5.094A47AB1D4966C8CD318AD7EB1521A6] - (.SlimWare Utilities, Inc. - SlimDrivers.) -- H:\Arquivos de programas\SlimDrivers\SlimDrivers.exe [29395264] [PID.188]
[MD5.B9436A665A8621073A12338B16D7BFD4] - (.Oracle Corporation - Java Quick Starter Service.) -- H:\Arquivos de programas\Java\jre7\bin\jqs.exe [182696] [PID.828]
[MD5.506708142BC63DABA64F2D3AD1DCD5BF] - (.Google Inc. - Google Installer.) -- H:\Arquivos de programas\Google\Update\GoogleUpdate.exe [116648] [PID.920]
[MD5.11F714F85530A2BD134074DC30E99FCA] - (.Microsoft Corporation - Machine Debug Manager.) -- H:\Arquivos de programas\Arquivos comuns\Microsoft Shared\VS7DEBUG\MDM.exe [322120] [PID.1048]
[MD5.6D2018AEE93285F2A8BEF55D722187A3] - (.Microsoft Corporation - Application Layer Gateway Service.) -- H:\WINDOWS\System32\alg.exe [44544] [PID.2740]
[MD5.6E6656C6618C4B0B000267D9AF9EF743] - (.Google Inc. - Google Chrome.) -- H:\Arquivos de programas\Google\Chrome\Application\chrome.exe [859464] [PID.3112]
[MD5.66EA3B698F9A7EA2DBF0E4B246B6C958] - (.Nicolas Coolman - ZHPDiag.) -- H:\Arquivos de programas\ZHPDiag\ZHPDiag.exe [8349696] [PID.668]
~ Processes Running: Scanned in 00mn 02s



---\\ Internet Explorer, Arranque, Pesquisa, URLSearchHook( gancho de URL), Phishing (R0,R1,R3,R4)
R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ IE Browser: 13 Legitimates Filtered in 00mn 00s



---\\ Internet Explorer, Gestão do Proxy (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s



---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas
F2 - REG:system.ini: USERINIT=H:\WINDOWS\system32\userinit.exe,
F2 - REG:system.ini: Shell=H:\WINDOWS\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Keys: Scanned in 00mn 00s



---\\ Redireção do ficheiro Hosts (01)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 19



---\\ Barras do Internet Explorer (03))
O3 - Toolbar: avast! Online Security - [HKLM]{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} . (.AVAST Software - IE Webrep plugin.) -- H:\Arquivos de programas\AVAST Software\Avast\aswWebRepIE.dll
~ Toolbar: Scanned in 00mn 00s



---\\ Outras conexões do utilizador (04)
O4 - GS\Desktop [AllUsers]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- H:\Arquivos de programas\Google\Chrome\Application\chrome.exe
O4 - GS\Desktop [AllUsers]: SlimDrivers.lnk . (...) -- H:\WINDOWS\Installer\{A5457401-D56A-43F2-9524-78E54A7FC07A}\Icon.exe
O4 - GS\Desktop [AllUsers]: SPEEDY.lnk - Chave orfã
O4 - GS\Desktop [POSITIVO]: Atalho para ComboFix.lnk . (.Swearware - ComboFix NSIS Installer.) -- H:\Documents and Settings\POSITIVO\Meus documentos\Downloads\ComboFix.exe
~ Global Startup: 10 Legitimates Filtered in 00mn 01s



---\\ Aplicações iniciadas por registo & pastas (04)
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- H:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe =>.Oracle Corporation
O4 - HKLM\..\Run: [AvastUI.exe] . (.AVAST Software - avast! Antivirus.) -- H:\Arquivos de programas\AVAST Software\Avast\AvastUI.exe
O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- H:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SlimDrivers] . (.SlimWare Utilities, Inc. - SlimDrivers.) -- H:\Arquivos de programas\SlimDrivers\SlimDrivers.exe
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- H:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- H:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-21-448539723-413027322-1177238915-1003\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- H:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-448539723-413027322-1177238915-1003\..\Run: [SlimDrivers] . (.SlimWare Utilities, Inc. - SlimDrivers.) -- H:\Arquivos de programas\SlimDrivers\SlimDrivers.exe
~ Application: Scanned in 00mn 00s



---\\ Boutões da barra de ferramentas principal do Internet Explorer (09)
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- H:\Arquivos de programas\Microsoft Office\OFFICE11\REFBARH.ICO
O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -- Chave orfã
O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- H:\Arquivos de programas\Messenger\msmsgs.exe
~ IE Extra Buttons: Scanned in 00mn 00s



---\\ Piratagem da Opção " Redefinir Configurações da Web " (014)
O14 - IERESET.INF: SEARCH_PAGE_URL=SEARCH_PAGE_URL="&http://home.microsoft.com/intl/br/access/allinone.asp"
O14 - IERESET.INF: SAFESITE_VALUE=SAFESITE_VALUE="search.msn.com.br"
~ IE Paramètres WEB: Scanned in 00mn 00s



---\\ Alteração Dominio/Clientes DNS (017)
O17 - HKLM\System\CCS\Services\Tcpip\..\{FF425B82-2088-47B7-A127-5617C3D53EED}: NameServer = 200.204.0.10 200.204.0.138
O17 - HKLM\System\CS1\Services\Tcpip\..\{FF425B82-2088-47B7-A127-5617C3D53EED}: NameServer = 200.204.0.10 200.204.0.138
O17 - HKLM\System\CS2\Services\Tcpip\..\{FF425B82-2088-47B7-A127-5617C3D53EED}: NameServer = 200.204.0.10 200.204.0.138
~ Domain: Scanned in 00mn 00s



---\\ Protocolo adicional (018)
O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} . (.Microsoft Corporation - WIA Scripting Layer.) -- H:\WINDOWS\system32\wiascr.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- H:\Arquivos de programas\Arquivos comuns\Microsoft Shared\OFFICE11\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s



---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- H:\WINDOWS\system32\crypt32.dll
O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- H:\WINDOWS\system32\cryptnet.dll
O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agente de rede off-line.) -- H:\WINDOWS\system32\cscdll.dll
O20 - Winlogon Notify: dimsntfy . (.Microsoft Corporation - DIMS Notification Handler.) -- H:\WINDOWS\system32\dimsntfy.dll
O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- H:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- H:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL de notificação do serviço de logon secu.) -- H:\WINDOWS\system32\sclgntfy.dll
O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- H:\WINDOWS\system32\WlNotify.dll
O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- H:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- H:\WINDOWS\system32\wlnotify.dll
~ Winlogon: Scanned in 00mn 00s



---\\ Chave do Registo autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} . (.Microsoft Corporation - Biblioteca da interface de usuário do naveg.) -- H:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Pré-carregador Browseui - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Biblioteca da interface de usuário do naveg.) -- H:\WINDOWS\system32\browseui.dll
~ STS/SSO: Scanned in 00mn 00s



---\\ Enumeração Ativa do Ambiente de trabalho & Editor MHTML (024)
O24 - Desktop Component 0: Minha página inicial atual - file:About:Home
O24 - Desktop General: BackupWallPaper - .(...) - H:\Documents and Settings\POSITIVO\Configurações locais\Dados de aplicativos\Microsoft\Wallpaper1.bmp
O24 - Desktop General: WallPaper - .(...) - H:\Documents and Settings\POSITIVO\Configurações locais\Dados de aplicativos\Microsoft\Wallpaper1.bmp
~ Desktop Component: 4 Legitimates Filtered in 00mn 00s



---\\ Drivers lançados ao arranque do sistema (041)
O41 - Driver: (AswRdr) . (. - .) - ??\Hdrivers\aswRdr.sys (.not file.)
O41 - Driver: (aswSnx) . (. - .) - ??\Hdrivers\aswSnx.sys (.not file.)
O41 - Driver: (aswSP) . (. - .) - ??\Hdrivers\aswSP.sys (.not file.)
O41 - Driver: (aswTdi) . (. - .) - ??\Hdrivers\aswTdi.sys (.not file.)
~ Drivers: 72 Legitimates Filtered in 00mn 00s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\GbAs]
[HKLM\Software\Baidu Security] =>Adware.BDSearch
[HKLM\Software\Baidu_Drp_pos] =>Adware.BDSearch
[HKLM\Software\melondrea] =>PUP.Melondrea
~ Key Software: 135 Legitimates Filtered in 00mn 00s



---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 28/2/2014 - 03:24:26 - [0] ----D H:\Arquivos de programas\GrabRez =>Adware.GrabRez
O43 - CFD: 3/3/2014 - 02:05:14 - [48,394] ----D H:\Arquivos de programas\GUMDF.tmp
O43 - CFD: 17/4/2013 - 02:30:54 - [0,001] ----D H:\Arquivos de programas\Serviços on-line
O43 - CFD: 17/4/2013 - 02:30:23 - [0,008] ----D H:\Arquivos de programas\Arquivos comuns\Serviços
O43 - CFD: 19/8/2013 - 06:34:32 - [99,113] ----D H:\Documents and Settings\All Users\Dados de aplicativos\Baidu Security =>Adware.BDSearch
O43 - CFD: 3/3/2014 - 02:08:45 - [2,821] ----D H:\Documents and Settings\POSITIVO\Dados de aplicativos\Baidu Security =>Adware.BDSearch
O43 - CFD: 17/4/2013 - 10:18:54 - [0,014] R---D H:\Documents and Settings\POSITIVO\Menu Iniciar\Programas\Acessórios
O43 - CFD: 3/3/2014 - 02:07:34 - [0] R---D H:\Documents and Settings\POSITIVO\Menu Iniciar\Programas\Inicializar
~ Program Folder: 82 Legitimates Filtered in 00mn 09s



---\\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044)
O44 - LFC:[MD5.866F4023AE3BB04FEC87A06E953097FB] - 2/3/2014 - 16:52:38 ---A- . (...) -- H:\WINDOWS\system32\jupdate-1.7.0_51-b13.log [5899]
O44 - LFC:[MD5.F042EE4C8D66248D9B86DCF52ABAE416] - 3/3/2014 - 02:17:42 ---A- . (...) -- H:\WINDOWS\PEV.exe [256000]
O44 - LFC:[MD5.9E05A9C264C8A908A8E79450FCBFF047] - 3/3/2014 - 02:17:42 ---A- . (...) -- H:\WINDOWS\grep.exe [80412]
O44 - LFC:[MD5.2B657A67AEBB84AEA5632C53E61E23BF] - 3/3/2014 - 02:17:42 ---A- . (...) -- H:\WINDOWS\sed.exe [98816]
O44 - LFC:[MD5.5E832F4FAF5F481F2EAF3B3A48F603B8] - 3/3/2014 - 02:17:42 ---A- . (...) -- H:\WINDOWS\zip.exe [68096]
O44 - LFC:[MD5.0277C027A26428DB64EF4F64F52BB4FD] - 3/3/2014 - 02:17:43 ---A- . (...) -- H:\WINDOWS\MBR.exe [208896]
O44 - LFC:[MD5.C51A881398F29071239741AE16D07C1C] - 3/3/2014 - 02:23:32 RSHA- . (...) -- H:\cmldr [261856]
O44 - LFC:[MD5.BB4E8E4D5CC4EF59D6E34B5F0CA7EF7F] - 3/3/2014 - 02:23:35 ---A- . (...) -- H:\Boot.bak [210]
O44 - LFC:[MD5.D41D8CD98F00B204E9800998ECF8427E] - 3/3/2014 - 13:15:56 ---A- . (...) -- H:\WINDOWS\Sti_Trace.log [0]
O44 - LFC:[MD5.D29063020B8AE53A4B38D3F72EAE4E5B] - 3/3/2014 - 13:15:58 ---A- . (...) -- H:\WINDOWS\wiaservc.log [48]
O44 - LFC:[MD5.11E635D3BBF1EA377DBD2C86F2FBF273] - 3/3/2014 - 14:52:56 ---A- . (...) -- H:\WINDOWS\wiadebug.log [430]
O44 - LFC:[MD5.75A8EE6F0917AD9355367DBF25DB8415] - 3/3/2014 - 14:54:24 ---A- . (...) -- H:\WINDOWS\system32\Drivers\SWDUMon.sys [13464]
~ Files: 49 Legitimates Filtered in 00mn 05s



---\\ Operações e funções ao arranque do Windows Explorer (046)
O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll
~ ShellExecuteHooks: Scanned in 00mn 00s



---\\ Exportar a chave da aplicação autorizada (047)
O47 - AAKE:Key Export SP - "H:\Arquivos de programas\FrostWire 5\FrostWire.exe" [Enabled] .(...) -- H:\Arquivos de programas\FrostWire 5\FrostWire.exe (.not file.)
~ Keys Export: 10 Legitimates Filtered in 00mn 00s



---\\ Image File Execution Options (IFEO) (O50)
O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d
~ IFEO: Scanned in 00mn 00s



---\\ Enumeração das chaves do registo StartupReg (SMSR) (O53)
O53 - SMSR:HKLM\...\startupreg\Ярлык для страницы свойств High Definition Audio [Key] . (.Windows (R) Server 2003 DDK provider - High Definition Audio Property Page Shortcu.) -- H:\WINDOWS\system32\HDAShCut.exe
~ SMSR Keys: 6 Legitimates Filtered in 00mn 00s



---\\ Lista dos drivers do sistema (SDL) (O58)
O58 - SDL:[MD5.F277C43C2E0672EED28CCA0D13CE175F] - 24/3/2008 - 05:08:14 ---A- . (.Analog Devices, Inc. - High Definition Audio Function Driver.) -- H:\WINDOWS\system32\Drivers\ADIHdAud.sys [331264]
O58 - SDL:[MD5.D48659BB24C48345D926ECB45C1EBDF5] - 13/8/2004 - 00:56:20 ---A- . (.No owner - ATK0110 ACPI Utility.) -- H:\WINDOWS\system32\Drivers\ASACPI.sys [5810]
O58 - SDL:[MD5.F385467DF95D0A73775CB3B076B8B969] - 1/3/2014 - 03:24:55 ---A- . (...) -- H:\WINDOWS\system32\Drivers\aswRvrt.sys [49944]
O58 - SDL:[MD5.1B0662514A68C3A42E60D240C5ABEF28] - 1/3/2014 - 03:24:55 ---A- . (...) -- H:\WINDOWS\system32\Drivers\aswVmm.sys [180248]
O58 - SDL:[MD5.E31BA3DC84CAE33ED6ED98201913EC1C] - 3/9/2013 - 08:59:02 ---A- . (.Baidu, Inc. - Baidu Antivirus Hook Base.) -- H:\WINDOWS\system32\Drivers\Bhbase.sys [47456] =>Adware.BDSearch
O58 - SDL:[MD5.DA6675E1400D58412C93180F8651A9FB] - 28/10/2001 - 11:06:30 ---A- . (.RAVISENT Technologies Inc. - CineMaster C 1.2 WDM Main Driver.) -- H:\WINDOWS\system32\Drivers\cinemst2.sys [262528]
O58 - SDL:[MD5.573C7D0A32852B48F3058CFD8026F511] - 13/4/2008 - 08:36:06 ---A- . (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) -- H:\WINDOWS\system32\Drivers\hdaudbus.sys [144384]
O58 - SDL:[MD5.2A013E7530BEAB6E569FAA83F517E836] - 7/1/2005 - 10:07:16 ---A- . (.Windows (R) Server 2003 DDK provider - High Definition Audio Function Driver v1.0a.) -- H:\WINDOWS\system32\Drivers\HdAudio.sys [145920]
O58 - SDL:[MD5.80D317BD1C3DBC5D4FE7B1678C60CADD] - 28/10/2001 - 11:07:22 ---A- . (.Parallel Technologies, Inc. - Parallel Technologies DirectParallel IO Library.) -- H:\WINDOWS\system32\Drivers\ptilink.sys [17792]
O58 - SDL:[MD5.B6A6B409FDA9D9EBD3AADB838D3D7173] - 17/3/2006 - 13:18:58 ---A- . (.Sensaura - Sensaura WDM 3D Audio Driver.) -- H:\WINDOWS\system32\Drivers\senfilt.sys [392960]
O58 - SDL:[MD5.75A8EE6F0917AD9355367DBF25DB8415] - 3/3/2014 - 14:54:24 ---A- . (...) -- H:\WINDOWS\system32\Drivers\SWDUMon.sys [13464]
O58 - SDL:[MD5.55E01061C74A8CEFFF58DC36114A8D3F] - 28/10/2001 - 11:06:30 ---A- . (.RAVISENT Technologies Inc. - CineMaster C WDM DVD Minidriver.) -- H:\WINDOWS\system32\Drivers\vdmindvd.sys [58112]
O58 - SDL:[MD5.C1E76718BAB6BCA0D18E5670F074F821] - 28/10/2001 - 11:06:08 ---A- . (...) -- H:\WINDOWS\system32\ansi.sys [9032]
O58 - SDL:[MD5.0FE9F16075C9ACB941C957B7C649176E] - 28/10/2001 - 11:06:16 ---A- . (...) -- H:\WINDOWS\system32\country.sys [27097]
O58 - SDL:[MD5.912150FE88E79AFEE0BB72216FAB2617] - 28/10/2001 - 11:06:36 ---A- . (...) -- H:\WINDOWS\system32\himem.sys [4896]
O58 - SDL:[MD5.582BCDD47CF4B68B5CB528F18E3CB808] - 28/10/2001 - 11:06:40 ---A- . (...) -- H:\WINDOWS\system32\key01.sys [42809]
O58 - SDL:[MD5.FBBCFEC1379C5C02D88A361993EDF1B8] - 13/4/2008 - 08:50:56 ---A- . (...) -- H:\WINDOWS\system32\keyboard.sys [42537]
O58 - SDL:[MD5.19D4F0DAD3F393C13DE7F849ADE72EFE] - 28/10/2001 - 11:07:10 ---A- . (...) -- H:\WINDOWS\system32\ntdos.sys [27900]
O58 - SDL:[MD5.CF9ED169FF86D935E47999E82359E898] - 28/10/2001 - 11:07:10 ---A- . (...) -- H:\WINDOWS\system32\ntdos404.sys [29146]
O58 - SDL:[MD5.03B945AC0481CD8BB161C3569D8ED1C3] - 28/10/2001 - 11:07:10 ---A- . (...) -- H:\WINDOWS\system32\ntdos411.sys [29370]
O58 - SDL:[MD5.BBC957DC18C17CC027EB80B7C77F2AEA] - 28/10/2001 - 11:07:10 ---A- . (...) -- H:\WINDOWS\system32\ntdos412.sys [29274]
O58 - SDL:[MD5.3CFFAEFFF23B0D208214A6D3061A5B1B] - 28/10/2001 - 11:07:10 ---A- . (...) -- H:\WINDOWS\system32\ntdos804.sys [29146]
O58 - SDL:[MD5.86BB7AF2533B342B8E274590AD2190FA] - 13/4/2008 - 08:49:48 ---A- . (...) -- H:\WINDOWS\system32\ntio.sys [33984]
O58 - SDL:[MD5.6F73F50162DEF60C84B725C18CD9140F] - 13/4/2008 - 08:49:44 ---A- . (...) -- H:\WINDOWS\system32\ntio404.sys [34560]
O58 - SDL:[MD5.0FDD5E69C1FF3B58043D44F2CC743D45] - 13/4/2008 - 08:49:40 ---A- . (...) -- H:\WINDOWS\system32\ntio411.sys [35648]
O58 - SDL:[MD5.8842837C4D8311BF8E72BEE8CCC42217] - 13/4/2008 - 08:49:44 ---A- . (...) -- H:\WINDOWS\system32\ntio412.sys [35424]
O58 - SDL:[MD5.6B56CEB3C6F9D5CD7293DBD9FE23B311] - 13/4/2008 - 08:49:42 ---A- . (...) -- H:\WINDOWS\system32\ntio804.sys [34560]
~ Drivers: 6 Legitimates Filtered in 00mn 07s



---\\ Lista das ferramentas de remoção de vírus (LAT) (063)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s



---\\ Lista dos serviços Legacy du registo (064)
O64 - Services: CurCS - 3/9/2013 - H:\WINDOWS\system32\drivers\Bhbase.sys (Bhbase) .(.Baidu, Inc. - Baidu Antivirus Hook Base.) - LEGACY_BHBASE =>Adware.BDSearch
~ Legacy: 122 Legitimates Filtered in 00mn 03s



---\\ Associações Shell Spawning (O67)
O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 10 Legitimates Filtered in 00mn 01s



---\\ Menu de inicialização Internet (068)
O68 - StartMenuInternet: <>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- H:\Arquivos de programas\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- H:\Arquivos de programas\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- H:\Arquivos de programas\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s



---\\ Pesquisa de infeção nos navegadores da Internet (SBI) (069)
O69 - SBI: SearchScopes [HKCU] Web - (Web) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Keys: Scanned in 00mn 00s



---\\ Pesquisa adicional à raiz do sistema (radicular) (SPRF) (O84)
[MD5.A845789676F7D2A542E708EB5CAC12C9] [SPRF][2/3/2014] (...) -- H:\Documents and Settings\POSITIVO\Desktop\adwcleaner.exe [1244192]
~ Files: 2 Legitimates Filtered in 00mn 01s



---\\ Estado general dos serviços não Microsoft (EGS) (SR=Executados, SS=Parados)
SS - | Demand 21/2/2014 257928 | (AdobeFlashPlayerUpdateSvc) . (.Adobe Systems Incorporated.) - H:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
SS - | Demand 13/4/2008 225280 | (dmadmin) . (.Microsoft Corp., Veritas Software.) - H:\WINDOWS\system32\dmadmin.exe
SS - | Auto 3/3/2014 116648 | (gupdate) . (.Google Inc..) - H:\Arquivos de programas\Google\Update\GoogleUpdate.exe
SS - | Demand 3/3/2014 116648 | (gupdatem) . (.Google Inc..) - H:\Arquivos de programas\Google\Update\GoogleUpdate.exe

SR - | Auto 1/3/2014 50344 | (avast! Antivirus) . (.AVAST Software.) - H:\Arquivos de programas\AVAST Software\Avast\AvastSvc.exe
SR - | Auto 18/12/2013 182696 | (JavaQuickStarterService) . (.Oracle Corporation.) - H:\Arquivos de programas\Java\jre7\bin\jqs.exe

~ Services: Scanned in 02mn 19s



---\\ Scâner Aditional (088)
Database Version : 13031 - (3/3/2014)
Clés trouvées (Keys found) : 1
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 3
Fichiers trouvés (Files found) : 3

[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus] =>Adware.BDSearch
H:\Arquivos de programas\GrabRez =>Adware.GrabRez^
H:\Documents and Settings\All Users\Dados de aplicativos\Baidu Security =>Adware.BDSearch^
H:\Documents and Settings\POSITIVO\Dados de aplicativos\Baidu Security =>Adware.BDSearch^
[HKLM\Software\Baidu Security] =>Adware.BDSearch^
[HKLM\Software\Baidu_Drp_pos] =>Adware.BDSearch^
[HKLM\Software\melondrea] =>PUP.Melondrea^
~ Additionnel Scan: 144662 Items scanned in 01mn 38s



---\\ Sumário das deteções encontradas na sua estação
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Adware.BDSearch
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Melondrea
~ MSI: 2 link(s) detected in 01mn 38s



~ 706 Legitimates filtered by white list
End of the scan (429 lines in 05mn 23s)(0)

 Copie todo o texto destacado em vermelho que te passei (começando em script zhpfix e indo até SysRestore)
_____________________________________________________________________________________________________________

 Vá no menu: Iniciar > Todos os programas > ZHP > Abra o Zhpfix > Clique em Importação > Clique no botão GO > Clique em Oui > Caso queira que os arquivos da lixeira sejam excluídos clique em Oui novamente > Um relatório aparecerá no bloco de notas.

Copie este relatório e poste em sua próxima resposta.

Rapport de ZHPFix 2014.2.16.5 par Nicolas Coolman, Update du 16/02/2014
Fichier d'export Registre :
Run by POSITIVO at 3/3/2014 16:51:18
High Elevated Privileges : OK
Windows XP Professional Service Pack 3 (Build 2600)

Reciclagem vazia (00mn 03s)
Reparação de atalhos do navegador

========== Estado dos serviços ==========
BHBASE Parado

========== Chaves do Registo ==========
ELIMINÉ: CLSID Extra Buttons: {e2e2dd38-d088-4134-82b7-f2ba38496583}
ELIMINÉ: HKLM\Software\Baidu Security
ELIMINÉ: HKLM\Software\Baidu_Drp_pos
ELIMINÉ: HKLM\Software\melondrea
ELIMINÉ: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus

========== Valores do Registo ==========
ELIMINÉ AAKE KeyValue: H:\Arquivos de programas\FrostWire 5\FrostWire.exe
ProxyFix : Configuração proxy removida com sucesso
ELIMINÉ ProxyServer Value
ELIMINÉ ProxyEnable Value
ELIMINÉ EnableHttp1_1 Value
ELIMINÉ ProxyHttp1.1 Value
ELIMINÉ ProxyOverride Value

========== Pastas ==========
Nenhuma pasta CLSID local utilizador vazia

========== Ficheiros ==========
ELIMINÉ: h:\windows\system32\drivers\bhbase.sys
ELIMINÉ Temporários windows (161) (47.884.587 octets)
ELIMINÉ Flash Cookies (0) (0 octets)

========== Restauração Sistema ==========
Ponto de restauro do sistema criado com sucesso


========== Recapitulativo ==========
5 : Chaves do Registo
7 : Valores do Registo
1 : Pastas
3 : Ficheiros
1 : Estado dos serviços
1 : Restauração Sistema


End of clean in 01mn 02s

 Desative temporariamente seu antivírus para evitar conflitos.

Acesse este link abaixo e clique no primeiro botão da esquerda que é o botão Download Zoek.exe:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

*Clique com o botão direito do mouse no Zoek.exe e selecione [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

* Copie todo este texto destacado em vermelho que te passei e cole-o no espaço em branco do Zoek.

*Clique [Run Script]

*Durante o scan uma mensagem parecida com esta abaixo mostrando o progresso do escaneamento será apresentada. Aguarde o término...pode demorar!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

*Caso a reinicialização do PC seja solicitada, clique [OK]

* Poste o log do Zoek que estará em C:\zoek-results.txt em sua próxima resposta.

Zoek.exe v5.0.0.0 Updated 02-March-2014
Tool run by POSITIVO on seg 03/03/2014 at 17:14:20,62.
Microsoft Windows XP Professional 5.1.2600 Service Pack 3 x86
Running in: Normal Mode Internet Access Detected
Launched: H:\Documents and Settings\POSITIVO\Meus documentos\Downloads\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

3/3/2014 17:15:56 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== Deleting Files \ Folders ======================

H:\Arquivos de programas\GUTE0.tmp deleted
H:\Arquivos de programas\GUMDF.tmp deleted
H:\WINDOWS\System32\InstallUtil.InstallLog deleted

==== Folders Found ======================

2014-03-02 19:19:03 2014-03-02 19:19:03 -------- d-----w- H:\AdwCleaner\Quarantine\H\Documents and Settings\All Users\Dados de aplicativos\baidu
2014-03-03 04:36:03 2014-03-03 04:36:03 -------- d-----w- H:\Documents and Settings\POSITIVO\Configurações locais\Temp\baidu_secure
2014-03-03 19:50:35 2014-03-03 19:51:00 -------- d-----w- H:\Documents and Settings\POSITIVO\Dados de aplicativos\ZHP\Quarantine\Baidu Security.DIR
2014-03-03 19:51:00 2014-03-03 19:51:00 -------- d-----w- H:\Documents and Settings\POSITIVO\Dados de aplicativos\ZHP\Quarantine\Baidu Security.DIR\Baidu Security
2014-03-03 19:51:00 2014-03-03 19:51:00 -------- d-----w- H:\Documents and Settings\POSITIVO\Dados de aplicativos\ZHP\Quarantine\Baidu Security.DIR\Baidu Security\PC Faster\4.0.0.0\Uninstall\Baidu PC Faster Uninstall
2014-03-03 19:51:00 2014-03-03 19:51:00 -------- d-----w- H:\Documents and Settings\POSITIVO\Dados de aplicativos\ZHP\Quarantine\Baidu Security.DIR\Baidu Security\PC Faster\4.0.0.0\Uninstall\Baidu PC Faster Uninstall HK

==== Files Found ======================


--- H:\Documents and Settings\POSITIVO\Dados de aplicativos\ZHP\Quarantine\Baidu Security.DIR\RpData\rpFile-Baidu_Secure_SystemUp_4.0.1.56634-2014-03-03 03-00-54-0718-[32720].dat ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 723
Created time: 2014-03-03 19:50:35
Modified time: 2014-03-03 05:02:06
MD5: C4273D9DFDD8BE91C345B7EDBCD93DAF
SHA1: BDAD0C4D2255D225D19406C121EB5F920FC640BC


==== Registry Search Results for "Baidu" ======================


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\Baidu_Secure_SystemUp_3.6.0.38659]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\Baidu_Secure_SystemUp_3.6.0.38659\DEBUG]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\Baidu_Secure_SystemUp_4.0.1.56634]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\Baidu_Secure_SystemUp_4.0.1.56634\DEBUG]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{77FEF28E-EB96-44FF-B511-3185DEA48697}]
"DllName"="baidubar.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{B580CF65-E151-49C3-B73F-70B13FCA8E86}]
"DllName"="baidubar.dll"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BHBASE\0000]
"DeviceDesc"="Baidu Hook Base"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Bhbase]
"DisplayName"="Baidu Hook Base"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BprotectEx]
"DisplayName"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BprotectEx]
"InstPath"="H:\\Arquivos de programas\\Baidu Security\\PC Faster\\3.7.0.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCFApiUtil]
"ImagePath"="\\??\\H:\\Arquivos de programas\\Baidu Security\\PC Faster\\3.7.0.0\\PCFApiUtil.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BHBASE\0000]
"DeviceDesc"="Baidu Hook Base"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Bhbase]
"DisplayName"="Baidu Hook Base"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BprotectEx]
"DisplayName"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BprotectEx]
"InstPath"="H:\\Arquivos de programas\\Baidu Security\\PC Faster\\3.7.0.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\PCFApiUtil]
"ImagePath"="\\??\\H:\\Arquivos de programas\\Baidu Security\\PC Faster\\3.7.0.0\\PCFApiUtil.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BHBASE\0000]
"DeviceDesc"="Baidu Hook Base"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_BPROTECTEX\0000]
"DeviceDesc"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bhbase]
"DisplayName"="Baidu Hook Base"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BprotectEx]
"DisplayName"="Baidu ProtectEx"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BprotectEx]
"InstPath"="H:\\Arquivos de programas\\Baidu Security\\PC Faster\\3.7.0.0"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PCFApiUtil]
"ImagePath"="\\??\\H:\\Arquivos de programas\\Baidu Security\\PC Faster\\3.7.0.0\\PCFApiUtil.sys"

[HKEY_USERS\.DEFAULT\Software\Baidu Security]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\DataReport]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\DataReport]
"h:\\documents and settings\\all users\\dados de aplicativos\\baidu security\\rpdata"="http://sync.pcfaster.baidu.com/cgi-bin-py/get_pcf_statistic_info.cgi"

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\DataReport]
"h:\\documents and settings\\all users\\dados de aplicativos\\baidu security\\rpdata\\2013-09-12 00_30_30_0546rpdata.dat"="http://sync.pcfaster.baidu.com/cgi-bin-py/get_pcf_statistic_info.cgi"

[HKEY_USERS\S-1-5-21-448539723-413027322-1177238915-1003\Software\Avast Software\WRC\SearchRules\baidu.com]

[HKEY_USERS\S-1-5-21-448539723-413027322-1177238915-1003\Software\Avast Software\WRC\SearchRules\baidu.com]
"url"="^http\\:\\/\\/www\\.baidu\\.com\\/.*"

[HKEY_USERS\S-1-5-18\Software\Baidu Security]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\DataReport]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\DataReport]
"h:\\documents and settings\\all users\\dados de aplicativos\\baidu security\\rpdata"="http://sync.pcfaster.baidu.com/cgi-bin-py/get_pcf_statistic_info.cgi"

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\DataReport]
"h:\\documents and settings\\all users\\dados de aplicativos\\baidu security\\rpdata\\2013-09-12 00_30_30_0546rpdata.dat"="http://sync.pcfaster.baidu.com/cgi-bin-py/get_pcf_statistic_info.cgi"

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"wrc@avast.com"="H:\Arquivos de programas\AVAST Software\Avast\WebRep\FF" [01/03/2014 03:24]

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
gomekmidlodglbbmalcneegieacbdmki - H:\Arquivos de programas\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[01/03/2014 03:24]

Google Wallet - POSITIVO\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.baixaki.com.br/portal/?utm_source=sol&utm_medium=ppi&utm_campaign=portal"
"Default_Page_URL"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://www.google.com"
"Default_Search_URL"="http://www.google.com"
"Search Page"="http://www.google.com"
"Start Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.google.com"
"CustomizeSearch"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://www.baixaki.com.br/portal/?utm_source=sol&utm_medium=ppi&utm_campaign=portal"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm"
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Reset Google Chrome ======================

H:\Documents and Settings\POSITIVO\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\Preferences was reset successfully
H:\Documents and Settings\POSITIVO\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\Web Data was reset successfully

==== shortcuts on Users Desktops ======================

H:\Documents and Settings\POSITIVO\Desktop\Atalho para ComboFix.lnk - H:\Documents and Settings\POSITIVO\Meus documentos\Downloads\ComboFix.exe
H:\Documents and Settings\POSITIVO\Desktop\Windows Media Player.lnk - H:\Arquivos de programas\Windows Media Player\wmplayer.exe /prefetch:1
H:\Documents and Settings\POSITIVO\Desktop\ZHPDiag.lnk - H:\Arquivos de programas\ZHPDiag\ZHPhep.exe
H:\Documents and Settings\POSITIVO\Desktop\ZHPFix.lnk - H:\Arquivos de programas\ZHPDiag\ZHPFix\ZHPhep.exe

==== shortcuts on All Users Desktop ======================

H:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk - H:\Arquivos de programas\Adobe\Reader 9.0\Reader\AcroRd32.exe
H:\Documents and Settings\All Users\Desktop\avast Free Antivirus.lnk -
H:\Documents and Settings\All Users\Desktop\CCleaner.lnk - H:\Arquivos de programas\CCleaner\CCleaner.exe
H:\Documents and Settings\All Users\Desktop\Google Chrome.lnk - H:\Arquivos de programas\Google\Chrome\Application\chrome.exe
H:\Documents and Settings\All Users\Desktop\SlimDrivers.lnk - H:\WINDOWS\Installer\{A5457401-D56A-43F2-9524-78E54A7FC07A}\Icon.exe
H:\Documents and Settings\All Users\Desktop\SPEEDY.lnk -

==== shortcuts in Users Start Menu ======================

H:\Documents and Settings\POSITIVO\Menu Iniciar\Programas\Internet Explorer.lnk - H:\Arquivos de programas\Internet Explorer\iexplore.exe
H:\Documents and Settings\POSITIVO\Menu Iniciar\Programas\Acessórios\Prompt de comando.lnk - H:\WINDOWS\system32\cmd.exe
H:\Documents and Settings\POSITIVO\Menu Iniciar\Programas\Acessórios\Ferramentas do Sistema\Internet Explorer (Sem Complementos).lnk - H:\Arquivos de programas\Internet Explorer\iexplore.exe

==== shortcuts in All Users Start Menu ======================

H:\Documents and Settings\All Users\Menu Iniciar\Programas\Avast\avast Free Antivirus.lnk -
H:\Documents and Settings\All Users\Menu Iniciar\Programas\CCleaner\CCleaner.lnk - H:\Arquivos de programas\CCleaner\CCleaner.exe
H:\Documents and Settings\All Users\Menu Iniciar\Programas\CCleaner\Uninstall CCleaner.lnk - H:\Arquivos de programas\CCleaner\uninst.exe
H:\Documents and Settings\All Users\Menu Iniciar\Programas\Google Chrome\Google Chrome.lnk - H:\Arquivos de programas\Google\Chrome\Application\chrome.exe
H:\Documents and Settings\All Users\Menu Iniciar\Programas\Java\About Java.lnk - H:\Arquivos de programas\Java\jre7\bin\javacpl.exe -tab about
H:\Documents and Settings\All Users\Menu Iniciar\Programas\Java\Check For Updates.lnk - H:\Arquivos de programas\Java\jre7\bin\javacpl.exe -tab update
H:\Documents and Settings\All Users\Menu Iniciar\Programas\Java\Configure Java.lnk - H:\Arquivos de programas\Java\jre7\bin\javacpl.exe
H:\Documents and Settings\All Users\Menu Iniciar\Programas\Java\Get Help.lnk -
H:\Documents and Settings\All Users\Menu Iniciar\Programas\Java\Visit Java.com.lnk -
H:\Documents and Settings\All Users\Menu Iniciar\Programas\SlimDrivers\SlimDrivers Help.lnk - H:\WINDOWS\Installer\{A5457401-D56A-43F2-9524-78E54A7FC07A}\Icon.exe -help
H:\Documents and Settings\All Users\Menu Iniciar\Programas\SlimDrivers\SlimDrivers.lnk - H:\WINDOWS\Installer\{A5457401-D56A-43F2-9524-78E54A7FC07A}\Icon.exe
H:\Documents and Settings\All Users\Menu Iniciar\Programas\ZHP\ZHPDiag.lnk - H:\Arquivos de programas\ZHPDiag\ZHPhep.exe
H:\Documents and Settings\All Users\Menu Iniciar\Programas\ZHP\ZHPFix.lnk - H:\Arquivos de programas\ZHPDiag\ZHPFix\ZHPhep.exe

==== shortcuts in Quick Launch ======================

H:\Documents and Settings\POSITIVO\Dados de aplicativos\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - H:\Arquivos de programas\Google\Chrome\Application\chrome.exe
H:\Documents and Settings\POSITIVO\Dados de aplicativos\Microsoft\Internet Explorer\Quick Launch\Iniciar o navegador Internet Explorer.lnk - H:\Arquivos de programas\Internet Explorer\iexplore.exe
H:\Documents and Settings\POSITIVO\Dados de aplicativos\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk - H:\Arquivos de programas\Windows Media Player\wmplayer.exe /prefetch:1

==== Reset IE Proxy ======================

Value(s) before fix:
"ProxyEnable"=dword:00000000

Value(s) after fix:
"ProxyEnable"=dword:00000000

==== Empty IE Cache ======================

H:\Documents and Settings\Default User\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
H:\Documents and Settings\LocalService\Configurações locais\Temp\Temporary Internet Files\Content.IE5 emptied successfully
H:\Documents and Settings\NetworkService\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
H:\WINDOWS\system32\config\systemprofile\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
H:\WINDOWS\system32\config\systemprofile\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
H:\Documents and Settings\LocalService\Configurações locais\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
H:\Documents and Settings\POSITIVO\Configurações locais\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

H:\Documents and Settings\POSITIVO\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== H:\zoek_backup content ======================

H:\zoek_backup (files=69 folders=1 100686533 bytes)

==== Empty Temp Folders ======================

H:\Documents and Settings\Default User\Configurações locais\Temp emptied successfully
H:\Documents and Settings\LocalService\Configurações locais\Temp emptied successfully
H:\Documents and Settings\NetworkService\Configurações locais\Temp emptied successfully
H:\Documents and Settings\POSITIVO\Configurações locais\Temp will be emptied at reboot
H:\WINDOWS\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

H:\WINDOWS\Temp successfully emptied
H:\DOCUME~1\POSITIVO\CONFIG~1\Temp successfully emptied

==== Empty Recycle Bin ======================

H:\RECYCLER successfully emptied

==== Deleting Files / Folders ======================

"H:\Documents and Settings\LocalService\Configurações locais\Temporary Internet Files\Content.IE5\index.dat" not found
"H:\Documents and Settings\POSITIVO\Configurações locais\Temporary Internet Files\Content.IE5\index.dat" not found

==== EOF on seg 03/03/2014 at 17:45:43,18 ======================

*Clique com o botão direito do mouse no Zoek.exe e selecione [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

* Copie todo este texto destacado em vermelho que te passei e cole-o no espaço em branco do Zoek.

*Clique [Run Script]

*Durante o scan uma mensagem parecida com esta abaixo mostrando o progresso do escaneamento será apresentada. Aguarde o término...pode demorar!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

*Caso a reinicialização do PC seja solicitada, clique [OK]

* Poste o log do Zoek que estará em C:\zoek-results.txt em sua próxima resposta.

Zoek.exe v5.0.0.0 Updated 02-March-2014
Tool run by POSITIVO on seg 03/03/2014 at 18:22:09,59.
Microsoft Windows XP Professional 5.1.2600 Service Pack 3 x86
Running in: Normal Mode Internet Access Detected
Launched: H:\Documents and Settings\POSITIVO\Meus documentos\Downloads\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

H:\zoek-results2014-03-03-204543.log 17757 bytes

==== System Restore Info ======================

3/3/2014 18:23:25 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bhbase deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Bhbase deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BprotectEx deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\BprotectEx deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PCFApiUtil deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\PCFApiUtil deleted successfully

==== Deleting Files \ Folders ======================

H:\Documents and Settings\POSITIVO\Configurações locais\Temp\baidu_secure not found

==== Folders Found ======================

2014-03-02 19:19:03 2014-03-02 19:19:03 -------- d-----w- H:\AdwCleaner\Quarantine\H\Documents and Settings\All Users\Dados de aplicativos\baidu
2014-03-03 19:50:35 2014-03-03 19:51:00 -------- d-----w- H:\Documents and Settings\POSITIVO\Dados de aplicativos\ZHP\Quarantine\Baidu Security.DIR
2014-03-03 19:51:00 2014-03-03 19:51:00 -------- d-----w- H:\Documents and Settings\POSITIVO\Dados de aplicativos\ZHP\Quarantine\Baidu Security.DIR\Baidu Security
2014-03-03 19:51:00 2014-03-03 19:51:00 -------- d-----w- H:\Documents and Settings\POSITIVO\Dados de aplicativos\ZHP\Quarantine\Baidu Security.DIR\Baidu Security\PC Faster\4.0.0.0\Uninstall\Baidu PC Faster Uninstall
2014-03-03 19:51:00 2014-03-03 19:51:00 -------- d-----w- H:\Documents and Settings\POSITIVO\Dados de aplicativos\ZHP\Quarantine\Baidu Security.DIR\Baidu Security\PC Faster\4.0.0.0\Uninstall\Baidu PC Faster Uninstall HK

==== Files Found ======================


--- H:\Documents and Settings\POSITIVO\Dados de aplicativos\ZHP\Quarantine\Baidu Security.DIR\RpData\rpFile-Baidu_Secure_SystemUp_4.0.1.56634-2014-03-03 03-00-54-0718-[32720].dat ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 723
Created time: 2014-03-03 19:50:35
Modified time: 2014-03-03 05:02:06
MD5: C4273D9DFDD8BE91C345B7EDBCD93DAF
SHA1: BDAD0C4D2255D225D19406C121EB5F920FC640BC


==== Registry Search Results for "Baidu" ======================


[HKEY_USERS\.DEFAULT\Software\Baidu Security]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster]

[HKEY_USERS\.DEFAULT\Software\Baidu Security\PC Faster\DataReport]

[HKEY_USERS\S-1-5-21-448539723-413027322-1177238915-1003\Software\Avast Software\WRC\SearchRules\baidu.com]

[HKEY_USERS\S-1-5-18\Software\Baidu Security]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster]

[HKEY_USERS\S-1-5-18\Software\Baidu Security\PC Faster\DataReport]

==== H:\zoek_backup content ======================

H:\zoek_backup (files=69 folders=1 100686533 bytes)

==== EOF on seg 03/03/2014 at 18:25:35,87 ======================

*Clique com o botão direito do mouse no Zoek.exe e selecione [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

* Copie todo este texto destacado em vermelho que te passei e cole-o no espaço em branco do Zoek

*Clique [Run Script]

*Durante o scan uma mensagem parecida com esta abaixo mostrando o progresso do escaneamento será apresentada. Aguarde o término...pode demorar!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

*Caso a reinicialização do PC seja solicitada, clique [OK]

* Poste o log do Zoek que estará em C:\zoek-results.txt em sua próxima resposta.

Zoek.exe v5.0.0.0 Updated 02-March-2014
Tool run by POSITIVO on seg 03/03/2014 at 18:37:41,32.
Microsoft Windows XP Professional 5.1.2600 Service Pack 3 x86
Running in: Normal Mode Internet Access Detected
Launched: H:\Documents and Settings\POSITIVO\Desktop\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

H:\zoek-results2014-03-03-204543.log 17757 bytes
H:\zoek-results2014-03-03-212535.log 7150 bytes

==== System Restore Info ======================

3/3/2014 18:38:48 Zoek.exe System Restore Point Created Succesfully.

==== Folders Found ======================

2014-03-02 19:19:03 2014-03-02 19:19:03 -------- d-----w- H:\AdwCleaner\Quarantine\H\Documents and Settings\All Users\Dados de aplicativos\baidu
2014-03-03 19:50:35 2014-03-03 19:51:00 -------- d-----w- H:\Documents and Settings\POSITIVO\Dados de aplicativos\ZHP\Quarantine\Baidu Security.DIR
2014-03-03 19:51:00 2014-03-03 19:51:00 -------- d-----w- H:\Documents and Settings\POSITIVO\Dados de aplicativos\ZHP\Quarantine\Baidu Security.DIR\Baidu Security
2014-03-03 19:51:00 2014-03-03 19:51:00 -------- d-----w- H:\Documents and Settings\POSITIVO\Dados de aplicativos\ZHP\Quarantine\Baidu Security.DIR\Baidu Security\PC Faster\4.0.0.0\Uninstall\Baidu PC Faster Uninstall
2014-03-03 19:51:00 2014-03-03 19:51:00 -------- d-----w- H:\Documents and Settings\POSITIVO\Dados de aplicativos\ZHP\Quarantine\Baidu Security.DIR\Baidu Security\PC Faster\4.0.0.0\Uninstall\Baidu PC Faster Uninstall HK

==== Files Found ======================


--- H:\Documents and Settings\POSITIVO\Dados de aplicativos\ZHP\Quarantine\Baidu Security.DIR\RpData\rpFile-Baidu_Secure_SystemUp_4.0.1.56634-2014-03-03 03-00-54-0718-[32720].dat ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 723
Created time: 2014-03-03 19:50:35
Modified time: 2014-03-03 05:02:06
MD5: C4273D9DFDD8BE91C345B7EDBCD93DAF
SHA1: BDAD0C4D2255D225D19406C121EB5F920FC640BC


==== Registry Search Results for "Baidu" ======================

No instances of string "Baidu" found.

==== H:\zoek_backup content ======================

H:\zoek_backup (files=69 folders=1 100686533 bytes)

==== EOF on seg 03/03/2014 at 18:41:03,20 ======================

Como está o PC após estas limpezas?

O Combofix ainda acusa o Baidu como um antivírus instalado   

 Faça uma limpeza com o Ccleaner seguindo as dicas deste tutorial:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

E aí veja se o Baidu para de aparecer e nos diga o resultado aqui.

A praga continua...   

Faça o download do RegSeeker:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Depois de baixar, clique com o botão direito do mouse sobre ele e escolha a opção de extraí-lo > Abra a pasta dele e clique com o botão direito do mouse no arquivo RegSeeker.exe e escolha a opção de Executar como administrador.

Clique na opção Find in Registry > Em search for digite Baidu e clique em Search.

Quando ele concluir a pesquisa, selecione as entradas que ele encontrou, clique em Action e escolha a opção Delete selected itens.

Depois disto nos diga o resultado.

Continua...  

Mas alguns itens do baidu foram removidos pelo RegSeeker? Ou nada foi encontrado?

Sim, mas o combofix ainda detecta os vestígios dele... Não sei mais o que fazer  

Abra o RegSeeker > Clique em Find in Registry > Em search for escreva Baidu > marque a caixinha Search files > clique em Search! > tal como é mostrado nesta imagem:

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

assim que ele encontrar alguns arquivos pertencentes ao Baidu, selecione-os e exclua-os.

Depois disto nos diga se mais alguns itens foram removidos e se resolveu.

Nenhum item foi detectado    Desculpe por te encher tanto   

Nenhum item foi detectado    Desculpe por te encher tanto   

 Baixe o [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] e salve-o no Desktop (Área de Trabalho)

Obs: Ao acessar o link acima, clique no botão Download Now 32-Bit Version

*Execute o FRST e aceite o contrato


*Clique [Scan]


*Ao término clique [OK] > [OK]



*Serão criados dois relatórios no Desktop: FRST.txt e Addition.txt

Poste estes dois relatórios em sua próxima resposta. (Obs: se não couber em uma só resposta, pode dividi-la em mais postagens).

Quando você terminar o procedimento acima e postar os relatórios pedidos, faça também este:

Faça o download do SystemLook.exe e salve no seu desktop:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

*** Usuários do Windows Vista ou Windows 7 Clique com o direito sobre o arquivo SystemLook.exe, depois clique em Executar como admnistrador

Clique duas vezes no SystemLook.exe. Selecione e copie o texto que está destacado em vermelho abaixo e cole dentro do SystemLook:

:filefind
baidu

:folderfind
baidu

:regfind
baidu

Clique no botão Look e ao fim do exame um log se abrirá. Ele é salvo como SystemLook.txt no desktop.

Selecione, copie e cole o conteúdo deste log na sua próxima resposta.

TÓPICO ARQUIVADO

Como o autor não respondeu por mais de 15 dias, o tópico foi arquivado. Caso o autor do tópico necessite, o mesmo será reaberto, para isso deverá entrar em contato com um dos membros da [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] solicitando o desbloqueio.