Máquina com erros devido virus

Zoek.exe v5.0.0.0 Updated 14-April-2014
Tool run by Daniel on 01/05/2014 at 10:10:10,72.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Daniel\Desktop\zoek.pif [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2014-04-30-135738.log 1223 bytes
C:\zoek-results2014-04-30-144313.log 19356 bytes

==== System Restore Info ======================

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\zp3i0ezp.default\prefs.js:
user_pref("browser.startup.homepage", "[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Added to C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\zp3i0ezp.default\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

==== Deleting Files \ Folders ======================

C:\PROGRA~2\{3C5CBD7B-3D1D-411E-96C2-513FFCA84D2D} deleted
C:\PROGRA~2\ProductData deleted

==== Folders Found ======================

2014-01-30 18:49:58 2014-04-30 21:10:56 -------- d-----w- C:\FRST\Quarantine\C\Program Files\RocketPDF
2014-01-30 18:50:01 2014-04-30 21:53:32 -------- d-----w- C:\FRST\Quarantine\C\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RocketPDF
2014-01-30 18:50:10 2014-01-30 18:50:48 -------- d-----w- C:\Users\Daniel\AppData\Roaming\RocketPDF

==== Files Found ======================


--- C:\FRST\Quarantine\C\Program Files\RocketPDF\RocketPDF.exe ---
Company: Krzysztof Kowalczyk
File Description: RocketPDF
File Version: 2.2.1.0.0
Product Name: RocketPDF
Copyright: Copyright 2006-2012 all authors (GPLv3)
Original Filename: RocketPDF.exe
File type: ----a-w-
File size: 4949504
Created time: 2013-03-11 14:18:56
Modified time: 2013-03-11 14:18:56
MD5: 8EAD845FABB2546025F0F410F81685CE
SHA1: F014E5A388FCAD3F31B833728A6448F5690392A4


--- C:\FRST\Quarantine\C\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RocketPDF\RocketPDF.lnk ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 1020
Created time: 2014-01-30 18:50:02
Modified time: 2014-01-30 18:50:02
MD5: B598405DF3EBC36896A2BC9ADB21F6DA
SHA1: 1AC17262E919D1E2FAC5EDB646F0E2A123444065


--- C:\Users\Daniel\Desktop\RocketPDF.lnk ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 984
Created time: 2014-01-30 18:50:02
Modified time: 2014-01-30 18:50:02
MD5: 88D4BC16CDAC5A21DF1D0C2DF80CDFC3
SHA1: B3886BE85D2F05F89C2A12213D84DE29E4D2A2FD


==== Registry Search Results for "RocketPDF" ======================


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ePUB]
@="RocketPDF_File"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.xps]
@="RocketPDF_File"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File]
@="RocketPDF_File"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\DefaultIcon]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\DefaultIcon]
@="C:\\Program Files\\RocketPDF\\RocketPDF.exe,0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\edit]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\edit]
@="Edit RocketPDF_File"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\edit\command]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\edit\command]
@="\"C:\\Program Files\\RocketPDF\\RocketPDF.exe\" \"%1\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\open]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\open\command]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\open\command]
@="\"C:\\Program Files\\RocketPDF\\RocketPDF.exe\" \"%1\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\RocketPDF.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\RocketPDF.exe]
@="C:\\Program Files\\RocketPDF\\RocketPDF.exe"

[HKEY_USERS\S-1-5-21-840133867-106172080-2313266223-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\a1e6ded4_0]
@="{0.0.0.00000000}.{a7c7d0bd-530f-4c0f-94a8-4b30815f44dd}|\\Device\\HarddiskVolume2\\Program Files\\RocketPDF\\RocketPDF.exe%b{00000000-0000-0000-0000-000000000000}"

[HKEY_USERS\S-1-5-21-840133867-106172080-2313266223-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList]
"b"="RocketPDF.exe"

[HKEY_USERS\S-1-5-21-840133867-106172080-2313266223-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithProgids]
"RocketPDF_File"=hex(0):

[HKEY_USERS\S-1-5-21-840133867-106172080-2313266223-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xps\OpenWithProgids]
"RocketPDF_File"=hex(0):

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"wrc@avast.com"="C:\Program Files\AVAST Software\Avast\WebRep\FF" [30/04/2014 17:53]

==== Firefox Extensions ======================

ProfilePath: C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\zp3i0ezp.default
- avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
- Advanced SystemCare Surfing Protection - %ProfilePath%\extensions\ascsurfingprotection@iobit.com

AppDir: C:\Program Files\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\zp3i0ezp.default
E83B541C71965CFA1DEFF846CD6E9ECD - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll - Google Update
E83B541C71965CFA1DEFF846CD6E9ECD - C:\Users\Daniel\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll - Google Update
AC987EE8037531807C5D7E6217A23501 - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll - Adobe Acrobat
EB41064BC07017F5694CF16B4DEF6B10 - C:\Program Files\Adobe\Reader 11.0\Reader\browser\nppdf32.dll - Adobe Acrobat
FF0D6F82A0EC13952E83B9439100E45D - C:\Users\Daniel\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll - Facebook Video Calling Plugin
5B92CB0A3EEE50F6B9AE036B4F9B0F0C - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll - Google Earth Plugin
BE501CBC29B2025A263D80D399F1797A - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll - Silverlight Plug-In
256C847CD03160C9088FB440DB929448 - C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll - RealJukebox NS Plugin
555E65306A5D3A5978BE74E1DD62CDD9 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll - RealNetworks(tm) Chrome Background Extension Plug-In (32-bit)
E32771B0AE3F18CEFFC12D682025238A - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll - RealPlayer(tm) HTML5VideoShim Plug-In (32-bit)
2DC6257A367A6182E40F748D0396AAF9 - C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll - RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)
1E3AA02F2C91A2B25EFB4E355160CDCA - C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll - RealPlayer Download Plugin
1C8124B6A03A620EB0CBCA615666D2AE - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll - Windows Live® Photo Gallery
B27CCB1168B1960AEC6E9D3E0E0F0D2A - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrlui.dll - Microsoft® Silverlight


==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
gomekmidlodglbbmalcneegieacbdmki - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[30/04/2014 17:52]
lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx[02/10/2012 11:14]

Advanced SystemCare Surfing Protection - Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbmegnmpleoagolcnjnejdacakedpcgd
Skype Click to Call - Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl
Advanced SystemCare Surfing Protection - Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.msn.com.br/"
"Start Page Before"="http://www.google.com"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.msn.com.br/"
"Start Page Before"="http://www.msn.com.br/"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Reset Google Chrome ======================

C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== shortcuts on Users Desktops ======================

C:\Users\Daniel\Desktop\Kalline - Atalho.lnk - C:\Users\Daniel\Documents\Kalline aulas 2013
C:\Users\Daniel\Desktop\Kalline aulas 2014 - Atalho.lnk - C:\Users\Daniel\Documents\Kalline aulas 2014
C:\Users\Daniel\Desktop\Microsoft Excel 2010.lnk - C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\xlicons.exe
C:\Users\Daniel\Desktop\Microsoft Office Picture Manager.lnk - C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\oisicon.exe
C:\Users\Daniel\Desktop\Microsoft PowerPoint 2010.lnk - C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pptico.exe
C:\Users\Daniel\Desktop\Microsoft Word 2010.lnk - C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\wordicon.exe
C:\Users\Daniel\Desktop\Photoshop - Atalho.lnk - C:\Program Files\Adobe\Adobe Photoshop CS5\Photoshop.exe
C:\Users\Daniel\Desktop\RocketPDF.lnk - C:\Program Files\RocketPDF\RocketPDF.exe
C:\Users\Daniel\Desktop\Serra da Capivara - Atalho.lnk - C:\Users\Daniel\Documents\Serra da Capivara
C:\Users\Daniel\Desktop\UsbFix.lnk - C:\UsbFix\UsbFix.exe
C:\Users\Daniel\Desktop\ZHPDiag.lnk - C:\Program Files\ZHPDiag\ZHPhep.exe
C:\Users\Daniel\Desktop\ZHPFix.lnk - C:\Program Files\ZHPDiag\ZHPFix\ZHPhep.exe

==== shortcuts on All Users Desktop ======================

C:\Users\Public\Desktop\Adobe Reader XI.lnk - C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe
C:\Users\Public\Desktop\Advanced SystemCare 7.lnk - C:\Program Files\IObit\Advanced SystemCare 7\ASCTray.exe /manual
C:\Users\Public\Desktop\aTube Catcher.lnk - C:\Program Files\DsNET Corp\aTube Catcher 2.0\yct.exe
C:\Users\Public\Desktop\AutoCAD 2010 - English.lnk - C:\Program Files\AutoCAD 2010\acad.exe
C:\Users\Public\Desktop\avast Free Antivirus.lnk -
C:\Users\Public\Desktop\CCleaner.lnk - C:\Program Files\CCleaner\CCleaner.exe
C:\Users\Public\Desktop\IObit Uninstaller.lnk - C:\Program Files\IObit\IObit Uninstaller\Uninstaler_SkipUac.exe
C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk - C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
C:\Users\Public\Desktop\RealPlayer.lnk - C:\Program Files\Real\RealPlayer\realplay.exe /launch:desktop
C:\Users\Public\Desktop\TIM Communicator.lnk - C:\Program Files\TIM Communicator\orolixcommunicator.exe
C:\Users\Public\Desktop\Video Search.lnk - C:\Program Files\DsNET Corp\aTube Catcher 2.0\yct.exe /VIDEOSEARCH
C:\Users\Public\Desktop\Zipper.lnk - C:\Windows\Installer\{40B325F7-2A46-41E0-BE2F-23C19F7F101E}\_A8733889CFE09697300527.exe

==== shortcuts in Users Start Menu ======================

C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk - C:\Users\Daniel\AppData\Local\Google\Chrome\Application\chrome.exe

==== shortcuts in All Users Start Menu ======================

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk - C:\Windows\Installer\{AC76BA86-7AD7-1046-7B44-AB0000000001}\SC_Reader.ico
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk - C:\Program Files\Mozilla Firefox\firefox.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare 7\Advanced SystemCare 7.lnk - C:\Program Files\IObit\Advanced SystemCare 7\ASCTray.exe /manual
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare 7\Desinstalar Advanced SystemCare.lnk - C:\Program Files\IObit\Advanced SystemCare 7\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare 7\Toolbox.lnk - C:\Program Files\IObit\Advanced SystemCare 7\ASCTray.exe /toolbox
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced SystemCare 7\Turbo Boost.lnk - C:\Program Files\IObit\Advanced SystemCare 7\ASCTray.exe /turboboost
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\aTube Catcher\aTube Catcher.lnk - C:\Program Files\DsNET Corp\aTube Catcher 2.0\yct.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast\avast Free Antivirus.lnk -
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner.lnk - C:\Program Files\CCleaner\CCleaner.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\Uninstall CCleaner.lnk - C:\Program Files\CCleaner\uninst.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive\Google Docs.lnk - C:\Program Files\Google\Drive\googledrivesync.exe --new_document
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive\Google Drive.lnk - C:\Program Files\Google\Drive\googledrivesync.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive\Google Sheets.lnk - C:\Program Files\Google\Drive\googledrivesync.exe --new_spreadsheet
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive\Google Slides.lnk - C:\Program Files\Google\Drive\googledrivesync.exe --new_presentation
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller\Help.lnk - C:\Program Files\IObit\IObit Uninstaller\help.html
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller\IObit Uninstaller.lnk - C:\Program Files\IObit\IObit Uninstaller\Uninstaler_SkipUac.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller\Uninstall IObit Uninstaller.lnk - C:\Program Files\IObit\IObit Uninstaller\UninstallDisplay.exe uninstall_start
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack\Codec Tweak Tool.lnk - C:\Program Files\K-Lite Codec Pack\Tools\CodecTweakTool.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack\Media Player Classic.lnk - C:\Program Files\K-Lite Codec Pack\Media Player Classic\mpc-hc.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack\Configuration\DirectVobSub.lnk - C:\Windows\System32\rundll32.exe "C:\Program Files\K-Lite Codec Pack\Filters\vsfilter.dll",DirectVobSub
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack\Configuration\ffdshow audio decoder.lnk - C:\Windows\System32\rundll32.exe "C:\Program Files\K-Lite Codec Pack\Filters\ffdshow\ffdshow.ax",configureAudio
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack\Configuration\ffdshow VFW interface.lnk - C:\Windows\System32\rundll32.exe "C:\Windows\system32\ff_vfw.dll",configureVFW
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack\Configuration\ffdshow video decoder.lnk - C:\Windows\System32\rundll32.exe "C:\Program Files\K-Lite Codec Pack\Filters\ffdshow\ffdshow.ax",configure
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack\Configuration\LAV Audio.lnk - C:\Windows\System32\rundll32.exe "C:\Program Files\K-Lite Codec Pack\Filters\LAV\lavaudio.ax",OpenConfiguration
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack\Configuration\LAV Splitter.lnk - C:\Windows\System32\rundll32.exe "C:\Program Files\K-Lite Codec Pack\Filters\LAV\lavsplitter.ax",OpenConfiguration
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack\Configuration\LAV Video.lnk - C:\Windows\System32\rundll32.exe "C:\Program Files\K-Lite Codec Pack\Filters\LAV\lavvideo.ax",OpenConfiguration
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack\Configuration\Reset to recommended settings.lnk - C:\Program Files\K-Lite Codec Pack\Tools\CodecTweakTool.exe /resetsettings
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack\Configuration\x264 VFW (x86).lnk - C:\Windows\System32\rundll32.exe "C:\Windows\system32\x264vfw.dll",Configure
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack\Configuration\Xvid VFW.lnk - C:\Windows\System32\rundll32.exe "C:\Windows\system32\xvidvfw.dll",Configure
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack\Help\Frequently Asked Questions.lnk - C:\Program Files\K-Lite Codec Pack\Info\faq.htm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack\Tools\GraphStudioNext.lnk - C:\Program Files\K-Lite Codec Pack\Tools\GraphStudioNext.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack\Tools\MediaInfo.lnk - C:\Program Files\K-Lite Codec Pack\Tools\mediainfo.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack\Tools\Win7DSFilterTweaker.lnk - C:\Program Files\K-Lite Codec Pack\Tools\CodecTweakTool.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack\Uninstall\Uninstall K-Lite Codec Pack.lnk - C:\Program Files\K-Lite Codec Pack\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Desinstalar Malwarebytes Anti-Malware.lnk - C:\Program Files\Malwarebytes Anti-Malware\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Malwarebytes Anti-Malware.lnk - C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk - C:\Program Files\Malwarebytes Anti-Malware\Chameleon\Windows\chameleon.chm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MCShield\MCShield Control Center.lnk - C:\Program Files\MCShield\MCShieldCC.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MCShield\MCShield Real-Time Monitor.lnk - C:\Program Files\MCShield\MCShieldRTM.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MCShield\Logs\All scans.lnk - C:\ProgramData\MCShield\AllScans.txt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MCShield\Logs\Last scan.lnk - C:\ProgramData\MCShield\LastScan.txt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MCShield\Logs\Summary.lnk - C:\ProgramData\MCShield\Summary.txt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MCShield\Tools\MCShield Translator.lnk - C:\Program Files\MCShield\Tools\Translator.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MCShield\Uninstall\Uninstall MCShield.lnk - C:\Program Files\MCShield\MCS-Uninstall.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP\ZHPDiag.lnk - C:\Program Files\ZHPDiag\ZHPhep.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP\ZHPFix.lnk - C:\Program Files\ZHPDiag\ZHPFix\ZHPhep.exe

==== shortcuts in Quick Launch ======================

C:\Users\Daniel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Daniel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Daniel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Daniel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\AutoCAD 2010 - English.lnk - C:\Program Files\AutoCAD 2010\acad.exe
C:\Users\Daniel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\On-Screen Keyboard.lnk - C:\Windows\system32\osk.exe
C:\Users\Daniel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\TIM Communicator.lnk - C:\Program Files\TIM Communicator\orolixcommunicator.exe
C:\Users\Daniel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Uninstall Programs.lnk - C:\Program Files\IObit\IObit Uninstaller\Uninstaler_SkipUac.exe
C:\Users\Daniel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Advanced SystemCare 7.lnk - C:\Program Files\IObit\Advanced SystemCare 7\ASCTray.exe /manual
C:\Users\Daniel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Users\Daniel\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Daniel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Daniel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk - C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Daniel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Skype .lnk - C:\Program Files\Skype\Phone\Skype.exe
C:\Users\Daniel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk - C:\Windows\explorer.exe
C:\Users\Daniel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk - C:\Program Files\Windows Media Player\wmplayer.exe /prefetch:1
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -

==== Reset IE Proxy ======================

Value(s) before fix:
"ProxyEnable"=dword:00000000

Value(s) after fix:
"ProxyEnable"=dword:00000000

==== Empty IE Cache ======================

C:\Users\Daniel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Daniel\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Daniel\AppData\Local\Mozilla\Firefox\Profiles\zp3i0ezp.default\Cache emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=193 folders=63 13136603 bytes)

==== Empty Temp Folders ======================

C:\Users\Daniel\AppData\Local\Temp will be emptied at reboot
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\USURIO~1\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Daniel\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 01/05/2014 at 10:42:51,29 ======================

Desative temporariamente seu antivírus para evitar conflitos.

*Clique com o botão direito do mouse no Zoek.exe e selecione [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

* Selecione e copie todo este texto destacado em vermelho que te passei e cole-o no espaço em branco do Zoek

*Clique [Run Script]

*Durante o scan uma mensagem parecida com esta abaixo mostrando o progresso do escaneamento será apresentada. Aguarde o término...pode demorar!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

*Caso a reinicialização do PC seja solicitada, clique [OK]

* Poste o log do Zoek que estará em C:\zoek-results.txt em sua próxima resposta.

Zoek.exe v5.0.0.0 Updated 14-April-2014
Tool run by Daniel on 01/05/2014 at 11:22:41,26.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Daniel\Desktop\zoek.pif [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2014-04-30-135738.log 1223 bytes
C:\zoek-results2014-04-30-144313.log 19356 bytes
C:\zoek-results2014-05-01-134251.log 26748 bytes
C:\zoek-results2014-05-01-140832.log 526 bytes

==== System Restore Info ======================

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ePUB]
@=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.xps]
@=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File]
@=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\DefaultIcon]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\DefaultIcon]
@=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\edit]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\edit]
@=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\edit\command]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\edit\command]
@=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\open]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\open\command]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\open\command]
@=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\RocketPDF.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\RocketPDF.exe]
@=-
[HKEY_USERS\S-1-5-21-840133867-106172080-2313266223-1000\Software\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\a1e6ded4_0]
@=-
[HKEY_USERS\S-1-5-21-840133867-106172080-2313266223-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList]
"b"=-
[HKEY_USERS\S-1-5-21-840133867-106172080-2313266223-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithProgids]
"RocketPDF_File"=-
[HKEY_USERS\S-1-5-21-840133867-106172080-2313266223-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xps\OpenWithProgids]
"RocketPDF_File"=-

==== Deleting Files \ Folders ======================

C:\Users\Daniel\AppData\Roaming\RocketPDF deleted
"C:\Users\Daniel\Desktop\RocketPDF.lnk" deleted

==== Folders Found ======================

2014-01-30 18:49:58 2014-04-30 21:10:56 -------- d-----w- C:\FRST\Quarantine\C\Program Files\RocketPDF
2014-01-30 18:50:01 2014-04-30 21:53:32 -------- d-----w- C:\FRST\Quarantine\C\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RocketPDF

==== Files Found ======================


--- C:\FRST\Quarantine\C\Program Files\RocketPDF\RocketPDF.exe ---
Company: Krzysztof Kowalczyk
File Description: RocketPDF
File Version: 2.2.1.0.0
Product Name: RocketPDF
Copyright: Copyright 2006-2012 all authors (GPLv3)
Original Filename: RocketPDF.exe
File type: ----a-w-
File size: 4949504
Created time: 2013-03-11 14:18:56
Modified time: 2013-03-11 14:18:56
MD5: 8EAD845FABB2546025F0F410F81685CE
SHA1: F014E5A388FCAD3F31B833728A6448F5690392A4


--- C:\FRST\Quarantine\C\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RocketPDF\RocketPDF.lnk ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 1020
Created time: 2014-01-30 18:50:02
Modified time: 2014-01-30 18:50:02
MD5: B598405DF3EBC36896A2BC9ADB21F6DA
SHA1: 1AC17262E919D1E2FAC5EDB646F0E2A123444065


==== Registry Search Results for "RocketPDF" ======================


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\DefaultIcon]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\edit]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\edit\command]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\open]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\open\command]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\RocketPDF.exe]

==== C:\zoek_backup content ======================

C:\zoek_backup (files=195 folders=64 13146491 bytes)

==== EOF on 01/05/2014 at 11:32:06,54 ======================

Desative temporariamente seu antivírus para evitar conflitos.

*Clique com o botão direito do mouse no Zoek.exe e selecione [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

* Selecione e copie todo este texto destacado em vermelho que te passei e cole-o no espaço em branco do Zoek

*Clique [Run Script]

*Durante o scan uma mensagem parecida com esta abaixo mostrando o progresso do escaneamento será apresentada. Aguarde o término...pode demorar!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

*Caso a reinicialização do PC seja solicitada, clique [OK]

* Poste o log do Zoek que estará em C:\zoek-results.txt em sua próxima resposta.

Zoek.exe v5.0.0.0 Updated 14-April-2014
Tool run by Daniel on 01/05/2014 at 11:47:18,90.
Microsoft Windows 7 Ultimate 6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Daniel\Desktop\zoek.pif [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2014-04-30-135738.log 1223 bytes
C:\zoek-results2014-04-30-144313.log 19356 bytes
C:\zoek-results2014-05-01-134251.log 26748 bytes
C:\zoek-results2014-05-01-140832.log 526 bytes
C:\zoek-results2014-05-01-143206.log 4656 bytes

==== System Restore Info ======================

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\DefaultIcon]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\edit]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\edit\command]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\open]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\RocketPDF_File\shell\open\command]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\RocketPDF.exe]

==== Folders Found ======================

2014-01-30 18:49:58 2014-04-30 21:10:56 -------- d-----w- C:\FRST\Quarantine\C\Program Files\RocketPDF
2014-01-30 18:50:01 2014-04-30 21:53:32 -------- d-----w- C:\FRST\Quarantine\C\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RocketPDF

==== Files Found ======================


--- C:\FRST\Quarantine\C\Program Files\RocketPDF\RocketPDF.exe ---
Company: Krzysztof Kowalczyk
File Description: RocketPDF
File Version: 2.2.1.0.0
Product Name: RocketPDF
Copyright: Copyright 2006-2012 all authors (GPLv3)
Original Filename: RocketPDF.exe
File type: ----a-w-
File size: 4949504
Created time: 2013-03-11 14:18:56
Modified time: 2013-03-11 14:18:56
MD5: 8EAD845FABB2546025F0F410F81685CE
SHA1: F014E5A388FCAD3F31B833728A6448F5690392A4


--- C:\FRST\Quarantine\C\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RocketPDF\RocketPDF.lnk ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File type: ----a-w-
File size: 1020
Created time: 2014-01-30 18:50:02
Modified time: 2014-01-30 18:50:02
MD5: B598405DF3EBC36896A2BC9ADB21F6DA
SHA1: 1AC17262E919D1E2FAC5EDB646F0E2A123444065


==== Registry Search Results for "RocketPDF" ======================

No instances of string "RocketPDF" found.

==== C:\zoek_backup content ======================

C:\zoek_backup (files=195 folders=64 13146491 bytes)

==== EOF on 01/05/2014 at 11:55:21,44 ======================

O RocketPDF ainda aparece? Como está o PC?

Vejo que você é muito solicitado aqui, todas postagens são respondidas por você.

Bem vamos ao assunto;
Não aparece mais, está bom só falta eu conseguir rodar o Purera para poder dizer se finalizamos.

luizvilarinho escreveu:Vejo que você é muito solicitado aqui, todas postagens são respondidas por você.

Sim, depois que o Wings faleceu não tenho mais ninguém para auxiliar na remoção de malwares.
________________________________________________________________________________

Bem vamos ao assunto;
Não aparece mais, está bom só falta eu conseguir rodar o Purera para poder dizer se finalizamos.

Sim, rode-o então por gentileza, e nos diga o resultado.

Já decorreu 14 minutos e o PureRa ainda está escaneando, é normal?

luizvilarinho escreveu:Já decorreu 14 minutos e o PureRa ainda está escaneando, é normal?

Está no modo seguro ou no normal? Se estiver no modo normal, tente fazer a limpeza no modo seguro.

Acho que desisto de rodar o PureRa pois estou no modo seguro e já passou 10 minutos e não conluio ainda.

Então faz a limpeza com o Ccleaner e com o ATF Cleaner:

Tutorial do ATF-Cleaner
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Fiz essa a, mas agora tava com um problema no crome e removi ele mas agora não consigo reinstalar da erro toda vez, algum procedimento para isso.

Mesmo no modo seguro o Chrome não está instalando?

Consegui instalar mas de alguma forma ele tá da mesma forma anterior e não apagou correto, usei o iobit unistaler para isso, eu configuro para ele ficar abrindo uma determinada pagina mas ao fechar e abrir novamente ele apaga a configuração feita, e na barra de favoritos esta os mesmos então é mais uma indicação que não removeu completo tem alguma forma de apagar ele por completo.

O Iobit Uninstaller nunca usei, mas você pode usar o Revo Uninstaller na remoção completa dele que é bastante eficiente.

Bem tudo feito mas o crome não ficou como deveria, mas deixamos como está, finalizemos esse tópico tudo resolvido.
Obrigado.

CASO RESOLVIDO

Caso o autor do tópico necessite, o mesmo será reaberto, para isso deverá entrar em contato com um dos membros da [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] solicitando o desbloqueio.