Problemas para remover YoUiTuAdBelOccKer

pessoal, não consigo remover essa maldita extensão YoUiTuAdBelOccKer
no Chrome ela aparece como uma extensão gerenciada que não pode ser removida.
Já instalei o AdwCleaner e fiz a "varredura" do sistema, mas não adiantou,

segue abaixo o log, obrigada pela ajuda:


# AdwCleaner v3.020 - Relatório criado 09/03/2014 às 23:38:15
# Atualizado 27/02/2014 por Xplode
# Sistema Operacional : Windows 7 Home Premium Service Pack 1 (64 bits)
# Usuário : Usuario - USUARIO-PC
# Executando de : D:\Usuario\Desktop\AdwCleaner.exe
# Opção : Limpar

***** [ Serviços ] *****


***** [ Arquivos / Pastas ] *****

Pasta Deletada : C:\ProgramData\Ask
Pasta Deletada : C:\ProgramData\boost_interprocess
Pasta Deletada : C:\ProgramData\House Of Soft
Pasta Deletada : C:\ProgramData\QuickSet
Pasta Deletada : C:\ProgramData\FunDeals
Pasta Deletada : C:\ProgramData\JoniCouuppono
Pasta Deletada : C:\Program Files (x86)\Desk 365
Pasta Deletada : C:\Program Files (x86)\WebexpEnhancedV1
Pasta Deletada : C:\Program Files (x86)\FunDeals
Pasta Deletada : C:\Program Files (x86)\JoniCouuppono
Pasta Deletada : C:\Users\Usuario\AppData\Local\torch
Pasta Deletada : C:\Users\Usuario\AppData\Roaming\Desk 365
Arquivo Deletada : C:\Users\Usuario\AppData\Roaming\Mozilla\Firefox\Profiles\5s2sl5df.default\user.js
Arquivo Deletada : C:\Windows\System32\Tasks\RunAsStdUser

***** [ Atalhos ] *****

Atalho Desinfectada : C:\Users\Usuario\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\22find.lnk

***** [ Registro ] *****

Valor Deletedo : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [12x3q@3244516.com]
Valor Deletedo : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [ext@bettersurfplus.com]
Valor Deletedo : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [xz123@ya456.com]
Chave Deletedo : HKLM\SOFTWARE\Google\Chrome\Extensions\dedmngkbaffkenlfdcbganndoghblmap
Chave Deletedo : HKLM\SOFTWARE\Google\Chrome\Extensions\ijblflkdjdopkpdgllkmlbgcffjbnfda
Chave Deletedo : HKLM\SOFTWARE\Google\Chrome\Extensions\poheodfamflhhhdcmjfeggbgigeefaco
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\desk365_RASAPI32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\desk365_RASMANCS
Chave Deletedo : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Chave Deletedo : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Chave Deletedo : HKCU\Software\InstallCore
Chave Deletedo : HKCU\Software\Softonic
Chave Deletedo : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Chave Deletedo : HKCU\Software\AppDataLow\SProtector
Chave Deletedo : HKCU\Software\AppDataLow\Software\lyrixeeker
Chave Deletedo : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Chave Deletedo : HKLM\Software\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Chave Deletedo : HKLM\Software\BetterSurf
Chave Deletedo : HKLM\Software\caphyon
Chave Deletedo : HKLM\Software\Desksvc
Chave Deletedo : HKLM\Software\hdcode
Chave Deletedo : HKLM\Software\SP Global
Chave Deletedo : HKLM\Software\SProtector
Chave Deletedo : HKLM\Software\V9
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CA41BB14-E67B-1653-C57B-5CA99418A866}

***** [ Navegadores ] *****

-\\ Internet Explorer v11.0.9600.16428

Configurações Restauradas : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Configurações Restauradas : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
Configurações Restauradas : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs]

-\\ Mozilla Firefox v27.0.1 (pt-BR)

[ Arquivo : C:\Users\Usuario\AppData\Roaming\Mozilla\Firefox\Profiles\5s2sl5df.default\prefs.js ]

Linha deletada : user_pref("aol_toolbar.default.homepage.check", false);
Linha deletada : user_pref("aol_toolbar.default.search.check", false);
Linha deletada : user_pref("extensions.BabylonToolbar.prtkDS", 0);
Linha deletada : user_pref("extensions.BabylonToolbar.prtkHmpg", 0);
Linha deletada : user_pref("extensions.DD2g.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};if(window.self.location.protocol.indexOf('hxxp')>-1 && window.self==window.top && ![...]
Linha deletada : user_pref("extensions.Gjb5zE.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};var _wlst={lsKey:\"ssjsmn2ja8ddw2a\",get:function(b,a){if(3<b)return a(!1);var d=[...]
Linha deletada : user_pref("extensions.UB6kdjsfrd.scode", "(function(){if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};var _wlst={lsKey:\"ssjsmn2ja8ddw2a\",get:function(b,a){if(3<b)return a(!1);va[...]
Linha deletada : user_pref("extensions.ewB.scode", "(function(){try{var url=window.self.location.href;if(url.indexOf(\"acebook\")>-1||url.indexOf(\"txtlnkusaolp00000800\")>-1||url.match(/ressbar.com[^f]+fid=65017/)||u[...]
Linha deletada : user_pref("extensions.hklIuTNi.scode", "(function(){try{var url=window.self.location.href;if(url.indexOf(\"acebook\")>-1||url.indexOf(\"txtlnkusaolp00000800\")>-1||url.indexOf(\"sumorobo\")>-1||url.in[...]
Linha deletada : user_pref("extensions.nSaAY8Lqj27.scode", "(function(){try{if(window.self.location.hostname.indexOf(\"acebook.co\")>-1){return};}catch(e){};if(window.self.location.protocol.indexOf('hxxp')>-1 && windo[...]
Linha deletada : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Linha deletada : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Linha deletada : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Linha deletada : user_pref("sweetim.toolbar.previous.keyword.URL", "");
Linha deletada : user_pref("sweetim.toolbar.scripts.1.domain-blacklist", "");
Linha deletada : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "");
Linha deletada : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "");
Linha deletada : user_pref("sweetim.toolbar.searchguard.enable", "");

-\\ Google Chrome v

[ Arquivo : C:\Users\Usuario\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [7911 octets] - [09/03/2014 23:35:56]
AdwCleaner[S0].txt - [7036 octets] - [09/03/2014 23:38:15]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7096 octets] ##########

  Oi Juliana. Seja bem vinda ao Fórum PC Brasil.

 Desative temporariamente seu antivírus para evitar conflitos.

Acesse este link abaixo e clique no primeiro botão da esquerda que é o botão Download Zoek.exe:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

*Clique com o botão direito do mouse no Zoek.exe e selecione [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

* Copie todo este texto destacado em vermelho que te passei e cole-o no espaço em branco do Zoek

*Clique [Run Script]

*Durante o scan uma mensagem parecida com esta abaixo mostrando o progresso do escaneamento será apresentada. Aguarde o término...pode demorar!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

*Caso a reinicialização do PC seja solicitada, clique [OK]

* Poste o log do Zoek que estará em C:\zoek-results.txt em sua próxima resposta.

Obg pela ajuda Power Max,

vou colar o log abaixo, mas depois que fiz a verificação sumiu a extensão

de qlqr forma, segue o log, só por precaução:

Zoek.exe v5.0.0.0 Updated 07-March-2014
Tool run by Usuario on 10/03/2014 at 0:43:07,47.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: D:\Usuario\Desktop\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

10/03/2014 00:44:45 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Usuario\AppData\Roaming\Mozilla\Firefox\Profiles\5s2sl5df.default\prefs.js:
user_pref("browser.search.defaulturl", "");
user_pref("browser.search.defaultenginename", "");
user_pref("browser.search.defaultenginename,S", "");
user_pref("browser.search.selectedEngine", "");
user_pref("browser.search.selectedEngine,S", "");
user_pref("browser.search.order.1", "");
user_pref("browser.search.order.1,S", "");
user_pref("keyword.URL", "");

Added to C:\Users\Usuario\AppData\Roaming\Mozilla\Firefox\Profiles\5s2sl5df.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

ProfilePath: C:\Users\Usuario\AppData\Roaming\Mozilla\Firefox\Profiles\5s2sl5df.default

user.js not found
---- Lines browser.startup.page removed from prefs.js ----
user_pref("browser.startup.page", 3);
---- Lines extensions.DD2g removed from prefs.js ----
user_pref("extensions.DD2g.epoch", "1387247335");
user_pref("extensions.DD2g.url", "http://getsync.info/sync2/?q=hfZ9ofqMA6aMCyVUojw8qdwMg708BNmGWj8ckShGheDUojwHrjsFqjaFrTnGrShIC7n0rjrFrTw7rdsGpdkGtNh
---- Lines extensions.Gjb5zE removed from prefs.js ----
user_pref("extensions.Gjb5zE.epoch", "1389054027");
user_pref("extensions.Gjb5zE.url", "http://toolkitfun.in/sync2/?q=hfZ9ofx6pftQtNbPhd9EtMqLDe49CNU0nVsMCMlNhd9FrHwGrHwErdr6qjsMBzqUojw9rdwEqTaErTaEpih7
---- Lines extensions.UB6kdjsfrd removed from prefs.js ----
user_pref("extensions.UB6kdjsfrd.epoch", "1389054027");
user_pref("extensions.UB6kdjsfrd.url", "http://solutionprojob.info/sync2/?q=hfZ9oeP8WeOMCyVUojaMg708BNmGWj8ckShGheDUojwHrjsHrjaErHCHqihIC7n0rjnErja7rd
---- Lines extensions.ewB removed from prefs.js ----
user_pref("extensions.ewB.epoch", "1391820601");
user_pref("extensions.ewB.url", "http://veteranusashare.ru/sync2/?q=hfZ9oemZC7wMCyVUojaMg708BNmGWj8ckShGheDUojw9rdwHrjaErjrFqihIC7n0rjnErTa6rda8rdw9tN
---- Lines extensions.hklIuTNi removed from prefs.js ----
user_pref("extensions.hklIuTNi.epoch", "1394402063");
user_pref("extensions.hklIuTNi.url", "http://veteranusashare.ru/sync2/?q=hfZ9oehSBfwMCyVUojaMg708BNmGWj8ckShGheDUojw9rdrEqTsFrjrGqchIC7n0rjnErHa5rTw8q
---- Lines extensions.nSaAY8Lqj27 removed from prefs.js ----
user_pref("extensions.nSaAY8Lqj27.epoch", "1390262738");
user_pref("extensions.nSaAY8Lqj27.url", "http://getsync.info/sync2/?q=hfZ9oeDGDzrMCyVUojw8qdwMg708BNmGWj8ckShGheDUojw9rdwFqHa9rHr8qchIC7n0rjnErjsErdaE
---- FireFox user.js and prefs.js backups ----

prefs_032014_0103_.backup

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\RockMelt\shell\open\command]
@="C:\\Users\\Usuario\\AppData\\Local\\RockMelt\\Application\\rockmelt.exe"

==== Deleting Files \ Folders ======================

C:\PROGRA~3\kfdjmekdbnbanmndlgclligbhmdaiabp deleted
C:\Users\Usuario\AppData\LocalLow\{D5C59D66-1A80-15CA-D206-C00FEC530600} deleted
C:\Windows\sysWoW64\config\systemprofile\AppData\LocalLow\{FBCDF0F0-31CA-7447-C97F-75A4C61E8EA3} deleted
C:\Users\Usuario\AppData\Local\Packages\windows_ie_ac_001\AC\{65BF156A-B161-7F0C-6F2E-7E7B2450F1E3} deleted
C:\Users\Usuario\AppData\Local\Packages\windows_ie_ac_001\AC\{D5C59D66-1A80-15CA-D206-C00FEC530600} deleted
C:\Users\Usuario\AppData\Local\Packages\windows_ie_ac_001\AC\{F1BA3293-A357-8138-19EC-ED8D7CAC9A30} deleted
C:\Windows\SysNative\config\systemprofile\AppData\Local\Packages\windows_ie_ac_001\AC\{FBCDF0F0-31CA-7447-C97F-75A4C61E8EA3} deleted
C:\PROGRA~3\5254ced9d63ee219 deleted
C:\PROGRA~3\DIScounetExteensaii deleted
C:\PROGRA~2\DIScounetExteensaii deleted
C:\PROGRA~3\YoUiTuAdBelOccKer deleted
C:\PROGRA~2\YoUiTuAdBelOccKer deleted
C:\PROGRA~2\GS Supporter deleted
C:\PROGRA~2\SK Supporter deleted
C:\Users\Usuario\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\22find.lnk deleted
C:\PROGRA~3\InstallMate deleted
C:\Windows\tasks\GS.Enabler-S-1824435291.job deleted
C:\Windows\tasks\SK.Enabler-S-1495795506.job deleted
C:\windows\SysNative\tasks\GS.Enabler-S-1824435291 deleted
C:\windows\SysNative\tasks\SK.Enabler-S-1495795506 deleted
C:\Users\Usuario\AppData\Roaming\unins000.exe deleted
D:\Usuario\Downloads\Legendas232.exe deleted
D:\Usuario\Downloads\Legendas231.exe deleted
"C:\PROGRA~3\mpgbddikfgelenjnojoicakhpcbmpmpm\mpgbddikfgelenjnojoicakhpcbmpmpm.crx" deleted
"C:\PROGRA~3\mpgbddikfgelenjnojoicakhpcbmpmpm\update.xml" deleted
"C:\PROGRA~3\mpgbddikfgelenjnojoicakhpcbmpmpm" deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"otis@digitalpersona.com"="C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt" [19/09/2012 15:37]
[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]
"{87F8774F-B485-47E2-A755-A40A8A5E886C}"="C:\Users\Usuario\AppData\Local\GAS Tecnologia\GBBD\bb\xpi" [07/01/2014 22:52]

==== Firefox Extensions ======================

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Usuario\AppData\Roaming\Mozilla\Firefox\Profiles\5s2sl5df.default
D775FA6F1E88B3B99E69E8A0D6C3A819 - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll - Shockwave Flash
630B1C896D9DC03447A6951102EBEBFD - C:\Users\Usuario\AppData\Local\GAS Tecnologia\GBBD\npsf_bb.dll - Módulo de Proteção - Banco do Brasil
C36444D7301A8C881FC7296B092609C7 - C:\Users\Usuario\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll - Google Update
FF0D6F82A0EC13952E83B9439100E45D - C:\Users\Usuario\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll - Facebook Video Calling Plugin
341B3AE026B143DBC17BA1E1E0BAE3D6 - C:\Users\Usuario\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll - Unity Player
A74B2B17FCE088C437312F9E1F6E0324 - C:\Users\Usuario\AppData\Local\RockMelt\Update\1.2.189.1\npRockMeltOneClick8.dll - RockMelt Update
58B690C992C321664AB6145A350B5DCD - C:\Users\Usuario\AppData\Local\GAS Tecnologia\GBBD\npsf_bb_64.dll - Módulo de Proteção - Banco do Brasil


==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
epojlgbehpaeekopencdagbdamnkppci - C:\Program Files (x86)\LyriXeeker\130.crx[]
mmifolfpllfdhilecpdpmemhelmanajl - C:\Program Files (x86)\BetterSurf\BetterSurfPlus\ch\BetterSurfPlus.crx[]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
pgacfjdigcddmmncljpflgcfpfahebkh - C:\Users\Usuario\AppData\Local\GAS Tecnologia\GBBD\bb\sf.crx[07/01/2014 22:52]

GReeattsavaer - Administrador\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lomhmjnpdakmogbdkhmkimiidbmhblfl
GReeattsavaer - Administrador\AppData\Local\Torch\User Data\Default\Extensions\lomhmjnpdakmogbdkhmkimiidbmhblfl
GReeattsavaer - Convidado\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lomhmjnpdakmogbdkhmkimiidbmhblfl
GReeattsavaer - Convidado\AppData\Local\Google\Chrome\User Data\Default\Extensions\lomhmjnpdakmogbdkhmkimiidbmhblfl
GReeattsavaer - Convidado\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lomhmjnpdakmogbdkhmkimiidbmhblfl
GReeattsavaer - Convidado\AppData\Local\Torch\User Data\Default\Extensions\lomhmjnpdakmogbdkhmkimiidbmhblfl
GReeattsavaer - Usuario\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lomhmjnpdakmogbdkhmkimiidbmhblfl
Google Wallet - Usuario\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Why Login? - Usuario\AppData\Local\RockMelt\User Data\Default\Extensions\kifbifhcmjgogbdlmblmjemdlincicmb
Google Docs - C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake
Google Drive - C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf
YouTube - C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Google Search - C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
22find - C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\ijblflkdjdopkpdgllkmlbgcffjbnfda
YoUiTuAdBelOccKer - C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpgbddikfgelenjnojoicakhpcbmpmpm
Google Wallet - C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Gmail - C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== Chrome Fix ======================

C:\Users\Usuario\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_b.scorecardresearch.com_0.localstorage deleted successfully
C:\Users\Usuario\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_b.scorecardresearch.com_0.localstorage-journal deleted successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpgbddikfgelenjnojoicakhpcbmpmpm deleted successfully
C:\Users\Usuario\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_mpgbddikfgelenjnojoicakhpcbmpmpm_0.localstorage deleted successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_mpgbddikfgelenjnojoicakhpcbmpmpm_0.localstorage deleted successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_mpgbddikfgelenjnojoicakhpcbmpmpm_0.localstorage-journal deleted successfully
C:\Users\Administrador\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lomhmjnpdakmogbdkhmkimiidbmhblfl deleted successfully
C:\Users\Administrador\AppData\Local\Torch\User Data\Default\Extensions\lomhmjnpdakmogbdkhmkimiidbmhblfl deleted successfully
C:\Users\Convidado\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lomhmjnpdakmogbdkhmkimiidbmhblfl deleted successfully
C:\Users\Convidado\AppData\Local\Google\Chrome\User Data\Default\Extensions\lomhmjnpdakmogbdkhmkimiidbmhblfl deleted successfully
C:\Users\Convidado\AppData\Local\Google\Chrome SxS\User Data\Default\Extensions\lomhmjnpdakmogbdkhmkimiidbmhblfl deleted successfully
C:\Users\Convidado\AppData\Local\Torch\User Data\Default\Extensions\lomhmjnpdakmogbdkhmkimiidbmhblfl deleted successfully
C:\Users\Usuario\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\lomhmjnpdakmogbdkhmkimiidbmhblfl deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
"Default_Page_URL"="http://www.google.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="http://www.google.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Start Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Reset Google Chrome ======================

C:\Users\Usuario\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Usuario\AppData\Local\RockMelt\User Data\Default\Preferences was reset successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Usuario\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully
C:\Users\Usuario\AppData\Local\RockMelt\User Data\Default\Web Data was reset successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-2265212610-969842259-3182842817-1000\Software\Mozilla\Firefox\Extensions\{f3672c93-914e-4491-a30a-1c2054bea2e4} deleted successfully

==== shortcuts on Users Desktops ======================

C:\Users\Public\Desktop\iTunes.lnk - C:\Program Files (x86)\iTunes\iTunes.exe
C:\Users\Public\Desktop\iTunes.lnk - C:\Program Files (x86)\iTunes\iTunes.exe
C:\Users\Public\Desktop\iTunes.lnk - C:\Program Files (x86)\iTunes\iTunes.exe
C:\Users\Public\Desktop\iTunes.lnk - C:\Program Files (x86)\iTunes\iTunes.exe
C:\Users\Public\Desktop\iTunes.lnk - C:\Program Files (x86)\iTunes\iTunes.exe
C:\Users\Public\Desktop\iTunes.lnk - C:\Program Files (x86)\iTunes\iTunes.exe
C:\Users\Public\Desktop\iTunes.lnk - C:\Program Files (x86)\iTunes\iTunes.exe
C:\Users\Public\Desktop\iTunes.lnk - C:\Program Files (x86)\iTunes\iTunes.exe
C:\Users\Public\Desktop\iTunes.lnk - C:\Program Files (x86)\iTunes\iTunes.exe
C:\Users\Public\Desktop\iTunes.lnk - C:\Program Files (x86)\iTunes\iTunes.exe

==== shortcuts on All Users Desktop ======================

C:\Users\Public\Desktop\iTunes.lnk - C:\Program Files (x86)\iTunes\iTunes.exe

==== shortcuts in All Users Start Menu ======================

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk - C:\Windows\Installer\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}\AppleSoftwareUpdateIco.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes\iTunes.lnk - C:\Program Files (x86)\iTunes\iTunes.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes\Sobre o iTunes.lnk - C:\Program Files (x86)\iTunes\iTunes.Resources\pt.lproj\About iTunes.rtf
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype\Skype.lnk - C:\Program Files (x86)\Skype\Phone\Skype.exe

==== shortcuts in Quick Launch ======================

C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Usuario\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PhotoScape.lnk - C:\Program Files (x86)\PhotoScape\PhotoScape.exe
C:\Users\Usuario\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Usuario\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Usuario\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk -
C:\Users\Usuario\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\9d91276b0be3e46b\pinned.lnk -
C:\Users\Usuario\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Users\Usuario\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Usuario\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\iTunes.lnk - C:\Program Files (x86)\iTunes\iTunes.exe
C:\Users\Usuario\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Snipping Tool.lnk -
C:\Users\Usuario\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\TweetDeck.lnk - C:\Users\Usuario\AppData\Roaming\Microsoft\Installer\{FA6381E9-96D2-4F6F-866C-4D16E5986FF6}\TweetDeck.exe
C:\Users\Usuario\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk - C:\Windows\explorer.exe
C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -

==== Reset IE Proxy ======================

Value(s) before fix:
"ProxyOverride"="*.local"
"ProxyEnable"=dword:00000000

Value(s) after fix:
"ProxyEnable"=dword:00000000

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\9125170b-560a-499b-a801-db09a63bf3fe deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CB6AFD45-C957-ECA2-DC41-AB5A5A440620} deleted successfully
HKEY_CURRENT_USER\Software\Policies\Google\Chrome\ExtensionInstallForcelist deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\epojlgbehpaeekopencdagbdamnkppci deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\mmifolfpllfdhilecpdpmemhelmanajl deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{5F189DF5-2D05-472B-9091-84D9848AE48B}{e9f32388} deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\S-1824435291 deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\S-1495795506 deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBAgent deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerDVD12Agent deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerDVD12DMREngine deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Usuario\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Usuario\AppData\Local\Mozilla\Firefox\Profiles\5s2sl5df.default\Cache emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Usuario\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
C:\Users\Usuario\AppData\Local\RockMelt\User Data\Default\Cache emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=95 folders=36 11071363 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Usuario\AppData\Local\Temp will be emptied at reboot
C:\Users\USURIO~1\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Usuario\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 10/03/2014 at 1:13:38,07 ======================

 Siga, por gentileza, as dicas deste tutorial para fazer uma limpeza de seu PC com o Malwarebytes:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Na sua próxima resposta poste este log do Malwarebytes.

Ficamos no aguardo.

segue o log!

Malwarebytes Anti-Malware 1.75.0.1300
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Versão da Base de Dados: v2014.03.10.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Usuario :: USUARIO-PC [administrador]

10/03/2014 17:59:12
mbam-log-2014-03-10 (17-59-12).txt

Tipo de Verificação: Verificação Completa (C:\|D:\|)
Opções de verificações ativadas: Memória | Inicialização | Registro | Sistema de arquivos | Heurística/Extra | Heurística/Shuriken | PUP | PUM
Opções de verificação desativadas: P2P
Objetos escaneados: 406556
Tempo decorrido: 1 hora(s), 37 minuto(s), 21 segundo(s)

Processos de Memória Detectados: 0
(Não foram detectados ítens maliciosos)

Módulos de Memória Detectados: 0
(Não foram detectados ítens maliciosos)

Chaves de Registro Detectadas: 1
HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252} (PUP.Optional.GreatSaver.A) -> Enviado para a Quarentena e deletado com sucesso.

Valores de Registro Detectadas: 0
(Não foram detectados ítens maliciosos)

Itens de Dados no Registro Detectadas: 0
(Não foram detectados ítens maliciosos)

Pastas Detectadas: 0
(Não foram detectados ítens maliciosos)

Arquivos Detectados: 11
C:\AdwCleaner\Quarantine\C\ProgramData\House Of Soft\GS.Enabler\GS.Enabler.exe.vir (PUP.Optional.MultiPlug.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\AdwCleaner\Quarantine\C\ProgramData\QuickSet\SK.Enabler\SK.Enabler.exe.vir (PUP.Optional.MultiPlug.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Usuario\AppData\Local\Google\Chrome\User Data\Default\File System\001\t\00\00000000 (PUP.Optional.InstalleRex) -> Enviado para a Quarentena e deletado com sucesso.
C:\Users\Usuario\AppData\Local\Google\Chrome\User Data\Default\File System\004\t\00\00000000 (PUP.Optional.OneClickDownloader.A) -> Enviado para a Quarentena e deletado com sucesso.
C:\zoek_backup\D_Usuario_Downloads_Legendas231.exe.vir (PUP.Optional.InstalleRex) -> Enviado para a Quarentena e deletado com sucesso.
C:\zoek_backup\D_Usuario_Downloads_Legendas232.exe.vir (PUP.Optional.Installrex) -> Enviado para a Quarentena e deletado com sucesso.
D:\Usuario\Downloads\any-video-converter-5.0.9.exe (PUP.Optional.OpenCandy) -> Enviado para a Quarentena e deletado com sucesso.
D:\Usuario\Downloads\Ccleaner.exe (PUP.Optional.Firseria) -> Enviado para a Quarentena e deletado com sucesso.
D:\Usuario\Downloads\installer_tweetdeck_English.exe (PUP.BundleInstaller.DES) -> Enviado para a Quarentena e deletado com sucesso.
D:\Usuario\Downloads\setupFacebookChatDesktop__3727_il7267926.exe (PUP.Optional.Amonetize.A) -> Enviado para a Quarentena e deletado com sucesso.
D:\Usuario\Downloads\skype-600126-baixaki-32-bits.exe (PUP.AdBundle) -> Enviado para a Quarentena e deletado com sucesso.

(fim)

  Está tudo certo.  Fico feliz que o problema tenha sido resolvido.

 Só para finalizar siga estes tutoriais abaixo, por gentileza:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
_______________________________________________________________________________________________________________________

 Para remover os programas usados na limpeza deste PC e criar um novo ponto de restauração seguro e sem problemas, utilize o DelFix seguindo as dicas [Tens de ter uma conta e sessão iniciada para poderes visualizar este link].
_______________________________________________________________________________________________________________________

  Foi um prazer ajudar. Conte sempre conosco!

eu que agradeço  :rindo_atoa: 

CASO RESOLVIDO

Caso o autor do tópico necessite, o mesmo será reaberto, para isso deverá entrar em contato com um dos membros da [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] solicitando o desbloqueio.