Certificado

por saraapereira1 Qua 07 maio 2014, 21:47

Olá boa noite meu computador ta abrindo algo que pergunta se eu quero instalar um certificado
diz assim:

Você esta prestes a instalar um certificado de uma autoridade de certificação ( autoridade de certificação) que diz representar:

CE_UmbrellaCert

entre outras coisas, e no final pergunta se desejo instalar esse certificado
o que é isso???

por **Power Max** Qua 07 maio 2014, 22:03

Olá.

Baixe o programa Adwcleaner clicando no link abaixo e depois clique no botão Download Now @BleepingComputer:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Para executar corretamente o AdwCleaner é só seguir as dicas deste tutorial:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

* Na sua próxima resposta poste o log (relatório) do Adwcleaner que estará em C:\AdwCleaner\AdwCleaner[S0].txt

Ficamos na espera.

por saraapereira1 Qui 08 maio 2014, 11:00

# AdwCleaner v3.207 - Relatório criado 08/05/2014 às 10:55:29
# Atualizado 05/05/2014 por Xplode
# Sistema Operacional : Windows 7 Home Basic Service Pack 1 (64 bits)
# Usuário : Aleluia - ALELUIA-TECNO
# Executando de : C:\Users\Aleluia\Downloads\adwcleaner.exe
# Opção : Limpar

***** [ Serviços ] *****

***** [ Arquivos / Pastas ] *****

Pasta Deletada : C:\ProgramData\baidu
Pasta Deletada : C:\Users\Public\Documents\baidu

***** [ Atalhos ] *****

***** [ Registro ] *****

***** [ Navegadores ] *****

-\\ Internet Explorer v11.0.9600.17041

-\\ Google Chrome v

[ Arquivo : C:\Users\Aleluia\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [31234 octets] - [02/05/2014 20:48:51]
AdwCleaner[R1].txt - [9894 octets] - [04/05/2014 08:42:41]
AdwCleaner[R2].txt - [6319 octets] - [07/05/2014 20:35:28]
AdwCleaner[R3].txt - [1233 octets] - [08/05/2014 10:54:27]
AdwCleaner[S0].txt - [28290 octets] - [02/05/2014 20:50:26]
AdwCleaner[S1].txt - [7336 octets] - [04/05/2014 08:43:41]
AdwCleaner[S2].txt - [5833 octets] - [07/05/2014 20:36:38]
AdwCleaner[S3].txt - [1148 octets] - [08/05/2014 10:55:29]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1208 octets] ##########

por **Power Max** Qui 08 maio 2014, 11:06

Desative temporariamente seu antivírus para evitar conflitos.

* Acesse este link abaixo e clique no primeiro botão da esquerda que é o botão Download Zoek.exe:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Certificado 772309

Para executá-lo corretamente siga as dicas deste tutorial:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

* Assim que ele concluir a limpeza dos problemas acesse o log (relatório) do Zoek que estará em C:\zoek-results.txt e copie todo seu conteúdo e poste em sua próxima resposta.

por saraapereira1 Qui 08 maio 2014, 12:20

Zoek.exe v5.0.0.0 Updated 14-April-2014
Tool run by Aleluia on 08/05/2014 at 11:40:36,59.
Microsoft Windows 7 Home Basic 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Aleluia\Downloads\zoek.exe [Scan all users] [Script inserted]

==== System Restore Info ======================

08/05/2014 11:43:25 Zoek.exe System Restore Point Created Succesfully.

==== Reset Hosts File ======================

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handle within DNS itself.
127.0.0.1 localhost
::1 localhost

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1798105164-1853435045-4239063915-1000\Software\Microsoft\Internet Explorer\SearchScopes\{100B0FEE-FF27-42C3-A6C3-DB3B45495CE4} deleted successfully
HKEY_USERS\S-1-5-21-1798105164-1853435045-4239063915-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E627DC4B-8C04-4234-A2D4-1D634EE01C41} deleted successfully

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== Deleting Files \ Folders ======================

C:\Users\Aleluia\AppData\Roaming\Baidu deleted
C:\Users\Aleluia\AppData\Roaming\GetRightToGo deleted
C:\PROGRA~3\FileSplitUpLoad.dll deleted
C:\PROGRA~3\Allmyapps deleted
C:\PROGRA~3\Baidu deleted
C:\Users\Aleluia\Downloads\rcpsetup_softonic_new_br_pd_new.exe deleted
C:\Users\Aleluia\Downloads\SoftonicDownloader_para_pes-2013.exe deleted
C:\user.js deleted
C:\Windows\Syswow64\InstallUtil.InstallLog deleted
C:\Users\Aleluia\Desktop\FREE Games.url deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"{0153E448-190B-4987-BDE1-F256CADA672F}"="C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext" [25/08/2012 17:54]
[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]
"smartwebprinting@hp.com"="C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3" [22/08/2012 17:47]

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
jfmjfhklogoienhpfnppmbcbjfjnkonk - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx[25/08/2012 17:54]

avast Online Security - Aleluia\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki
RealPlayer HTML5Video Downloader Extension - Aleluia\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk
Google Wallet - Aleluia\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

==== Chrome Fix ======================

C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx deleted successfully
C:\Users\Aleluia\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.google.com"
"Search Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.google.com"
"Search Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="http://www.google.com"
"oldTabs"="http://www.google.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="http://www.google.com"
"oldTabs"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"
{B7011797-A5DF-4FC5-BF45-4C5E2FBC60E9} Unknown Url="Not_Found"

==== Reset Google Chrome ======================

C:\Users\Aleluia\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Aleluia\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1798105164-1853435045-4239063915-1000\Software\Microsoft\Internet Explorer\SearchScopes\{B7011797-A5DF-4FC5-BF45-4C5E2FBC60E9} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{a1bcc327-7c56-4d0c-a1b7-fd4c30da8a09} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a1bcc327-7c56-4d0c-a1b7-fd4c30da8a09} deleted successfully

==== Deleting CLSID Registry Values ======================

==== shortcuts on Users Desktops ======================

C:\Users\Aleluia\Desktop\adwcleaner - Atalho.lnk - C:\Users\Aleluia\Downloads\adwcleaner.exe
C:\Users\Aleluia\Desktop\Biblia Eletrônica.lnk -
C:\Users\Aleluia\Desktop\Downloads.lnk - C:\Users\Aleluia\Downloads
C:\Users\Aleluia\Desktop\Facebook Messenger.lnk - C:\Users\Aleluia\AppData\Local\Facebook\Messenger\2.1.4590.0\FacebookMessenger.exe
C:\Users\Aleluia\Desktop\meu computador.lnk -
C:\Users\Aleluia\Desktop\Microsoft Excel 2010.lnk - C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\xlicons.exe
C:\Users\Aleluia\Desktop\Microsoft PowerPoint 2010.lnk - C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pptico.exe
C:\Users\Aleluia\Desktop\Microsoft Security Essentials.lnk - C:\Program Files (x86)\Microsoft Security Client\msseces.exe
C:\Users\Aleluia\Desktop\Microsoft Word 2010.lnk - C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\wordicon.exe
C:\Users\Aleluia\Desktop\PhotoScape.lnk - C:\Program Files (x86)\PhotoScape\PhotoScape.exe
C:\Users\Aleluia\Desktop\Sweet Home 3D.lnk - C:\Program Files (x86)\Sweet Home 3D\SweetHome3D.exe
C:\Users\Aleluia\Desktop\Windows Live Messenger.lnk -
C:\Users\Aleluia\Desktop\zoek - Atalho.lnk - C:\Users\Aleluia\Downloads\zoek.exe
C:\Users\Aleluia\Desktop\Bráulio\Desktop.lnk -
C:\Users\Aleluia\Desktop\provinhas Sara\slide-6-728 - Cópia - Atalho.lnk -
C:\Users\Aleluia\Desktop\provinhas Sara\Um bichinho diferente-texto com atividade - Atalho.lnk - C:\Users\Aleluia\Desktop\provinhas Sara\Um bichinho diferente-texto com atividade.gif

==== shortcuts on All Users Desktop ======================

C:\Users\Public\Desktop\Adobe Reader X.lnk - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe
C:\Users\Public\Desktop\Ares.lnk - C:\Program Files (x86)\Ares\Ares.exe
C:\Users\Public\Desktop\Central de Soluções HP.lnk -
C:\Users\Public\Desktop\Claro.lnk - C:\Program Files (x86)\Claro\Claro.exe
C:\Users\Public\Desktop\Connection Manager.lnk - C:\Program Files (x86)\Connection Manager\UIMain.exe
C:\Users\Public\Desktop\Google Docs.lnk - C:\Program Files (x86)\Google\Drive\googledrivesync.exe --new_document
C:\Users\Public\Desktop\Google Sheets.lnk - C:\Program Files (x86)\Google\Drive\googledrivesync.exe --new_spreadsheet
C:\Users\Public\Desktop\Google Slides.lnk - C:\Program Files (x86)\Google\Drive\googledrivesync.exe --new_presentation
C:\Users\Public\Desktop\HP Photosmart Essential 3.5.lnk - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpse.exe
C:\Users\Public\Desktop\iTunes.lnk - C:\Program Files (x86)\iTunes\iTunes.exe
C:\Users\Public\Desktop\Loja de Suprimentos HP.lnk - C:\Program Files (x86)\HP\HPSSUPPLY\hpqSSupply.exe
C:\Users\Public\Desktop\Mundo Bíblico.lnk -
C:\Users\Public\Desktop\RealPlayer.lnk - C:\Program Files (x86)\Real\RealPlayer\realplay.exe /launch:desktop
C:\Users\Public\Desktop\TIM Communicator.lnk - C:\Program Files (x86)\TIM Communicator\orolixcommunicator.exe

==== shortcuts in Users Start Menu ======================

C:\Users\Aleluia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Aleluia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Aleluia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox\Dropbox.lnk - C:\Users\Aleluia\AppData\Roaming\Dropbox\bin\Dropbox.exe /home
C:\Users\Aleluia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox\Uninstall Dropbox.lnk - C:\Users\Aleluia\AppData\Roaming\Dropbox\bin\DropboxUninstaller.exe
C:\Users\Aleluia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk - C:\Users\Aleluia\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Aleluia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lollipop_04261722.lnk - C:\Users\Aleluia\AppData\Local\Lollipop\lollipop_04261722.exe lollipop_04261722

==== shortcuts in All Users Start Menu ======================

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced Disk Recovery\Desinstalar Advanced Disk Recovery.lnk - C:\Program Files (x86)\Advanced Disk Recovery\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Advanced Disk Recovery\Iniciar Advanced Disk Recovery.lnk - C:\Program Files (x86)\Advanced Disk Recovery\HighestAvailable.exe C:\Program Files (x86)\Advanced Disk Recovery\AdvancedDiskRecovery.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ffdshow\Audio decoder configuration.lnk -
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ffdshow\Uninstall ffdshow.lnk -
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ffdshow\VFW configuration.lnk -
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ffdshow\Video decoder configuration.lnk -

==== shortcuts in Quick Launch ======================

C:\Users\Aleluia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Advanced Disk Recovery.lnk - C:\Program Files (x86)\Advanced Disk Recovery\HighestAvailable.exe C:\Program Files (x86)\Advanced Disk Recovery\AdvancedDiskRecovery.exe
C:\Users\Aleluia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Aleluia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\PhotoScape.lnk - C:\Program Files (x86)\PhotoScape\PhotoScape.exe
C:\Users\Aleluia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Aleluia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Aleluia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\7e4dca80246863e3\pinned.lnk - C:\Windows\system32\control.exe
C:\Users\Aleluia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Microsoft Security Essentials.lnk - C:\Program Files (x86)\Microsoft Security Client\msseces.exe
C:\Users\Aleluia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\RealPlayer.lnk - C:\Program Files (x86)\Real\RealPlayer\realplay.exe /launch:desktop
C:\Users\Aleluia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Adobe Reader X.lnk - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe
C:\Users\Aleluia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AMCap.lnk - C:\Program Files (x86)\Noel Danjou\AMCap\AMCap.exe
C:\Users\Aleluia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Users\Aleluia\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Aleluia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\HP Photosmart Essential 3.5.lnk - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqpse.exe
C:\Users\Aleluia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Aleluia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Excel 2010.lnk - C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\xlicons.exe
C:\Users\Aleluia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Word 2010.lnk - C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\wordicon.exe
C:\Users\Aleluia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk - C:\Windows\explorer.exe
C:\Users\Aleluia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk - C:\Program Files (x86)\Windows Media Player\wmplayer.exe /prefetch:1
C:\Users\Convidado\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Convidado\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Convidado\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Convidado\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\AMCap.lnk - C:\Program Files (x86)\Noel Danjou\AMCap\AMCap.exe
C:\Users\Convidado\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Convidado\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk - C:\Windows\explorer.exe
C:\Users\Convidado\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Media Player.lnk - C:\Program Files (x86)\Windows Media Player\wmplayer.exe /prefetch:1
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -
C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -
C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -

==== Reset IE Proxy ======================

Value(s) before fix:
"ProxyServer"="http=127.0.0.1:49942;https=127.0.0.1:49942"
"ProxyOverride"="<-loopback>"
"ProxyEnable"=dword:00000001

Value(s) after fix:
"ProxyEnable"=dword:00000000

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Hao123.com deleted successfully

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Aleluia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Aleluia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Aleluia\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Aleluia\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Convidado\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Convidado\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Convidado\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Convidado\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\Aleluia\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=18 folders=9 5266617 bytes)

==== Empty Temp Folders ======================

C:\Users\Aleluia\AppData\Local\Temp will be emptied at reboot
C:\Users\Convidado\AppData\Local\Temp emptied successfully
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\USURIO~1\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\Aleluia\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 08/05/2014 at 12:18:06,30 ======================

por saraapereira1 Qui 08 maio 2014, 12:21

Esse aí é o relatório , mas a mensagem continua aparecendo

por **Power Max** Qui 08 maio 2014, 12:24

Baixe o programa Junkware Removal Tool no link abaixo:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Para executar corretamente o programa acima é só seguir as dicas deste tutorial:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

* Na sua próxima resposta poste o log (relatório) do Junkware Removal Tool que estará salvo em sua área de trabalho com o nome de JRT.txt

Ficamos na espera.

por saraapereira1 Qui 08 maio 2014, 12:45

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Basic x64
Ran by Aleluia on 08/05/2014 at 12:33:48,10
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\baidu

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Program Files (x86)\hao123.com"

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08/05/2014 at 12:41:29,88
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

por **Power Max** Qui 08 maio 2014, 12:46

Faça o download do < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > < [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]> ( ... de Nicolas Coolman )

Para instalá-lo e executá-lo corretamente siga as dicas deste artigo:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

* Assim que ele concluir a sua verificação, copie todo o conteúdo do seu relatório ZHPDiag.txt e poste em sua próxima resposta.

por saraapereira1 Qui 08 maio 2014, 12:48

o problema ainda persiste... Sad

por **Power Max** Qui 08 maio 2014, 12:48

Use o ZHP como lhe passei acima e poste seu relatório para análise.

por saraapereira1 Qui 08 maio 2014, 12:56

~ Relatório do ZHPDiag v2014.5.8.57 - Nicolas Coolman (08/05/2014)
~ Iniciado por Aleluia (08/05/2014 12:52:47)
~ Endereço do Website : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Fóruns de suporte gratuito para desinfecção : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Tradução pelo utilizador
~ Estatuto da versão :
~ Lista Branca : Ativado pelo programa
~ Elevação dos Privilégios : OK
~ Controle de Conta de Utilizador : Deactivate by user

---\\ Navegadores Internet
MSIE: Internet Explorer v11.0.9600.17105
GCIE: Google Chrome v34.0.1847.131 (Defaut)

---\\ Informações sobre os produtos Windows
~ Langage: Portugais
Windows 7 Home Basic, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
Software Protection Service (Protection logicielle) : OK
Key Management Service client information : KO
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ Softwares de proteçao do sistema
Microsoft Security Client PT-BR Language Pack v2.1.1116.0
Windows Defender W7

---\\ Softwares d'optimização do sistema

---\\ Softwares de partilha do PeerToPeer (P2P)

---\\ Monitoramento dos softwares
Adobe Flash Player 10 ActiveX
Adobe Reader X

---\\ Informações sobre o sistema
~ Processor: Intel64 Family 6 Model 37 Stepping 5, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3765 MB (54% free)
System Restore: Activé (Enable)
System drive C: has 370 GB (80%) free of 461 GB

---\\ Modo de conexão ao sistema
~ Computer Name: ALELUIA-TECNO
~ User Name: Aleluia
~ All Users Names: Convidado, Aleluia, Administrador,
~ Unselected Option: 045,061,O62,065,066,080,O82,089
Logged in as Administrator

---\\ As variáveis de ambiente
~ System Unit : C:\
~ %AppZHP% : C:\Users\Aleluia\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Aleluia\AppData\Roaming\
~ %Desktop% : C:\Users\Aleluia\Desktop\
~ %Favorites% : C:\Users\Aleluia\Favorites\
~ %LocalAppData% : C:\Users\Aleluia\AppData\Local\
~ %StartMenu% : C:\Users\Aleluia\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumeração das unidades dos discos
C: Hard drive, Flash drive, Thumb drive (Free 370 Go of 461 Go)
D: CD-ROM drive (Not Inserted)
F: Floppy drive, Flash card reader, USB Key (Not Inserted)
Q: Hard drive, Flash drive, Thumb drive (Free 0 Go of 0 Go)

---\\ Estado do Centro de Segurança do Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
~ Security Center: 44 Legitimates Filtered in 00mn 00s

---\\ Pesquisa particular de ficheiros genéricos
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Windows Explorer.) (.25/02/2011 - 03:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Aplicativo de Inicialização do Windows.) (.13/07/2009 - 22:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.F220BA78AB542C70211D73AE4729B2CD] - (.Microsoft Corporation - Internet Extensions para Win32.) (.06/03/2014 - 03:22:40.) -- C:\Windows\System32\wininet.dll [2260480]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Aplicativo de Logon do Windows.) (.21/11/2010 - 00:24:29.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Biblioteca de Licenciamento de Software.) (.21/11/2010 - 00:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.27/09/2013 - 22:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.13/07/2009 - 22:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 20:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 00:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Driver de porta i8042.) (.13/07/2009 - 20:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.13/07/2009 - 21:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.26/04/2011 - 23:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 00:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - Driver do Sistema de Arquivos NT.) (.23/01/2014 - 23:37:55.) -- C:\Windows\system32\Drivers\ntfs.sys [1684928]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Driver de porta paralela.) (.13/07/2009 - 21:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 00:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.13/07/2009 - 21:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 00:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s

---\\ Estatuto dos ficheiros ocultos (Oculto/Total)
~ Mes images (My Pictures) : 2/156
~ Mes musiques (My Musics) : 1/991
~ Mes Videos (My Videos) : 1/78
~ Mes Favoris (My Favorites) : 1/22
~ Mes Documents (My Documents) : 9/1417
~ Mon Bureau (My Desktop) : 4/3842
~ Menu demarrer (Programs) : 1/34
~ Hidden Files: Scanned in 00mn 05s

---\\ Processos lançados
[MD5.349AB4F70E2AC44970894E7F03E1576E] - (.Huawei Technologies Co., Ltd. - DataCardMonitor MFC Application.) -- C:\ProgramData\DatacardService\DCSHelper.exe [236384] [PID.3204]
[MD5.C948AC73822CA662CF44185B909EA18B] - (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.exe [720064] [PID.3972]
[MD5.70EA13A41C0D9D31343EC203A629F801] - (.Ares Development Group - Ares p2p for windows.) -- C:\Program Files (x86)\Ares\Ares.exe [3209216] [PID.3980]
[MD5.B54921381A950C8215FB363B485C432B] - (.Hewlett-Packard Co. - HP Digital Imaging Monitor.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [270336] [PID.1480]
[MD5.4A73AB8412D3AA6CFAD24051FF9DBFA7] - (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160] [PID.3484]
[MD5.4BF3C4F9327BB33190603829C9F5E781] - (.Facebook - Facebook Messenger.) -- C:\Users\Aleluia\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe [248240] [PID.124]
[MD5.11947F50905DC85A44FE2B409857413B] - (.No owner - LockKey.) -- C:\Program Files (x86)\LockKey\LockKey.exe [801392] [PID.3376]
[MD5.A73731A0B0A165907799E9AFB461F856] - (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [296096] [PID.3780]
[MD5.C637FC4638A96165256B28D38DE7B953] - (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208] [PID.1260]
[MD5.2894C8A3A3F7B18F53262CDEB1F7DF8E] - (...) -- C:\Program Files (x86)\Connection Manager\UIexec.exe [153424] [PID.3220]
[MD5.B4E6C1B28AF8806008CB654C716ABAFA] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392] [PID.2988]
[MD5.F16EEA6CCA9D8A7D1193AE80E43FBBC7] - (.Hewlett-Packard Co. - HP CUE Status Root.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe [168960] [PID.4940]
[MD5.8A9FACCB684500829F7D0BCC67B386CC] - (.Hewlett-Packard Co. - HP CUE Alert Popup Window Objects.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe [559104] [PID.4992]
[MD5.883008A9B5BFF94A153D99DBA54CB5C1] - (.Hewlett-Packard - GPCore COM object.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe [362496] [PID.5048]
[MD5.542459D16B416D054161007FC9B1246E] - (.Google Inc. - Google Chrome.) -- C:\Users\Aleluia\AppData\Local\Google\Chrome\Application\chrome.exe [841032] [PID.1936]
[MD5.CCD09CA21C1946AF24834512BD9A6FCA] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [7873536] [PID.3384]
[MD5.B362181ED3771DC03B4141927C80F801] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65432] [PID.1568]
[MD5.F518545E5B7623AD49ABE7F8776EFA46] - (.Apple Inc. - YSLoader.exe.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [43336] [PID.1736]
[MD5.47EFDB5472E76B4FC91259FC4B3B659A] - (...) -- C:\MySQL\bin\mysqld.exe [8186368] [PID.1960]
[MD5.EA83547B253F5FEFC870DD0D04737EC2] - (.Orolix Desenvolvimento de Software LTDA. - USB Device monitor.) -- C:\Program Files (x86)\TIM Communicator\module\devicemon.exe [27040] [PID.2040]
[MD5.39B1D0A636A400304565D4521FAD6D77] - (.Microsoft Corporation - Microsoft Application Virtualization Virtua.) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [207528] [PID.2284]
[MD5.BE463B423C33C038ADCE0EDB6C2FD208] - (...) -- C:\Program Files (x86)\Connection Manager\AssistantServices.exe [270672] [PID.2352]
[MD5.77C5A741A7452812F278EF2C18478862] - (.Microsoft Corporation - Microsoft Application Virtualization Client.) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [523944] [PID.2448]
[MD5.FD557A50A65E44041CD2FCEF4BEB04DB] - (.Microsoft Corporation - Microsoft Office Client Virtualization Serv.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.exe [822504] [PID.2636]
[MD5.7E6B107120108B3A15BFECE0DE3201DB] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler.exe [228744] [PID.3224]
[MD5.8FFF9083252C16FE3960173722605E9E] - (.Intel Corporation - IAStorDataSvc.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [13336] [PID.4148]
~ Processes Running: Scanned in 00mn 00s

---\\ Google Chrome, Arranque,Pesquisa,Extensões (G0,G1,G2)
C:\Users\Aleluia\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [ahfgeienlihckogmohjhadlkjgocpleb] Loja v.0.2 (Activé)
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)

---\\ Pasta de extensão do Google Chrome
~ Google Lines Browser: 10 Legitimates Filtered in 00mn 00s

---\\ Internet Explorer, Gestão do Proxy (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <-loopback> =>Hijacker.Proxy
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:59661;https=127.0.0.1:59661 =>Hijacker.Proxy
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s

---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s

---\\ Redireção do ficheiro Hosts (01)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21

---\\ Aplicações iniciadas por registo & pastas (04)
O4 - GS\Startup [Aleluia]: lollipop_04261722.lnk . (...) -- C:\Users\Aleluia\AppData\Local\Lollipop\lollipop_04261722.exe (.not file.) =>Adware.Lollipop
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gerenciador de áudio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe (.not file.)
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] . (.Broadcom Corporation - Broadcom 802.11 Network Adapter Wireless Ne.) -- C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.exe
O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Google Installer.) -- C:\Users\Aleluia\AppData\Local\Google\Update\GoogleUpdate.exe
O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Facebook Installer.) -- C:\Users\Aleluia\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKCU\..\Run: [OfficeSyncProcess] . (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.exe
O4 - HKCU\..\Run: [ares] . (.Ares Development Group - Ares p2p for windows.) -- C:\Program Files (x86)\Ares\Ares.exe
O4 - HKCU\..\Run: [HW_OPENEYE_OUC_Claro] C:\Program Files (x86)\Claro\UpdateDog\ouc.exe (.not file.)
O4 - HKCU\..\Run: [ContentExplorer] . (.ContentExplorer - ContentExplorer.) -- C:\Users\Aleluia\AppData\Roaming\ContentExplorer\ContentExplorer.exe
O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_DBDF8A44B2E2569C1DC03EE3E53DB07D] . (.Google Inc. - Google Chrome.) -- C:\Users\Aleluia\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - HKLM\..\Wow6432Node\Run: [IAStorIcon] . (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Wow6432Node\Run: [LockKey] . (.No owner - LockKey.) -- C:\Program Files (x86)\LockKey\LockKey.exe
O4 - HKLM\..\Wow6432Node\Run: [WSED] . (.TODO: - TODO: .) -- C:\Program Files (x86)\WSED\WSED.exe
O4 - HKLM\..\Wow6432Node\Run: [BCSSync] . (.Microsoft Corporation - Microsoft Office 2010 component.) -- C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe =>.Microsoft Corporation
O4 - HKLM\..\Wow6432Node\Run: [hpqSRMon] . (.Hewlett-Packard - HpqSRmon.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Wow6432Node\Run: [TkBellExe] . (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe =>.RealNetworks, Inc
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe =>.Hewlett-Packard Co
O4 - HKLM\..\Wow6432Node\Run: [PSafeTray] C:\Program Files (x86)\PSafe\PSafeSysTray.exe (.not file.)
O4 - HKLM\..\Wow6432Node\Run: [PSafeWDS] C:\Program Files (x86)\PSafe\PSafeWDS.exe (.not file.)
O4 - HKLM\..\Wow6432Node\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
O4 - HKLM\..\Wow6432Node\Run: [UIExec] . (...) -- C:\Program Files (x86)\Connection Manager\UIexec.exe
O4 - HKLM\..\Wow6432Node\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [Google Update] . (.Google Inc. - Google Installer.) -- C:\Users\Aleluia\AppData\Local\Google\Update\GoogleUpdate.exe
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [Facebook Update] . (.Facebook Inc. - Facebook Installer.) -- C:\Users\Aleluia\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [OfficeSyncProcess] . (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.exe
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [ares] . (.Ares Development Group - Ares p2p for windows.) -- C:\Program Files (x86)\Ares\Ares.exe
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [HW_OPENEYE_OUC_Claro] C:\Program Files (x86)\Claro\UpdateDog\ouc.exe (.not file.)
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [ContentExplorer] . (.ContentExplorer - ContentExplorer.) -- C:\Users\Aleluia\AppData\Roaming\ContentExplorer\ContentExplorer.exe
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [GoogleChromeAutoLaunch_DBDF8A44B2E2569C1DC03EE3E53DB07D] . (.Google Inc. - Google Chrome.) -- C:\Users\Aleluia\AppData\Local\Google\Chrome\Application\chrome.exe
~ Application: Scanned in 00mn 00s

---\\ Boutões da barra de ferramentas principal do Internet Explorer (09)
O9 - Extra button: &Enviar para o OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\MICROS~3\Office14\ONBttnIE.dll =>.Microsoft Corporation
O9 - Extra button: &Anotações Vinculadas do OneNote [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\MICROS~3\Office14\ONBTTN~1.dll =>.Microsoft Corporation
O9 - Extra button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 [64Bits] - {CCA281CA-C863-46ef-9331-5C8D4460577F} . (...) -- C:\Program Files\WIDCOMM\Bluetooth Software\bt_hot_icon.ico
~ IE Extra Buttons: Scanned in 00mn 00s

---\\ Alteração Dominio/Clientes DNS (017)
O17 - HKLM\System\CCS\Services\Tcpip\..\{680AC1A4-4A09-49E5-8715-D03BD9079B39}: NameServer = 200.169.117.221 200.169.117.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{94F6B527-2087-4EA1-A9A3-A150221EB843}: DhcpNameServer = 172.20.10.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{9664848F-5400-4A33-A0F6-CF9F732C12E8}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{ED4402BF-608D-42FB-98E7-491F904B860E}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{F675FB36-63BE-4C55-BE56-01A77E6B84A7}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CS1\Services\Tcpip\..\{680AC1A4-4A09-49E5-8715-D03BD9079B39}: NameServer = 200.169.117.221 200.169.117.222
O17 - HKLM\System\CS1\Services\Tcpip\..\{94F6B527-2087-4EA1-A9A3-A150221EB843}: DhcpNameServer = 172.20.10.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{9664848F-5400-4A33-A0F6-CF9F732C12E8}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{ED4402BF-608D-42FB-98E7-491F904B860E}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{F675FB36-63BE-4C55-BE56-01A77E6B84A7}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CS2\Services\Tcpip\..\{680AC1A4-4A09-49E5-8715-D03BD9079B39}: NameServer = 200.169.117.221 200.169.117.222
O17 - HKLM\System\CS2\Services\Tcpip\..\{94F6B527-2087-4EA1-A9A3-A150221EB843}: DhcpNameServer = 172.20.10.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{9664848F-5400-4A33-A0F6-CF9F732C12E8}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{ED4402BF-608D-42FB-98E7-491F904B860E}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{F675FB36-63BE-4C55-BE56-01A77E6B84A7}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
~ Domain: Scanned in 00mn 00s

---\\ Protocolo adicional (018)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s

---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s

---\\ Lista dos serviços NT não Microsoft e não desativados (023)
O23 - Service: HWDeviceService64.exe (HWDeviceService64.exe) . (.No owner - DCSHOST.) - C:\ProgramData\DatacardService\HWDeviceService64.exe
O23 - Service: KMService (KMService) . (...) - C:\Windows\SysWOW64\srvany.exe =>Hijacker.Office
O23 - Service: MySQL (MySQL) . (...) - C:\MySQL\bin\mysqld.exe
O23 - Service: Orolix Device Monitor (OrolixDeviceMonitor) . (.Orolix Desenvolvimento de Software LTDA. - USB Device monitor.) - C:\Program Files (x86)\TIM Communicator\module\devicemon.exe
O23 - Service: Protect Monitor (ProtectMonitor) . (...) - C:\Program Files\PCDApp\StartHelp.exe =>Trojan.BitCoinMiner
~ Services: 13 Legitimates Filtered in 00mn 06s

---\\ Tarefas planificadas automaticamente (039)
[MD5.00000000000000000000000000000000] [APT] [{0B184303-EB93-42E4-89F1-74BAB04A7AEF}] (...) -- D:\setup.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{3A36A9F9-4038-49AA-9E36-7E581F19B867}] (...) -- C:\Users\Aleluia\AppData\Local\Temp\nsfFE23.tmp\5193805b-c284-4f85-b972-26465bc06f2f.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{65F9BF8D-734C-437B-BD5D-D75941EC8252}] (...) -- C:\Users\Aleluia\AppData\Local\Temp\nsg6484.tmp\5193805b-c284-4f85-b972-26465bc06f2f.exe (.not file.) [0]
[MD5.00000000000000000000000000000000] [APT] [{945E0D26-4B88-4D41-9400-7783E1BB9438}] (...) -- C:\Users\Aleluia\AppData\Local\Temp\nsuBFCC.tmp\5193805b-c284-4f85-b972-26465bc06f2f.exe (.not file.) [0]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1798105164-1853435045-4239063915-1000Core [914]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1798105164-1853435045-4239063915-1000UA [936]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore [1066]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA [1070]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1798105164-1853435045-4239063915-1000Core [1034]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1798105164-1853435045-4239063915-1000UA [1086]
~ Scheduled Task: 19 Legitimates Filtered in 00mn 04s

---\\ Drivers lançados ao arranque do sistema (041)
O41 - Driver: (Bfilter) . (. - .) - C:\Windows\system32\drivers\Bfilter.sys (.not file.)
O41 - Driver: (Bfmon) . (. - .) - C:\Windows\system32\drivers\Bfmon.sys (.not file.)
O41 - Driver: (Bnbase) . (. - .) - C:\Windows\System32\drivers\bnbasex64.sys (.not file.)
O41 - Driver: (Bndef) . (. - .) - C:\Windows\system32\drivers\bndef64.sys (.not file.)
O41 - Driver: (Bprotect) . (. - .) - C:\Windows\system32\drivers\Bprotect.sys (.not file.)
O41 - Driver: ({42e50651-9669-456e-9081-d5a836274274}w64) . (.StdLib - StdLib.) - C:\Windows\System32\drivers\{42e50651-9669-456e-9081-d5a836274274}w64.sys =>PUP.LinkiDoo
~ Drivers: 78 Legitimates Filtered in 00mn 00s

---\\ Software instalados (042)
O42 - Logiciel: A Bíblia Sagrada Versão Digital 6.7 Freeware - (.Por Marcelo Ribeiro de Oliveira - 20/05/2010.) [HKLM][64Bits] -- A Bíblia Sagrada Versão Digital 6.7 Freeware_is1
O42 - Logiciel: Ares 2.1.8 - (.Ares Development Group.) [HKLM][64Bits] -- Ares
O42 - Logiciel: Biblia Eletrônica 3.6.4 - (.RkSoft Softwares Ltda.) [HKLM][64Bits] -- Biblia Eletrônica_is1
O42 - Logiciel: Claro 3G - (...) [HKLM][64Bits] -- {93D34EE3-99B3-4DB1-8B0A-0A657466F90D}
O42 - Logiciel: ContentExplorer - (.ContentExplorer.net.) [HKLM][64Bits] -- ContentExplorer
O42 - Logiciel: FindRight - (.FindRight.) [HKLM][64Bits] -- FindRight =>Hijacker.FindrToolbar
O42 - Logiciel: LockKey - (...) [HKLM][64Bits] -- InstallShield_{AF192694-4B15-4AC1-92F3-1B02E98C08BD}
O42 - Logiciel: Lollipop - (.Lollipop Network, S.L..) [HKCU][64Bits] -- lollipop_04271637 =>Adware.Lollipop
O42 - Logiciel: Mundo Bíblico - (.Ideias Sem Fim.) [HKLM][64Bits] -- {FAD8C014-4637-45F3-BD56-285A90F39D36}_is1
O42 - Logiciel: PC Data App - (...) [HKLM][64Bits] -- PCData App =>Trojan.BitCoinMiner
O42 - Logiciel: SupraSavings - (.SupraSavings.) [HKLM][64Bits] -- {E6B105B8-1F65-4428-9397-1DFD8A03B94D} =>PUP.SupraSavings
O42 - Logiciel: TIM Communicator - (...) [HKLM][64Bits] -- OrolixCommunicator
O42 - Logiciel: TIMWEB.exe - (...) [HKLM][64Bits] -- lcgsm_is1
O42 - Logiciel: webssearches uninstaller - (.webssearches.) [HKLM][64Bits] -- webssearches uninstaller =>Hijacker.WebsSearches
~ Logic: 37 Legitimates Filtered in 00mn 00s

---\\ HKCU & HKLM Software Keys
[HKCU\Software\Ares]
[HKCU\Software\Baidu Security] =>Adware.BDSearch
[HKCU\Software\ContentExplorer]
[HKCU\Software\DefaultPackStatus]
[HKCU\Software\FindRight] =>Hijacker.FindrToolbar
[HKCU\Software\OrolixCommunicator]
[HKCU\Software\Orolix]
[HKCU\Software\PCDataApp]
[HKCU\Software\RkSoft]
[HKLM\Software\Baidu Security] =>Adware.BDSearch
[HKLM\Software\Wow6432Node\360Safe] =>Trojan.Lozavita
[HKLM\Software\Wow6432Node\Baidu Security] =>Adware.BDSearch
[HKLM\Software\Wow6432Node\Claro 3G]
[HKLM\Software\Wow6432Node\FindRight] =>Hijacker.FindrToolbar
[HKLM\Software\Wow6432Node\LockKey]
[HKLM\Software\Wow6432Node\Orolix]
[HKLM\Software\Wow6432Node\PCDataApp]
[HKLM\Software\Wow6432Node\Program DJ]
[HKLM\Software\Wow6432Node\RkSoft]
[HKLM\Software\Wow6432Node\USBDriverFlag]
[HKLM\Software\Wow6432Node\WSED]
~ Key Software: 264 Legitimates Filtered in 00mn 00s

---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 27/09/2012 - 19:37:59 - [] ----D C:\Program Files (x86)\Ares
O43 - CFD: 19/02/2014 - 11:12:47 - [] ----D C:\Program Files (x86)\Baidu Security =>Adware.BDSearch
O43 - CFD: 26/01/2013 - 20:55:46 - [] ----D C:\Program Files (x86)\Claro 3G
O43 - CFD: 08/05/2012 - 08:33:22 - [] ----D C:\Program Files (x86)\LockKey
O43 - CFD: 14/01/2013 - 08:36:17 - [] ----D C:\Program Files (x86)\MundoBiblico
O43 - CFD: 08/11/2012 - 11:43:00 - [] ----D C:\Program Files (x86)\RkSoft
O43 - CFD: 25/11/2012 - 12:25:09 - [] ----D C:\Program Files (x86)\TIM
O43 - CFD: 20/02/2014 - 16:34:02 - [] ----D C:\Program Files (x86)\TIM Communicator
O43 - CFD: 09/07/2013 - 11:32:40 - [0] ----D C:\Program Files (x86)\VIVO ZAP
O43 - CFD: 08/05/2012 - 08:34:13 - [] ----D C:\Program Files (x86)\WSED
O43 - CFD: 29/04/2014 - 21:42:08 - [] ----D C:\ProgramData\Baidu Security =>Adware.BDSearch
O43 - CFD: 20/02/2014 - 16:34:02 - [] ----D C:\ProgramData\OrolixCommunicator
O43 - CFD: 27/12/2012 - 15:16:00 - [] ----D C:\ProgramData\Softouch
O43 - CFD: 08/05/2012 - 08:35:26 - [] ----D C:\ProgramData\Win732
O43 - CFD: 08/05/2012 - 08:35:25 - [] ----D C:\ProgramData\Win764
O43 - CFD: 08/05/2012 - 08:34:28 - [] ----D C:\ProgramData\XP32
O43 - CFD: 07/05/2014 - 19:21:54 - [] ----D C:\Users\Aleluia\AppData\Roaming\ContentExplorer
O43 - CFD: 27/12/2012 - 15:16:00 - [] ----D C:\Users\Aleluia\AppData\Roaming\Softouch
O43 - CFD: 25/11/2012 - 12:25:09 - [] ----D C:\Users\Aleluia\AppData\Roaming\TIM
O43 - CFD: 27/09/2012 - 19:38:01 - [] ----D C:\Users\Aleluia\AppData\Local\Ares
O43 - CFD: 02/02/2013 - 12:15:34 - [] ----D C:\Users\Aleluia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TagSoft
~ Program Folder: 169 Legitimates Filtered in 00mn 00s

---\\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044)
O44 - LFC:[MD5.091D0C13B71B3C1A9519F73AAC8AAF01] - 03/05/2014 - 20:11:26 ----- . (...) -- C:\bootsqm.dat [3288]
O44 - LFC:[MD5.8E9E3CBA08EC47245B277110835CF305] - 07/05/2014 - 19:23:13 ---A- . (.The OpenVPN Project - TAP-Win32 Virtual Network Driver.) -- C:\Windows\System32\Drivers\tap0901.sys [38216]
O44 - LFC:[MD5.BD3CB5AC7696FD6CB1A850BFE16B6606] - 07/05/2014 - 20:01:38 ---A- . (...) -- C:\Windows\certutil.log [3621]
O44 - LFC:[MD5.C90122A144F8EA6B54D38CEC7B6D70CE] - 07/05/2014 - 22:50:29 ---A- . (...) -- C:\Windows\System32\prfc0416.dat [4119168]
O44 - LFC:[MD5.B20A07B78C51744CCAB95B47550B2C79] - 07/05/2014 - 22:50:29 ---A- . (...) -- C:\Windows\System32\prfh0416.dat [4873824]
O44 - LFC:[MD5.CC7AA7B42CF418FC3D926913490048F8] - 08/05/2014 - 11:36:58 ---A- . (...) -- C:\Windows\zoek-delete.exe [24064]
O44 - LFC:[MD5.C2888827395836BC0B5877BF33A1E4A8] - 08/05/2014 - 12:18:06 ---A- . (...) -- C:\zoek-results.log [20038]
O44 - LFC:[MD5.87FB9899C8FA8F614F8D999C68706051] - 24/04/2014 - 12:23:46 ---A- . (.StdLib - StdLib.) -- C:\Windows\System32\Drivers\{42e50651-9669-456e-9081-d5a836274274}w64.sys [61112] =>PUP.LinkiDoo
O44 - LFC:[MD5.F911578DA931B1ECA46127F7E93F35CB] - 27/04/2014 - 17:10:40 ---A- . (...) -- C:\Windows\unins000.exe [715038]
O44 - LFC:[MD5.1B2B0B7FA7937CD057AA6ED27273EC68] - 27/04/2014 - 17:10:42 ---A- . (...) -- C:\Windows\System32\lagarith.dll [148992]
O44 - LFC:[MD5.28EF5BD32C7E368BDC4C4B0D141CA59B] - 27/04/2014 - 17:10:43 ---A- . (...) -- C:\Windows\unins000.dat [1997]
O44 - LFC:[MD5.D10C62FF24D46105D0C7F2A52204A792] - 27/04/2014 - 21:35:58 ---A- . (...) -- C:\Windows\win.ini [713]
~ Files: 48 Legitimates Filtered in 00mn 08s

---\\ Operações e funções ao arranque do Windows Explorer (046)
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook [64Bits] - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL
~ ShellExecuteHooks: Scanned in 00mn 00s

---\\ Chave do registo Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{0b43739f-dd0e-11e1-8a84-7c4fb545abd1}\AutoRun\command. (...) -- E:\autorun.exe (.not file.)
O51 - MPSK:{0b4373b1-dd0e-11e1-8a84-7c4fb545abd1}\AutoRun\command. (...) -- E:\autorun.exe (.not file.)
O51 - MPSK:{11a951c8-673c-11e2-8424-7c4fb545abd1}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{17ba38c2-3903-11e3-ad2a-00235a7456d2}\AutoRun\command. (...) -- E:\Install.exe (.not file.)
O51 - MPSK:{1c6758cd-30ef-11e2-8309-00235a7456d2}\AutoRun\command. (...) -- E:\Install.exe (.not file.)
O51 - MPSK:{25e9e1c2-6d2e-11e2-bc58-7c4fb545abd1}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{448485cc-6701-11e2-a830-7c4fb545abd1}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{448485d5-6701-11e2-a830-7c4fb545abd1}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{50624ea6-9812-11e3-b28b-7c4fb545abd1}\AutoRun\command. (...) -- G:\LGAutoRun.exe (.not file.)
O51 - MPSK:{5f7c1ebc-c7a3-11e1-abfd-806e6f6e6963}\AutoRun\command. (...) -- D:\Quimica.exe (.not file.)
O51 - MPSK:{6a0613a9-d817-11e1-8fe2-7c4fb545abd1}\AutoRun\command. (...) -- E:\Install.exe (.not file.)
O51 - MPSK:{72cfdb1f-0721-11e2-96cb-7c4fb545abd1}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{72cfdb24-0721-11e2-96cb-7c4fb545abd1}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{8a2a6cf3-3711-11e2-ba67-7c4fb545abd1}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{acbab489-01f0-11e2-bb09-00235a7456d2}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{acbab48d-01f0-11e2-bb09-00235a7456d2}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{d36bd742-c90c-11e1-975d-7c4fb545abd1}\AutoRun\command. (...) -- E:\Windows\AutoRun.exe (.not file.)
O51 - MPSK:{d6ff78a8-01d6-11e2-b8dd-7c4fb545abd1}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
O51 - MPSK:{d6ff78b3-01d6-11e2-b8dd-00235a7456d2}\AutoRun\command. (...) -- E:\AutoRun.exe (.not file.)
~ Keys: Scanned in 00mn 00s

---\\ Pesquisa de infeções nos drivers (HKLM)(TDSD) (O52)
O52 - TDSD: \Drivers32\"VIDC.LAGS"="lagarith.dll" . (...) -- C:\Windows\System32\lagarith.dll
O52 - TDSD: \drivers.desc\"lagarith.dll"="Lagarith lossless codec [LAGS]" . (...) -- C:\Windows\System32\lagarith.dll
~ TDSD: 4 Legitimates Filtered in 00mn 00s

---\\ Enumeração das chaves do registo PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorUser"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 18 Legitimates Filtered in 00mn 00s

---\\ Enumeração das chaves do registo PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s

---\\ Lista dos drivers do sistema (SDL) (O58)
O58 - SDL:17/01/2013 - 21:07:36 R--A- . (.360.cn - 360HipsOEM.) -- C:\Windows\System32\Drivers\360FltOEM.sys [288688]
O58 - SDL:09/11/2009 - 11:22:46 ---A- . (.Haier Inc. - USB/Serial Device Driver.) -- C:\Windows\System32\Drivers\3GDatausbser64.sys [120832]
O58 - SDL:13/07/2009 - 22:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:26/06/2009 - 15:43:42 ---A- . (.Windows (R) Win 7 DDK provider - Embedded System Control.) -- C:\Windows\System32\Drivers\EMSC.sys [16752]
O58 - SDL:10/06/2009 - 17:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:26/03/2011 - 10:37:12 ---A- . (.MBB Incorporated - CDROM Filter.) -- C:\Windows\System32\Drivers\massfilter.sys [11776]
O58 - SDL:13/07/2009 - 22:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
O58 - SDL:09/04/2014 - 22:21:02 ---A- . (.The OpenVPN Project - TAP-Win32 Virtual Network Driver.) -- C:\Windows\System32\Drivers\tap0901.sys [38216]
O58 - SDL:18/03/2013 - 16:51:08 ---A- . (.Apple, Inc. - Apple Mobile Device USB Driver.) -- C:\Windows\System32\Drivers\usbaapl64.sys [54784]
O58 - SDL:24/04/2014 - 12:23:46 ---A- . (.StdLib - StdLib.) -- C:\Windows\System32\Drivers\{42e50651-9669-456e-9081-d5a836274274}w64.sys [61112] =>PUP.LinkiDoo
O58 - SDL:26/06/2009 - 15:43:42 ---A- . (.Windows (R) Win 7 DDK provider - Embedded System Control.) -- C:\Windows\SysWOW64\drivers\EMSC.sys [13680]
~ Drivers: 85 Legitimates Filtered in 00mn 08s

---\\ Lista das ferramentas de remoção de vírus (LAT) (063)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s

---\\ Lista dos serviços Legacy du registo (064)
O64 - Services: CurCS - 24/04/2014 - C:\Windows\System32\drivers\{42e50651-9669-456e-9081-d5a836274274}w64.sys ({42e50651-9669-456e-9081-d5a836274274}w64) .(.StdLib - StdLib.) - LEGACY_{42E50651-9669-456E-9081-D5A836274274}W64 =>PUP.LinkiDoo
~ Legacy: 90 Legitimates Filtered in 00mn 00s

---\\ Menu de inicialização Internet (068)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\Aleluia\AppData\Local\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s

---\\ Pesquisa de infeção nos navegadores da Internet (SBI) (069)
O69 - SBI: SearchScopes [HKCU] Web - (Web) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} [DefaultScope] - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Keys: Scanned in 00mn 00s

---\\ Pesquisa adicional à raiz do sistema (radicular) (SPRF) (O84)
[MD5.3423CE16DA5F241E49F8999E835300FD] [SPRF][10/06/2012] (.Por Marcelo Ribeiro de Oliveira - 20/05/201 - A Bíblia Sagrada Versão Digital 6.7 Freeware Setup.) -- C:\Users\Aleluia\Desktop\ABSVD67Setup.exe [2205098]
[MD5.6A23617835EBFC0999582E5D6700E9B3] [SPRF][02/02/2013] (.TagSoft - TagComércio.) -- C:\Users\Aleluia\Desktop\store_free.exe [6241822]
~ Files: 2 Legitimates Filtered in 00mn 00s

---\\ Listagem dos códigos dos software (PUC) (090)
O90 - PUC: "8B501B6E56F182443979D1DFA8309BD4" . (.SupraSavings.) -- c:\Windows\Installer\{E6B105B8-1F65-4428-9397-1DFD8A03B94D}\icon64.ico =>PUP.SupraSavings
~ Update Products: 1 Legitimates Filtered in 00mn 00s

---\\ Pesquisa dos pacotes WindowsInstaller (WIS) (O93) (NTFS)
[MD5.9D0767859EE938C0C4FAC30693109843] [WIS][07/05/2014] (.SupraSavings - SupraSavings.) -- C:\Windows\Installer\5dd964.msi [3162112] =>PUP.SupraSavings
~ WIS: 1 Legitimates Filtered in 00mn 05s

---\\ Search Tracing Registry Key (O100)
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\biclient_RASAPI32 =>Adware.MegaSearch
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\biclient_RASMANCS =>Adware.MegaSearch
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\FindRight_RASAPI32 =>Hijacker.FindrToolbar
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\FindRight_RASMANCS =>Hijacker.FindrToolbar
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\updateFindRight_RASAPI32 =>Hijacker.FindrToolbar
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\updateFindRight_RASMANCS =>Hijacker.FindrToolbar
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\utilFindRight_RASAPI32 =>Hijacker.FindrToolbar
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\utilFindRight_RASMANCS =>Hijacker.FindrToolbar
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\WajamInternetEnhancer_RASAPI32 =>PUP.Wajam
HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\WajamInternetEnhancer_RASMANCS =>PUP.Wajam
~ BTK: 238 Legitimates Filtered in 00mn 00s

---\\ Estado general dos serviços não Microsoft (EGS) (SR=Executados, SS=Parados)
SS - | Auto 23/12/2012 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 23/12/2012 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 22/10/2004 73728 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
SS - | Auto 10/07/1658 0 | (KMService) . (...) - C:\Windows\system32\srvany.exe =>Hijacker.Office
SS - | Auto 02/05/2014 97112 | (ProtectMonitor) . (...) - C:\Program Files\PCDApp\StartHelp.exe =>Trojan.BitCoinMiner
SS - | Demand 13/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SS - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 18/12/2013 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 07/01/2014 43336 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 30/08/2011 462184 | (Bonjour Service) . (.Apple Inc..) - C:\Program Files\Bonjour\mDNSResponder.exe
SR - | Auto 22/10/2010 953632 | (btwdins) . (.Broadcom Corporation..) - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
SR - | Demand 13/07/2009 27136 | C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll (hpqcxs08) . (.Hewlett-Packard Co..) - C:\Windows\System32\svchost.exe
SR - | Auto 13/07/2009 27136 | C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll (hpqddsvc) . (.Hewlett-Packard Co..) - C:\Windows\System32\svchost.exe
SR - | Auto 14/03/2011 346976 | (HWDeviceService64.exe) . (...) - C:\ProgramData\DatacardService\HWDeviceService64.exe
SR - | Auto 05/11/2010 13336 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
SR - | Demand 06/02/2014 641352 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SR - | Auto 11/03/2014 23808 | (MsMpSvc) . (.Microsoft Corporation.) - c:\Program Files\Microsoft Security Client\MsMpEng.exe
SR - | Auto 20/07/2012 8186368 | (MySQL) . (...) - C:\MySQL\bin\mysqld.exe
SR - | Auto 13/07/2009 27136 | C:\Windows\system32\HPZinw12.dll (Net Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe
SR - | Auto 20/04/2010 27040 | (OrolixDeviceMonitor) . (.Orolix Desenvolvimento de Software LTDA..) - C:\Program Files (x86)\TIM Communicator\module\devicemon.exe
SR - | Auto 13/07/2009 27136 | C:\Windows\system32\HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe
SR - | Auto 01/11/2011 270672 | (UI Assistant Service) . (...) - C:\Program Files (x86)\Connection Manager\AssistantServices.exe
SR - | Auto 15/10/2013 48128 | (wltrysvc) . (.Broadcom Corporation.) - C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRYSVC.exe
SR - | Auto 13/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 07s

---\\ Scâner Aditional (088)
Database Version : 13045 - (08/05/2014)
Clés trouvées (Keys found) : 10
Valeurs trouvées (Values found) : 1
Dossiers trouvés (Folders found) : 2
Fichiers trouvés (Files found) : 7

[HKLM\SYSTEM\CurrentControlSet\Services\KMService] =>Hijacker.Office^
[HKLM\SYSTEM\CurrentControlSet\Services\ProtectMonitor] =>Trojan.BitCoinMiner^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\FindRight] =>Hijacker.FindrToolbar^
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\lollipop_04271637] =>Adware.Lollipop^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\PCData App] =>Trojan.BitCoinMiner^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E6B105B8-1F65-4428-9397-1DFD8A03B94D}] =>PUP.SupraSavings^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\webssearches uninstaller] =>Hijacker.WebsSearches^
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375] =>PUP.Tarma
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5] =>PUP.Tarma
[HKLM\Software\Wow6432Node\360Safe] =>Trojan.Lozavita
C:\Program Files (x86)\Baidu Security =>Adware.BDSearch^
C:\ProgramData\Baidu Security =>Adware.BDSearch^
[HKCU\Software\Baidu Security] =>Adware.BDSearch^
[HKCU\Software\FindRight] =>Hijacker.FindrToolbar^
[HKLM\Software\Baidu Security] =>Adware.BDSearch^
[HKLM\Software\Wow6432Node\Baidu Security] =>Adware.BDSearch^
[HKLM\Software\Wow6432Node\FindRight] =>Hijacker.FindrToolbar^
C:\Windows\Installer\5dd964.msi =>PUP.SupraSavings^
C:\Users\Aleluia\Downloads\SaveAs.exe =>PUP.Offerware
~ Additionnel Scan: 290829 Items scanned in 00mn 23s

---\\ Sumário das deteções encontradas na sua estação
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Hijacker.Proxy
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Adware.Lollipop
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Hijacker.Office
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Trojan.BitCoinMiner
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.LinkiDoo
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Hijacker.FindrToolbar
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.SupraSavings
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Hijacker.WebsSearches
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Adware.BDSearch
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Trojan.Lozavita
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Adware.MegaSearch
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Wajam
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Tarma
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.Offerware
~ MSI: 14 link(s) detected in 00mn 00s

~ 808 Legitimates filtered by white list
End of the scan (602 lines in 01mn 38s)(0)

por **Power Max** Qui 08 maio 2014, 13:24

Há programas desnecessários iniciando junto com o Windows, o que torna o seu PC mais lento. Para corrigir isto, siga as dicas deste tutorial:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

De preferência deixe apenas os programas de segurança (anti-vírus/anti-spywares/firewall) iniciarem junto com o Windows.

Use também o programa Ccleaner, indicado neste tutorial acima, para fazer uma limpeza e otimização do PC agora e de tempos em tempos.
________________________________________________________________________________________________________

Certificado 772309

Selecione e copie todo o texto destacado em vermelho que te passei.
_____________________________________________________________________________________________________________

Certificado 772309

Vá no menu: Iniciar > Todos os programas > ZHP > Clique com o botão direito do mouse sobre o Zhpfix e escolha a opção de Executar como administrador > Clique em Importação > Clique no botão GO > Clique em Oui > Caso queira que os arquivos da lixeira sejam excluídos clique em Oui novamente > Um relatório aparecerá no bloco de notas.

Copie este relatório e poste em sua próxima resposta.

por saraapereira1 Qui 08 maio 2014, 18:19

Rapport de ZHPFix 2014.4.13.3 par Nicolas Coolman, Update du 13/04/2014
Fichier d'export Registre :
Run by Aleluia at 08/05/2014 18:18:03
High Elevated Privileges : OK
Windows 7 Home Basic Edition, 64-bit Service Pack 1 (Build 7601)

Reciclagem vazia (00mn 05s)
Reparação de atalhos do navegador

========== Softwares ==========
AUSENTE Uninstall Process: c:\users\aleluia\appdata\roaming\contentexplorer\uninstall.exe
AUSENTE Uninstall Process: c:\program files\pcdapp\uninstaller.exe
ELIMINÉ: SupraSavings
AUSENTE Uninstall Process: c:\users\aleluia\appdata\roaming\webssearches\uninstallmanager.exe

========== Processo memória ==========
ELIMINÉ: Memory Process: C:\Users\Aleluia\Downloads\SaveAs.exe

========== Estado dos serviços ==========
{42E50651-9669-456E-9081-D5A836274274}W64 Parado

========== Chaves do Registo ==========
ELIMINÉ Logiciel Key: [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PCData App]
ELIMINÉ Logiciel Key: [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\webssearches uninstaller]
ELIMINÉ Driver Key: Bfilter
ELIMINÉ Driver Key: Bfmon
ELIMINÉ Driver Key: Bnbase
ELIMINÉ Driver Key: Bndef
ELIMINÉ Driver Key: Bprotect
ELIMINÉ Driver Key: {42e50651-9669-456e-9081-d5a836274274}w64
ELIMINÉ: HKCU\Software\Baidu Security
ELIMINÉ: HKCU\Software\FindRight
ELIMINÉ: HKCU\Software\PCDataApp
ELIMINÉ:* HKLM\Software\Baidu Security
ELIMINÉ: HKLM\Software\Wow6432Node\360Safe
ELIMINÉ: HKLM\Software\Wow6432Node\FindRight
ELIMINÉ: HKLM\Software\Wow6432Node\PCDataApp
ELIMINÉ CLSID MPSK: {0b43739f-dd0e-11e1-8a84-7c4fb545abd1}
ELIMINÉ CLSID MPSK: {0b4373b1-dd0e-11e1-8a84-7c4fb545abd1}
ELIMINÉ CLSID MPSK: {11a951c8-673c-11e2-8424-7c4fb545abd1}
ELIMINÉ CLSID MPSK: {17ba38c2-3903-11e3-ad2a-00235a7456d2}
ELIMINÉ CLSID MPSK: {1c6758cd-30ef-11e2-8309-00235a7456d2}
ELIMINÉ CLSID MPSK: {25e9e1c2-6d2e-11e2-bc58-7c4fb545abd1}
ELIMINÉ CLSID MPSK: {448485cc-6701-11e2-a830-7c4fb545abd1}
ELIMINÉ CLSID MPSK: {448485d5-6701-11e2-a830-7c4fb545abd1}
ELIMINÉ CLSID MPSK: {50624ea6-9812-11e3-b28b-7c4fb545abd1}
ELIMINÉ CLSID MPSK: {5f7c1ebc-c7a3-11e1-abfd-806e6f6e6963}
ELIMINÉ CLSID MPSK: {6a0613a9-d817-11e1-8fe2-7c4fb545abd1}
ELIMINÉ CLSID MPSK: {72cfdb1f-0721-11e2-96cb-7c4fb545abd1}
ELIMINÉ CLSID MPSK: {72cfdb24-0721-11e2-96cb-7c4fb545abd1}
ELIMINÉ CLSID MPSK: {8a2a6cf3-3711-11e2-ba67-7c4fb545abd1}
ELIMINÉ CLSID MPSK: {acbab489-01f0-11e2-bb09-00235a7456d2}
ELIMINÉ CLSID MPSK: {acbab48d-01f0-11e2-bb09-00235a7456d2}
ELIMINÉ CLSID MPSK: {d36bd742-c90c-11e1-975d-7c4fb545abd1}
ELIMINÉ CLSID MPSK: {d6ff78a8-01d6-11e2-b8dd-7c4fb545abd1}
ELIMINÉ CLSID MPSK: {d6ff78b3-01d6-11e2-b8dd-00235a7456d2}
ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\biclient_RASAPI32
ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\biclient_RASMANCS
ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\FindRight_RASAPI32
ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\FindRight_RASMANCS
ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\updateFindRight_RASAPI32
ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\updateFindRight_RASMANCS
ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\utilFindRight_RASAPI32
ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\utilFindRight_RASMANCS
ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\WajamInternetEnhancer_RASAPI32
ELIMINÉ: HKLM\SOFTWARE\Wow6432Node\Microsoft\Tracing\WajamInternetEnhancer_RASMANCS
ELIMINÉ: Service: Bonjour Service
ELIMINÉ:* HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\FindRight
ELIMINÉ: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\lollipop_04271637
ELIMINÉ:* HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375
ELIMINÉ:* HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5

========== Valores do Registo ==========
ELIMINÉ RunValue: HW_OPENEYE_OUC_Claro
ELIMINÉ RunValue: PSafeTray
ELIMINÉ RunValue: PSafeWDS
ProxyFix : Configuração proxy removida com sucesso
ELIMINÉ ProxyServer Value
ELIMINÉ ProxyEnable Value
ELIMINÉ EnableHttp1_1 Value
ELIMINÉ ProxyHttp1.1 Value
ELIMINÉ ProxyOverride Value

========== Elementos dos dados do Registo ==========
ELIMINÉ: R1 Search Page =

========== Pastas ==========
Nenhuma pasta CLSID local utilizador vazia

========== Ficheiros ==========
ELIMINÉ: c:\users\aleluia\appdata\roaming\microsoft\windows\start menu\programs\startup\lollipop_04261722.lnk
ELIMINA REINICIAR: c:\windows\system32\drivers\{42e50651-9669-456e-9081-d5a836274274}w64.sys
ELIMINA REINICIAR: c:\program files\bonjour\mdnsresponder.exe
ELIMINÉ Temporários windows (128) (1.895.408 octets)
ELIMINÉ Flash Cookies (0) (0 octets)

========== Tarefa planificada ==========
ELIMINÉ: {0B184303-EB93-42E4-89F1-74BAB04A7AEF}
ELIMINÉ: {3A36A9F9-4038-49AA-9E36-7E581F19B867}
ELIMINÉ: {65F9BF8D-734C-437B-BD5D-D75941EC8252}
ELIMINÉ: {945E0D26-4B88-4D41-9400-7783E1BB9438}

========== Restauração Sistema ==========
Ponto de restauro do sistema criado com sucesso

========== Recapitulativo ==========
1 : Processo memória
49 : Chaves do Registo
9 : Valores do Registo
1 : Elementos dos dados do Registo
1 : Pastas
5 : Ficheiros
4 : Softwares
1 : Estado dos serviços
4 : Tarefa planificada
1 : Restauração Sistema

End of clean in 02mn 08s

========== Caminho do ficheiro do relatório ==========
C:\Users\Aleluia\AppData\Roaming\ZHP\ZHPFix[R1].txt - 08/05/2014 18:18:09

por **Power Max** Qui 08 maio 2014, 18:24

Abra novamente o ( ZHPDiag )

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Clique "SEARCH" ou "PESQUISAR" e aguarde a conclusão.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Clique OK e, ao concluir, poste o relatório ZHPDiag.txt

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

por saraapereira1 Qui 08 maio 2014, 18:30

~ Relatório do ZHPDiag v2014.5.8.57 - Nicolas Coolman (08/05/2014)
~ Iniciado por Aleluia (08/05/2014 18:27:22)
~ Endereço do Website : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Fóruns de suporte gratuito para desinfecção : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Tradução pelo utilizador
~ Estatuto da versão :
~ Lista Branca : Ativado pelo programa
~ Elevação dos Privilégios : OK
~ Controle de Conta de Utilizador : Deactivate by user

---\\ Navegadores Internet
MSIE: Internet Explorer v11.0.9600.17105
GCIE: Google Chrome v34.0.1847.131 (Defaut)

---\\ Informações sobre os produtos Windows
~ Langage: Portugais
Windows 7 Home Basic, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
Software Protection Service (Protection logicielle) : OK
Key Management Service client information : KO
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ Softwares de proteçao do sistema
Microsoft Security Client PT-BR Language Pack v2.1.1116.0
Windows Defender W7

---\\ Softwares d'optimização do sistema

---\\ Softwares de partilha do PeerToPeer (P2P)

---\\ Monitoramento dos softwares
Adobe Flash Player 10 ActiveX
Adobe Reader X

---\\ Informações sobre o sistema
~ Processor: Intel64 Family 6 Model 37 Stepping 5, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3765 MB (56% free)
System Restore: Activé (Enable)
System drive C: has 370 GB (80%) free of 461 GB

---\\ Modo de conexão ao sistema
~ Computer Name: ALELUIA-TECNO
~ User Name: Aleluia
~ All Users Names: Convidado, Aleluia, Administrador,
~ Unselected Option: 045,061,O62,065,066,080,O82,089
Logged in as Administrator

---\\ As variáveis de ambiente
~ System Unit : C:\
~ %AppZHP% : C:\Users\Aleluia\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Aleluia\AppData\Roaming\
~ %Desktop% : C:\Users\Aleluia\Desktop\
~ %Favorites% : C:\Users\Aleluia\Favorites\
~ %LocalAppData% : C:\Users\Aleluia\AppData\Local\
~ %StartMenu% : C:\Users\Aleluia\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumeração das unidades dos discos
C: Hard drive, Flash drive, Thumb drive (Free 370 Go of 461 Go)
D: CD-ROM drive (Not Inserted)
F: Floppy drive, Flash card reader, USB Key (Not Inserted)
Q: Hard drive, Flash drive, Thumb drive (Free 0 Go of 0 Go)

---\\ Estado do Centro de Segurança do Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
~ Security Center: 44 Legitimates Filtered in 00mn 00s

---\\ Pesquisa particular de ficheiros genéricos
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Windows Explorer.) (.25/02/2011 - 03:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Aplicativo de Inicialização do Windows.) (.13/07/2009 - 22:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.F220BA78AB542C70211D73AE4729B2CD] - (.Microsoft Corporation - Internet Extensions para Win32.) (.06/03/2014 - 03:22:40.) -- C:\Windows\System32\wininet.dll [2260480]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Aplicativo de Logon do Windows.) (.21/11/2010 - 00:24:29.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Biblioteca de Licenciamento de Software.) (.21/11/2010 - 00:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.27/09/2013 - 22:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.13/07/2009 - 22:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 20:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 00:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Driver de porta i8042.) (.13/07/2009 - 20:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.13/07/2009 - 21:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.26/04/2011 - 23:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 00:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - Driver do Sistema de Arquivos NT.) (.23/01/2014 - 23:37:55.) -- C:\Windows\system32\Drivers\ntfs.sys [1684928]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Driver de porta paralela.) (.13/07/2009 - 21:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 00:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.13/07/2009 - 21:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 00:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s

---\\ Estatuto dos ficheiros ocultos (Oculto/Total)
~ Mes images (My Pictures) : 2/156
~ Mes musiques (My Musics) : 1/991
~ Mes Videos (My Videos) : 1/78
~ Mes Favoris (My Favorites) : 1/22
~ Mes Documents (My Documents) : 9/1417
~ Mon Bureau (My Desktop) : 4/3843
~ Menu demarrer (Programs) : 1/33
~ Hidden Files: Scanned in 00mn 02s

---\\ Processos lançados
[MD5.349AB4F70E2AC44970894E7F03E1576E] - (.Huawei Technologies Co., Ltd. - DataCardMonitor MFC Application.) -- C:\ProgramData\DatacardService\DCSHelper.exe [236384] [PID.1600]
[MD5.C948AC73822CA662CF44185B909EA18B] - (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.exe [720064] [PID.2804]
[MD5.70EA13A41C0D9D31343EC203A629F801] - (.Ares Development Group - Ares p2p for windows.) -- C:\Program Files (x86)\Ares\Ares.exe [3209216] [PID.2844]
[MD5.B54921381A950C8215FB363B485C432B] - (.Hewlett-Packard Co. - HP Digital Imaging Monitor.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [270336] [PID.3036]
[MD5.4BF3C4F9327BB33190603829C9F5E781] - (.Facebook - Facebook Messenger.) -- C:\Users\Aleluia\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe [248240] [PID.3064]
[MD5.51138BEEA3E2C21EC44D0932C71762A8] - (...) -- ysWOW64\RunDll32.exe [0] [PID.2104]
[MD5.4A73AB8412D3AA6CFAD24051FF9DBFA7] - (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160] [PID.3264]
[MD5.11947F50905DC85A44FE2B409857413B] - (.No owner - LockKey.) -- C:\Program Files (x86)\LockKey\LockKey.exe [801392] [PID.3620]
[MD5.A73731A0B0A165907799E9AFB461F856] - (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [296096] [PID.3696]
[MD5.C637FC4638A96165256B28D38DE7B953] - (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208] [PID.3780]
[MD5.2894C8A3A3F7B18F53262CDEB1F7DF8E] - (...) -- C:\Program Files (x86)\Connection Manager\UIexec.exe [153424] [PID.3808]
[MD5.B4E6C1B28AF8806008CB654C716ABAFA] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392] [PID.3840]
[MD5.F16EEA6CCA9D8A7D1193AE80E43FBBC7] - (.Hewlett-Packard Co. - HP CUE Status Root.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe [168960] [PID.4340]
[MD5.8A9FACCB684500829F7D0BCC67B386CC] - (.Hewlett-Packard Co. - HP CUE Alert Popup Window Objects.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe [559104] [PID.4940]
[MD5.883008A9B5BFF94A153D99DBA54CB5C1] - (.Hewlett-Packard - GPCore COM object.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe [362496] [PID.5136]
[MD5.542459D16B416D054161007FC9B1246E] - (.Google Inc. - Google Chrome.) -- C:\Users\Aleluia\AppData\Local\Google\Chrome\Application\chrome.exe [841032] [PID.4252]
[MD5.CCD09CA21C1946AF24834512BD9A6FCA] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [7873536] [PID.5080]
[MD5.B362181ED3771DC03B4141927C80F801] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65432] [PID.1632]
[MD5.F518545E5B7623AD49ABE7F8776EFA46] - (.Apple Inc. - YSLoader.exe.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [43336] [PID.1764]
[MD5.47EFDB5472E76B4FC91259FC4B3B659A] - (...) -- C:\MySQL\bin\mysqld.exe [8186368] [PID.1776]
[MD5.EA83547B253F5FEFC870DD0D04737EC2] - (.Orolix Desenvolvimento de Software LTDA. - USB Device monitor.) -- C:\Program Files (x86)\TIM Communicator\module\devicemon.exe [27040] [PID.2072]
[MD5.7E6B107120108B3A15BFECE0DE3201DB] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler.exe [228744] [PID.2264]
[MD5.39B1D0A636A400304565D4521FAD6D77] - (.Microsoft Corporation - Microsoft Application Virtualization Virtua.) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [207528] [PID.3432]
[MD5.BE463B423C33C038ADCE0EDB6C2FD208] - (...) -- C:\Program Files (x86)\Connection Manager\AssistantServices.exe [270672] [PID.3516]
[MD5.77C5A741A7452812F278EF2C18478862] - (.Microsoft Corporation - Microsoft Application Virtualization Client.) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [523944] [PID.408]
[MD5.FD557A50A65E44041CD2FCEF4BEB04DB] - (.Microsoft Corporation - Microsoft Office Client Virtualization Serv.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.exe [822504] [PID.3272]
[MD5.8FFF9083252C16FE3960173722605E9E] - (.Intel Corporation - IAStorDataSvc.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [13336] [PID.3328]
~ Processes Running: Scanned in 00mn 01s

---\\ Google Chrome, Arranque,Pesquisa,Extensões (G0,G1,G2)
C:\Users\Aleluia\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [ahfgeienlihckogmohjhadlkjgocpleb] Loja v.0.2 (Activé)
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)

---\\ Pasta de extensão do Google Chrome
~ Google Lines Browser: 10 Legitimates Filtered in 00mn 00s

---\\ Internet Explorer, Gestão do Proxy (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s

---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s

---\\ Redireção do ficheiro Hosts (01)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21

---\\ Aplicações iniciadas por registo & pastas (04)
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gerenciador de áudio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe (.not file.)
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] . (.Broadcom Corporation - Broadcom 802.11 Network Adapter Wireless Ne.) -- C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.exe
O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Google Installer.) -- C:\Users\Aleluia\AppData\Local\Google\Update\GoogleUpdate.exe
O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Facebook Installer.) -- C:\Users\Aleluia\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKCU\..\Run: [OfficeSyncProcess] . (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.exe
O4 - HKCU\..\Run: [ares] . (.Ares Development Group - Ares p2p for windows.) -- C:\Program Files (x86)\Ares\Ares.exe
O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_DBDF8A44B2E2569C1DC03EE3E53DB07D] . (.Google Inc. - Google Chrome.) -- C:\Users\Aleluia\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - HKLM\..\Wow6432Node\Run: [IAStorIcon] . (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Wow6432Node\Run: [LockKey] . (.No owner - LockKey.) -- C:\Program Files (x86)\LockKey\LockKey.exe
O4 - HKLM\..\Wow6432Node\Run: [WSED] . (.TODO: - TODO: .) -- C:\Program Files (x86)\WSED\WSED.exe
O4 - HKLM\..\Wow6432Node\Run: [BCSSync] . (.Microsoft Corporation - Microsoft Office 2010 component.) -- C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe =>.Microsoft Corporation
O4 - HKLM\..\Wow6432Node\Run: [hpqSRMon] . (.Hewlett-Packard - HpqSRmon.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Wow6432Node\Run: [TkBellExe] . (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe =>.RealNetworks, Inc
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe =>.Hewlett-Packard Co
O4 - HKLM\..\Wow6432Node\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
O4 - HKLM\..\Wow6432Node\Run: [UIExec] . (...) -- C:\Program Files (x86)\Connection Manager\UIexec.exe
O4 - HKLM\..\Wow6432Node\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [Google Update] . (.Google Inc. - Google Installer.) -- C:\Users\Aleluia\AppData\Local\Google\Update\GoogleUpdate.exe
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [Facebook Update] . (.Facebook Inc. - Facebook Installer.) -- C:\Users\Aleluia\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [OfficeSyncProcess] . (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.exe
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [ares] . (.Ares Development Group - Ares p2p for windows.) -- C:\Program Files (x86)\Ares\Ares.exe
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [GoogleChromeAutoLaunch_DBDF8A44B2E2569C1DC03EE3E53DB07D] . (.Google Inc. - Google Chrome.) -- C:\Users\Aleluia\AppData\Local\Google\Chrome\Application\chrome.exe
~ Application: Scanned in 00mn 00s

---\\ Boutões da barra de ferramentas principal do Internet Explorer (09)
O9 - Extra button: &Enviar para o OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\MICROS~3\Office14\ONBttnIE.dll =>.Microsoft Corporation
O9 - Extra button: &Anotações Vinculadas do OneNote [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\MICROS~3\Office14\ONBTTN~1.dll =>.Microsoft Corporation
O9 - Extra button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 [64Bits] - {CCA281CA-C863-46ef-9331-5C8D4460577F} . (...) -- C:\Program Files\WIDCOMM\Bluetooth Software\bt_hot_icon.ico
~ IE Extra Buttons: Scanned in 00mn 00s

---\\ Alteração Dominio/Clientes DNS (017)
O17 - HKLM\System\CCS\Services\Tcpip\..\{680AC1A4-4A09-49E5-8715-D03BD9079B39}: NameServer = 200.169.117.221 200.169.117.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{94F6B527-2087-4EA1-A9A3-A150221EB843}: DhcpNameServer = 172.20.10.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{9664848F-5400-4A33-A0F6-CF9F732C12E8}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{ED4402BF-608D-42FB-98E7-491F904B860E}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{F675FB36-63BE-4C55-BE56-01A77E6B84A7}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CS1\Services\Tcpip\..\{680AC1A4-4A09-49E5-8715-D03BD9079B39}: NameServer = 200.169.117.221 200.169.117.222
O17 - HKLM\System\CS1\Services\Tcpip\..\{94F6B527-2087-4EA1-A9A3-A150221EB843}: DhcpNameServer = 172.20.10.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{9664848F-5400-4A33-A0F6-CF9F732C12E8}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{ED4402BF-608D-42FB-98E7-491F904B860E}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{F675FB36-63BE-4C55-BE56-01A77E6B84A7}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CS2\Services\Tcpip\..\{680AC1A4-4A09-49E5-8715-D03BD9079B39}: NameServer = 200.169.117.221 200.169.117.222
O17 - HKLM\System\CS2\Services\Tcpip\..\{94F6B527-2087-4EA1-A9A3-A150221EB843}: DhcpNameServer = 172.20.10.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{9664848F-5400-4A33-A0F6-CF9F732C12E8}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{ED4402BF-608D-42FB-98E7-491F904B860E}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{F675FB36-63BE-4C55-BE56-01A77E6B84A7}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
~ Domain: Scanned in 00mn 00s

---\\ Protocolo adicional (018)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s

---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s

---\\ Lista dos serviços NT não Microsoft e não desativados (023)
O23 - Service: HWDeviceService64.exe (HWDeviceService64.exe) . (.No owner - DCSHOST.) - C:\ProgramData\DatacardService\HWDeviceService64.exe
O23 - Service: KMService (KMService) . (...) - C:\Windows\SysWOW64\srvany.exe =>Hijacker.Office
O23 - Service: MySQL (MySQL) . (...) - C:\MySQL\bin\mysqld.exe
O23 - Service: Orolix Device Monitor (OrolixDeviceMonitor) . (.Orolix Desenvolvimento de Software LTDA. - USB Device monitor.) - C:\Program Files (x86)\TIM Communicator\module\devicemon.exe
~ Services: 11 Legitimates Filtered in 00mn 03s

---\\ Tarefas planificadas automaticamente (039)
O39 - APT: - (..) -- C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1798105164-1853435045-4239063915-1000Core [914]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1798105164-1853435045-4239063915-1000UA [936]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore [1066]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA [1070]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1798105164-1853435045-4239063915-1000Core [1034]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1798105164-1853435045-4239063915-1000UA [1086]
~ Scheduled Task: 15 Legitimates Filtered in 00mn 03s

---\\ Drivers lançados ao arranque do sistema (041)
O41 - Driver: (Bfilter) . (. - .) - C:\Windows\system32\drivers\Bfilter.sys (.not file.)
O41 - Driver: (Bfmon) . (. - .) - C:\Windows\system32\drivers\Bfmon.sys (.not file.)
O41 - Driver: (Bnbase) . (. - .) - C:\Windows\System32\drivers\bnbasex64.sys (.not file.)
O41 - Driver: (Bndef) . (. - .) - C:\Windows\system32\drivers\bndef64.sys (.not file.)
O41 - Driver: (Bprotect) . (. - .) - C:\Windows\system32\drivers\Bprotect.sys (.not file.)
O41 - Driver: ({42e50651-9669-456e-9081-d5a836274274}w64) . (.StdLib - StdLib.) - C:\Windows\System32\drivers\{42e50651-9669-456e-9081-d5a836274274}w64.sys =>PUP.LinkiDoo
~ Drivers: 66 Legitimates Filtered in 00mn 00s

---\\ Software instalados (042)
O42 - Logiciel: A Bíblia Sagrada Versão Digital 6.7 Freeware - (.Por Marcelo Ribeiro de Oliveira - 20/05/2010.) [HKLM][64Bits] -- A Bíblia Sagrada Versão Digital 6.7 Freeware_is1
O42 - Logiciel: Ares 2.1.8 - (.Ares Development Group.) [HKLM][64Bits] -- Ares
O42 - Logiciel: Biblia Eletrônica 3.6.4 - (.RkSoft Softwares Ltda.) [HKLM][64Bits] -- Biblia Eletrônica_is1
O42 - Logiciel: Claro 3G - (...) [HKLM][64Bits] -- {93D34EE3-99B3-4DB1-8B0A-0A657466F90D}
O42 - Logiciel: LockKey - (...) [HKLM][64Bits] -- InstallShield_{AF192694-4B15-4AC1-92F3-1B02E98C08BD}
O42 - Logiciel: Mundo Bíblico - (.Ideias Sem Fim.) [HKLM][64Bits] -- {FAD8C014-4637-45F3-BD56-285A90F39D36}_is1
O42 - Logiciel: TIM Communicator - (...) [HKLM][64Bits] -- OrolixCommunicator
O42 - Logiciel: TIMWEB.exe - (...) [HKLM][64Bits] -- lcgsm_is1
~ Logic: 32 Legitimates Filtered in 00mn 00s

---\\ HKCU & HKLM Software Keys
[HKCU\Software\Ares]
[HKCU\Software\DefaultPackStatus]
[HKCU\Software\OrolixCommunicator]
[HKCU\Software\Orolix]
[HKCU\Software\RkSoft]
[HKLM\Software\Wow6432Node\Claro 3G]
[HKLM\Software\Wow6432Node\LockKey]
[HKLM\Software\Wow6432Node\Orolix]
[HKLM\Software\Wow6432Node\Program DJ]
[HKLM\Software\Wow6432Node\RkSoft]
[HKLM\Software\Wow6432Node\USBDriverFlag]
[HKLM\Software\Wow6432Node\WSED]
~ Key Software: 244 Legitimates Filtered in 00mn 00s

---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 27/09/2012 - 19:37:59 - [] ----D C:\Program Files (x86)\Ares
O43 - CFD: 26/01/2013 - 20:55:46 - [] ----D C:\Program Files (x86)\Claro 3G
O43 - CFD: 08/05/2012 - 08:33:22 - [] ----D C:\Program Files (x86)\LockKey
O43 - CFD: 14/01/2013 - 08:36:17 - [] ----D C:\Program Files (x86)\MundoBiblico
O43 - CFD: 08/11/2012 - 11:43:00 - [] ----D C:\Program Files (x86)\RkSoft
O43 - CFD: 25/11/2012 - 12:25:09 - [] ----D C:\Program Files (x86)\TIM
O43 - CFD: 20/02/2014 - 16:34:02 - [] ----D C:\Program Files (x86)\TIM Communicator
O43 - CFD: 09/07/2013 - 11:32:40 - [0] ----D C:\Program Files (x86)\VIVO ZAP
O43 - CFD: 08/05/2012 - 08:34:13 - [] ----D C:\Program Files (x86)\WSED
O43 - CFD: 20/02/2014 - 16:34:02 - [] ----D C:\ProgramData\OrolixCommunicator
O43 - CFD: 27/12/2012 - 15:16:00 - [] ----D C:\ProgramData\Softouch
O43 - CFD: 08/05/2012 - 08:35:26 - [] ----D C:\ProgramData\Win732
O43 - CFD: 08/05/2012 - 08:35:25 - [] ----D C:\ProgramData\Win764
O43 - CFD: 08/05/2012 - 08:34:28 - [] ----D C:\ProgramData\XP32
O43 - CFD: 27/12/2012 - 15:16:00 - [] ----D C:\Users\Aleluia\AppData\Roaming\Softouch
O43 - CFD: 25/11/2012 - 12:25:09 - [] ----D C:\Users\Aleluia\AppData\Roaming\TIM
O43 - CFD: 27/09/2012 - 19:38:01 - [] ----D C:\Users\Aleluia\AppData\Local\Ares
O43 - CFD: 02/02/2013 - 12:15:34 - [] ----D C:\Users\Aleluia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TagSoft
~ Program Folder: 166 Legitimates Filtered in 00mn 00s

---\\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044)
O44 - LFC:[MD5.8E9E3CBA08EC47245B277110835CF305] - 07/05/2014 - 19:23:13 ---A- . (.The OpenVPN Project - TAP-Win32 Virtual Network Driver.) -- C:\Windows\System32\Drivers\tap0901.sys [38216]
O44 - LFC:[MD5.BD3CB5AC7696FD6CB1A850BFE16B6606] - 07/05/2014 - 20:01:38 ---A- . (...) -- C:\Windows\certutil.log [3621]
O44 - LFC:[MD5.C90122A144F8EA6B54D38CEC7B6D70CE] - 07/05/2014 - 22:50:29 ---A- . (...) -- C:\Windows\System32\prfc0416.dat [4119168]
O44 - LFC:[MD5.B20A07B78C51744CCAB95B47550B2C79] - 07/05/2014 - 22:50:29 ---A- . (...) -- C:\Windows\System32\prfh0416.dat [4873824]
O44 - LFC:[MD5.CC7AA7B42CF418FC3D926913490048F8] - 08/05/2014 - 11:36:58 ---A- . (...) -- C:\Windows\zoek-delete.exe [24064]
O44 - LFC:[MD5.C2888827395836BC0B5877BF33A1E4A8] - 08/05/2014 - 12:18:06 ---A- . (...) -- C:\zoek-results.log [20038]
O44 - LFC:[MD5.87FB9899C8FA8F614F8D999C68706051] - 24/04/2014 - 12:23:46 ---A- . (.StdLib - StdLib.) -- C:\Windows\System32\Drivers\{42e50651-9669-456e-9081-d5a836274274}w64.sys [61112] =>PUP.LinkiDoo
O44 - LFC:[MD5.F911578DA931B1ECA46127F7E93F35CB] - 27/04/2014 - 17:10:40 ---A- . (...) -- C:\Windows\unins000.exe [715038]
O44 - LFC:[MD5.1B2B0B7FA7937CD057AA6ED27273EC68] - 27/04/2014 - 17:10:42 ---A- . (...) -- C:\Windows\System32\lagarith.dll [148992]
O44 - LFC:[MD5.28EF5BD32C7E368BDC4C4B0D141CA59B] - 27/04/2014 - 17:10:43 ---A- . (...) -- C:\Windows\unins000.dat [1997]
O44 - LFC:[MD5.D10C62FF24D46105D0C7F2A52204A792] - 27/04/2014 - 21:35:58 ---A- . (...) -- C:\Windows\win.ini [713]
~ Files: 47 Legitimates Filtered in 00mn 06s

---\\ Operações e funções ao arranque do Windows Explorer (046)
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook [64Bits] - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL
~ ShellExecuteHooks: Scanned in 00mn 00s

---\\ Pesquisa de infeções nos drivers (HKLM)(TDSD) (O52)
O52 - TDSD: \Drivers32\"VIDC.LAGS"="lagarith.dll" . (...) -- C:\Windows\System32\lagarith.dll
O52 - TDSD: \drivers.desc\"lagarith.dll"="Lagarith lossless codec [LAGS]" . (...) -- C:\Windows\System32\lagarith.dll
~ TDSD: 4 Legitimates Filtered in 00mn 00s

---\\ Enumeração das chaves do registo PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorUser"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 18 Legitimates Filtered in 00mn 00s

---\\ Enumeração das chaves do registo PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s

---\\ Lista dos drivers do sistema (SDL) (O58)
O58 - SDL:17/01/2013 - 21:07:36 R--A- . (.360.cn - 360HipsOEM.) -- C:\Windows\System32\Drivers\360FltOEM.sys [288688]
O58 - SDL:09/11/2009 - 11:22:46 ---A- . (.Haier Inc. - USB/Serial Device Driver.) -- C:\Windows\System32\Drivers\3GDatausbser64.sys [120832]
O58 - SDL:13/07/2009 - 22:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:26/06/2009 - 15:43:42 ---A- . (.Windows (R) Win 7 DDK provider - Embedded System Control.) -- C:\Windows\System32\Drivers\EMSC.sys [16752]
O58 - SDL:10/06/2009 - 17:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:26/03/2011 - 10:37:12 ---A- . (.MBB Incorporated - CDROM Filter.) -- C:\Windows\System32\Drivers\massfilter.sys [11776]
O58 - SDL:13/07/2009 - 22:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
O58 - SDL:09/04/2014 - 22:21:02 ---A- . (.The OpenVPN Project - TAP-Win32 Virtual Network Driver.) -- C:\Windows\System32\Drivers\tap0901.sys [38216]
O58 - SDL:18/03/2013 - 16:51:08 ---A- . (.Apple, Inc. - Apple Mobile Device USB Driver.) -- C:\Windows\System32\Drivers\usbaapl64.sys [54784]
O58 - SDL:24/04/2014 - 12:23:46 ---A- . (.StdLib - StdLib.) -- C:\Windows\System32\Drivers\{42e50651-9669-456e-9081-d5a836274274}w64.sys [61112] =>PUP.LinkiDoo
O58 - SDL:26/06/2009 - 15:43:42 ---A- . (.Windows (R) Win 7 DDK provider - Embedded System Control.) -- C:\Windows\SysWOW64\drivers\EMSC.sys [13680]
~ Drivers: 85 Legitimates Filtered in 00mn 08s

---\\ Lista das ferramentas de remoção de vírus (LAT) (063)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s

---\\ Menu de inicialização Internet (068)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\Aleluia\AppData\Local\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s

---\\ Pesquisa de infeção nos navegadores da Internet (SBI) (069)
O69 - SBI: SearchScopes [HKCU] Web - (Web) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} [DefaultScope] - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Keys: Scanned in 00mn 00s

---\\ Pesquisa adicional à raiz do sistema (radicular) (SPRF) (O84)
[MD5.3423CE16DA5F241E49F8999E835300FD] [SPRF][10/06/2012] (.Por Marcelo Ribeiro de Oliveira - 20/05/201 - A Bíblia Sagrada Versão Digital 6.7 Freeware Setup.) -- C:\Users\Aleluia\Desktop\ABSVD67Setup.exe [2205098]
[MD5.6A23617835EBFC0999582E5D6700E9B3] [SPRF][02/02/2013] (.TagSoft - TagComércio.) -- C:\Users\Aleluia\Desktop\store_free.exe [6241822]
~ Files: 2 Legitimates Filtered in 00mn 00s

---\\ Estado general dos serviços não Microsoft (EGS) (SR=Executados, SS=Parados)
SS - | Auto 23/12/2012 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 23/12/2012 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 22/10/2004 73728 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
SS - | Auto 10/07/1658 0 | (KMService) . (...) - C:\Windows\system32\srvany.exe =>Hijacker.Office
SS - | Demand 13/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SS - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 18/12/2013 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 07/01/2014 43336 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 22/10/2010 953632 | (btwdins) . (.Broadcom Corporation..) - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
SR - | Demand 13/07/2009 27136 | C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll (hpqcxs08) . (.Hewlett-Packard Co..) - C:\Windows\System32\svchost.exe
SR - | Auto 13/07/2009 27136 | C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll (hpqddsvc) . (.Hewlett-Packard Co..) - C:\Windows\System32\svchost.exe
SR - | Auto 14/03/2011 346976 | (HWDeviceService64.exe) . (...) - C:\ProgramData\DatacardService\HWDeviceService64.exe
SR - | Auto 05/11/2010 13336 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
SR - | Demand 06/02/2014 641352 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SR - | Auto 11/03/2014 23808 | (MsMpSvc) . (.Microsoft Corporation.) - c:\Program Files\Microsoft Security Client\MsMpEng.exe
SR - | Auto 20/07/2012 8186368 | (MySQL) . (...) - C:\MySQL\bin\mysqld.exe
SR - | Auto 13/07/2009 27136 | C:\Windows\system32\HPZinw12.dll (Net Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe
SR - | Auto 20/04/2010 27040 | (OrolixDeviceMonitor) . (.Orolix Desenvolvimento de Software LTDA..) - C:\Program Files (x86)\TIM Communicator\module\devicemon.exe
SR - | Auto 13/07/2009 27136 | C:\Windows\system32\HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe
SR - | Auto 01/11/2011 270672 | (UI Assistant Service) . (...) - C:\Program Files (x86)\Connection Manager\AssistantServices.exe
SR - | Auto 15/10/2013 48128 | (wltrysvc) . (.Broadcom Corporation.) - C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRYSVC.exe
SR - | Auto 13/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 07s

---\\ Scâner Aditional (088)
Database Version : 13045 - (08/05/2014)
Clés trouvées (Keys found) : 1
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 0

[HKLM\SYSTEM\CurrentControlSet\Services\KMService] =>Hijacker.Office^
~ Additionnel Scan: 290146 Items scanned in 00mn 22s

---\\ Sumário das deteções encontradas na sua estação
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Hijacker.Office
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.LinkiDoo
~ MSI: 2 link(s) detected in 00mn 00s

~ 771 Legitimates filtered by white list
End of the scan (483 lines in 01mn 32s)(0)

por saraapereira1 Qui 08 maio 2014, 18:43

~ Relatório do ZHPDiag v2014.5.8.57 - Nicolas Coolman (08/05/2014)
~ Iniciado por Aleluia (08/05/2014 18:27:22)
~ Endereço do Website : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Fóruns de suporte gratuito para desinfecção : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Tradução pelo utilizador
~ Estatuto da versão :
~ Lista Branca : Ativado pelo programa
~ Elevação dos Privilégios : OK
~ Controle de Conta de Utilizador : Deactivate by user

---\\ Navegadores Internet
MSIE: Internet Explorer v11.0.9600.17105
GCIE: Google Chrome v34.0.1847.131 (Defaut)

---\\ Informações sobre os produtos Windows
~ Langage: Portugais
Windows 7 Home Basic, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
Software Protection Service (Protection logicielle) : OK
Key Management Service client information : KO
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ Softwares de proteçao do sistema
Microsoft Security Client PT-BR Language Pack v2.1.1116.0
Windows Defender W7

---\\ Softwares d'optimização do sistema

---\\ Softwares de partilha do PeerToPeer (P2P)

---\\ Monitoramento dos softwares
Adobe Flash Player 10 ActiveX
Adobe Reader X

---\\ Informações sobre o sistema
~ Processor: Intel64 Family 6 Model 37 Stepping 5, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3765 MB (56% free)
System Restore: Activé (Enable)
System drive C: has 370 GB (80%) free of 461 GB

---\\ Modo de conexão ao sistema
~ Computer Name: ALELUIA-TECNO
~ User Name: Aleluia
~ All Users Names: Convidado, Aleluia, Administrador,
~ Unselected Option: 045,061,O62,065,066,080,O82,089
Logged in as Administrator

---\\ As variáveis de ambiente
~ System Unit : C:\
~ %AppZHP% : C:\Users\Aleluia\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Aleluia\AppData\Roaming\
~ %Desktop% : C:\Users\Aleluia\Desktop\
~ %Favorites% : C:\Users\Aleluia\Favorites\
~ %LocalAppData% : C:\Users\Aleluia\AppData\Local\
~ %StartMenu% : C:\Users\Aleluia\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumeração das unidades dos discos
C: Hard drive, Flash drive, Thumb drive (Free 370 Go of 461 Go)
D: CD-ROM drive (Not Inserted)
F: Floppy drive, Flash card reader, USB Key (Not Inserted)
Q: Hard drive, Flash drive, Thumb drive (Free 0 Go of 0 Go)

---\\ Estado do Centro de Segurança do Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
~ Security Center: 44 Legitimates Filtered in 00mn 00s

---\\ Pesquisa particular de ficheiros genéricos
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Windows Explorer.) (.25/02/2011 - 03:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Aplicativo de Inicialização do Windows.) (.13/07/2009 - 22:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.F220BA78AB542C70211D73AE4729B2CD] - (.Microsoft Corporation - Internet Extensions para Win32.) (.06/03/2014 - 03:22:40.) -- C:\Windows\System32\wininet.dll [2260480]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Aplicativo de Logon do Windows.) (.21/11/2010 - 00:24:29.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Biblioteca de Licenciamento de Software.) (.21/11/2010 - 00:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.27/09/2013 - 22:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.13/07/2009 - 22:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 20:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 00:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Driver de porta i8042.) (.13/07/2009 - 20:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.13/07/2009 - 21:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.26/04/2011 - 23:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 00:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - Driver do Sistema de Arquivos NT.) (.23/01/2014 - 23:37:55.) -- C:\Windows\system32\Drivers\ntfs.sys [1684928]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Driver de porta paralela.) (.13/07/2009 - 21:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 00:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.13/07/2009 - 21:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 00:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s

---\\ Estatuto dos ficheiros ocultos (Oculto/Total)
~ Mes images (My Pictures) : 2/156
~ Mes musiques (My Musics) : 1/991
~ Mes Videos (My Videos) : 1/78
~ Mes Favoris (My Favorites) : 1/22
~ Mes Documents (My Documents) : 9/1417
~ Mon Bureau (My Desktop) : 4/3843
~ Menu demarrer (Programs) : 1/33
~ Hidden Files: Scanned in 00mn 02s

---\\ Processos lançados
[MD5.349AB4F70E2AC44970894E7F03E1576E] - (.Huawei Technologies Co., Ltd. - DataCardMonitor MFC Application.) -- C:\ProgramData\DatacardService\DCSHelper.exe [236384] [PID.1600]
[MD5.C948AC73822CA662CF44185B909EA18B] - (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.exe [720064] [PID.2804]
[MD5.70EA13A41C0D9D31343EC203A629F801] - (.Ares Development Group - Ares p2p for windows.) -- C:\Program Files (x86)\Ares\Ares.exe [3209216] [PID.2844]
[MD5.B54921381A950C8215FB363B485C432B] - (.Hewlett-Packard Co. - HP Digital Imaging Monitor.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [270336] [PID.3036]
[MD5.4BF3C4F9327BB33190603829C9F5E781] - (.Facebook - Facebook Messenger.) -- C:\Users\Aleluia\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe [248240] [PID.3064]
[MD5.51138BEEA3E2C21EC44D0932C71762A8] - (...) -- ysWOW64\RunDll32.exe [0] [PID.2104]
[MD5.4A73AB8412D3AA6CFAD24051FF9DBFA7] - (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160] [PID.3264]
[MD5.11947F50905DC85A44FE2B409857413B] - (.No owner - LockKey.) -- C:\Program Files (x86)\LockKey\LockKey.exe [801392] [PID.3620]
[MD5.A73731A0B0A165907799E9AFB461F856] - (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [296096] [PID.3696]
[MD5.C637FC4638A96165256B28D38DE7B953] - (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208] [PID.3780]
[MD5.2894C8A3A3F7B18F53262CDEB1F7DF8E] - (...) -- C:\Program Files (x86)\Connection Manager\UIexec.exe [153424] [PID.3808]
[MD5.B4E6C1B28AF8806008CB654C716ABAFA] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392] [PID.3840]
[MD5.F16EEA6CCA9D8A7D1193AE80E43FBBC7] - (.Hewlett-Packard Co. - HP CUE Status Root.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe [168960] [PID.4340]
[MD5.8A9FACCB684500829F7D0BCC67B386CC] - (.Hewlett-Packard Co. - HP CUE Alert Popup Window Objects.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe [559104] [PID.4940]
[MD5.883008A9B5BFF94A153D99DBA54CB5C1] - (.Hewlett-Packard - GPCore COM object.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe [362496] [PID.5136]
[MD5.542459D16B416D054161007FC9B1246E] - (.Google Inc. - Google Chrome.) -- C:\Users\Aleluia\AppData\Local\Google\Chrome\Application\chrome.exe [841032] [PID.4252]
[MD5.CCD09CA21C1946AF24834512BD9A6FCA] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [7873536] [PID.5080]
[MD5.B362181ED3771DC03B4141927C80F801] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65432] [PID.1632]
[MD5.F518545E5B7623AD49ABE7F8776EFA46] - (.Apple Inc. - YSLoader.exe.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [43336] [PID.1764]
[MD5.47EFDB5472E76B4FC91259FC4B3B659A] - (...) -- C:\MySQL\bin\mysqld.exe [8186368] [PID.1776]
[MD5.EA83547B253F5FEFC870DD0D04737EC2] - (.Orolix Desenvolvimento de Software LTDA. - USB Device monitor.) -- C:\Program Files (x86)\TIM Communicator\module\devicemon.exe [27040] [PID.2072]
[MD5.7E6B107120108B3A15BFECE0DE3201DB] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler.exe [228744] [PID.2264]
[MD5.39B1D0A636A400304565D4521FAD6D77] - (.Microsoft Corporation - Microsoft Application Virtualization Virtua.) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [207528] [PID.3432]
[MD5.BE463B423C33C038ADCE0EDB6C2FD208] - (...) -- C:\Program Files (x86)\Connection Manager\AssistantServices.exe [270672] [PID.3516]
[MD5.77C5A741A7452812F278EF2C18478862] - (.Microsoft Corporation - Microsoft Application Virtualization Client.) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [523944] [PID.408]
[MD5.FD557A50A65E44041CD2FCEF4BEB04DB] - (.Microsoft Corporation - Microsoft Office Client Virtualization Serv.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.exe [822504] [PID.3272]
[MD5.8FFF9083252C16FE3960173722605E9E] - (.Intel Corporation - IAStorDataSvc.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [13336] [PID.3328]
~ Processes Running: Scanned in 00mn 01s

---\\ Google Chrome, Arranque,Pesquisa,Extensões (G0,G1,G2)
C:\Users\Aleluia\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [ahfgeienlihckogmohjhadlkjgocpleb] Loja v.0.2 (Activé)
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)

---\\ Pasta de extensão do Google Chrome
~ Google Lines Browser: 10 Legitimates Filtered in 00mn 00s

---\\ Internet Explorer, Gestão do Proxy (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s

---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s

---\\ Redireção do ficheiro Hosts (01)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21

---\\ Aplicações iniciadas por registo & pastas (04)
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gerenciador de áudio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe (.not file.)
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] . (.Broadcom Corporation - Broadcom 802.11 Network Adapter Wireless Ne.) -- C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.exe
O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Google Installer.) -- C:\Users\Aleluia\AppData\Local\Google\Update\GoogleUpdate.exe
O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Facebook Installer.) -- C:\Users\Aleluia\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKCU\..\Run: [OfficeSyncProcess] . (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.exe
O4 - HKCU\..\Run: [ares] . (.Ares Development Group - Ares p2p for windows.) -- C:\Program Files (x86)\Ares\Ares.exe
O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_DBDF8A44B2E2569C1DC03EE3E53DB07D] . (.Google Inc. - Google Chrome.) -- C:\Users\Aleluia\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - HKLM\..\Wow6432Node\Run: [IAStorIcon] . (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Wow6432Node\Run: [LockKey] . (.No owner - LockKey.) -- C:\Program Files (x86)\LockKey\LockKey.exe
O4 - HKLM\..\Wow6432Node\Run: [WSED] . (.TODO: - TODO: .) -- C:\Program Files (x86)\WSED\WSED.exe
O4 - HKLM\..\Wow6432Node\Run: [BCSSync] . (.Microsoft Corporation - Microsoft Office 2010 component.) -- C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe =>.Microsoft Corporation
O4 - HKLM\..\Wow6432Node\Run: [hpqSRMon] . (.Hewlett-Packard - HpqSRmon.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Wow6432Node\Run: [TkBellExe] . (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe =>.RealNetworks, Inc
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe =>.Hewlett-Packard Co
O4 - HKLM\..\Wow6432Node\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
O4 - HKLM\..\Wow6432Node\Run: [UIExec] . (...) -- C:\Program Files (x86)\Connection Manager\UIexec.exe
O4 - HKLM\..\Wow6432Node\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [Google Update] . (.Google Inc. - Google Installer.) -- C:\Users\Aleluia\AppData\Local\Google\Update\GoogleUpdate.exe
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [Facebook Update] . (.Facebook Inc. - Facebook Installer.) -- C:\Users\Aleluia\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [OfficeSyncProcess] . (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.exe
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [ares] . (.Ares Development Group - Ares p2p for windows.) -- C:\Program Files (x86)\Ares\Ares.exe
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [GoogleChromeAutoLaunch_DBDF8A44B2E2569C1DC03EE3E53DB07D] . (.Google Inc. - Google Chrome.) -- C:\Users\Aleluia\AppData\Local\Google\Chrome\Application\chrome.exe
~ Application: Scanned in 00mn 00s

---\\ Boutões da barra de ferramentas principal do Internet Explorer (09)
O9 - Extra button: &Enviar para o OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\MICROS~3\Office14\ONBttnIE.dll =>.Microsoft Corporation
O9 - Extra button: &Anotações Vinculadas do OneNote [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\MICROS~3\Office14\ONBTTN~1.dll =>.Microsoft Corporation
O9 - Extra button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 [64Bits] - {CCA281CA-C863-46ef-9331-5C8D4460577F} . (...) -- C:\Program Files\WIDCOMM\Bluetooth Software\bt_hot_icon.ico
~ IE Extra Buttons: Scanned in 00mn 00s

---\\ Alteração Dominio/Clientes DNS (017)
O17 - HKLM\System\CCS\Services\Tcpip\..\{680AC1A4-4A09-49E5-8715-D03BD9079B39}: NameServer = 200.169.117.221 200.169.117.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{94F6B527-2087-4EA1-A9A3-A150221EB843}: DhcpNameServer = 172.20.10.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{9664848F-5400-4A33-A0F6-CF9F732C12E8}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{ED4402BF-608D-42FB-98E7-491F904B860E}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{F675FB36-63BE-4C55-BE56-01A77E6B84A7}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CS1\Services\Tcpip\..\{680AC1A4-4A09-49E5-8715-D03BD9079B39}: NameServer = 200.169.117.221 200.169.117.222
O17 - HKLM\System\CS1\Services\Tcpip\..\{94F6B527-2087-4EA1-A9A3-A150221EB843}: DhcpNameServer = 172.20.10.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{9664848F-5400-4A33-A0F6-CF9F732C12E8}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{ED4402BF-608D-42FB-98E7-491F904B860E}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{F675FB36-63BE-4C55-BE56-01A77E6B84A7}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CS2\Services\Tcpip\..\{680AC1A4-4A09-49E5-8715-D03BD9079B39}: NameServer = 200.169.117.221 200.169.117.222
O17 - HKLM\System\CS2\Services\Tcpip\..\{94F6B527-2087-4EA1-A9A3-A150221EB843}: DhcpNameServer = 172.20.10.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{9664848F-5400-4A33-A0F6-CF9F732C12E8}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{ED4402BF-608D-42FB-98E7-491F904B860E}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{F675FB36-63BE-4C55-BE56-01A77E6B84A7}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
~ Domain: Scanned in 00mn 00s

---\\ Protocolo adicional (018)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s

---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s

---\\ Lista dos serviços NT não Microsoft e não desativados (023)
O23 - Service: HWDeviceService64.exe (HWDeviceService64.exe) . (.No owner - DCSHOST.) - C:\ProgramData\DatacardService\HWDeviceService64.exe
O23 - Service: KMService (KMService) . (...) - C:\Windows\SysWOW64\srvany.exe =>Hijacker.Office
O23 - Service: MySQL (MySQL) . (...) - C:\MySQL\bin\mysqld.exe
O23 - Service: Orolix Device Monitor (OrolixDeviceMonitor) . (.Orolix Desenvolvimento de Software LTDA. - USB Device monitor.) - C:\Program Files (x86)\TIM Communicator\module\devicemon.exe
~ Services: 11 Legitimates Filtered in 00mn 03s

---\\ Tarefas planificadas automaticamente (039)
O39 - APT: - (..) -- C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1798105164-1853435045-4239063915-1000Core [914]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1798105164-1853435045-4239063915-1000UA [936]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore [1066]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA [1070]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1798105164-1853435045-4239063915-1000Core [1034]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1798105164-1853435045-4239063915-1000UA [1086]
~ Scheduled Task: 15 Legitimates Filtered in 00mn 03s

---\\ Drivers lançados ao arranque do sistema (041)
O41 - Driver: (Bfilter) . (. - .) - C:\Windows\system32\drivers\Bfilter.sys (.not file.)
O41 - Driver: (Bfmon) . (. - .) - C:\Windows\system32\drivers\Bfmon.sys (.not file.)
O41 - Driver: (Bnbase) . (. - .) - C:\Windows\System32\drivers\bnbasex64.sys (.not file.)
O41 - Driver: (Bndef) . (. - .) - C:\Windows\system32\drivers\bndef64.sys (.not file.)
O41 - Driver: (Bprotect) . (. - .) - C:\Windows\system32\drivers\Bprotect.sys (.not file.)
O41 - Driver: ({42e50651-9669-456e-9081-d5a836274274}w64) . (.StdLib - StdLib.) - C:\Windows\System32\drivers\{42e50651-9669-456e-9081-d5a836274274}w64.sys =>PUP.LinkiDoo
~ Drivers: 66 Legitimates Filtered in 00mn 00s

---\\ Software instalados (042)
O42 - Logiciel: A Bíblia Sagrada Versão Digital 6.7 Freeware - (.Por Marcelo Ribeiro de Oliveira - 20/05/2010.) [HKLM][64Bits] -- A Bíblia Sagrada Versão Digital 6.7 Freeware_is1
O42 - Logiciel: Ares 2.1.8 - (.Ares Development Group.) [HKLM][64Bits] -- Ares
O42 - Logiciel: Biblia Eletrônica 3.6.4 - (.RkSoft Softwares Ltda.) [HKLM][64Bits] -- Biblia Eletrônica_is1
O42 - Logiciel: Claro 3G - (...) [HKLM][64Bits] -- {93D34EE3-99B3-4DB1-8B0A-0A657466F90D}
O42 - Logiciel: LockKey - (...) [HKLM][64Bits] -- InstallShield_{AF192694-4B15-4AC1-92F3-1B02E98C08BD}
O42 - Logiciel: Mundo Bíblico - (.Ideias Sem Fim.) [HKLM][64Bits] -- {FAD8C014-4637-45F3-BD56-285A90F39D36}_is1
O42 - Logiciel: TIM Communicator - (...) [HKLM][64Bits] -- OrolixCommunicator
O42 - Logiciel: TIMWEB.exe - (...) [HKLM][64Bits] -- lcgsm_is1
~ Logic: 32 Legitimates Filtered in 00mn 00s

---\\ HKCU & HKLM Software Keys
[HKCU\Software\Ares]
[HKCU\Software\DefaultPackStatus]
[HKCU\Software\OrolixCommunicator]
[HKCU\Software\Orolix]
[HKCU\Software\RkSoft]
[HKLM\Software\Wow6432Node\Claro 3G]
[HKLM\Software\Wow6432Node\LockKey]
[HKLM\Software\Wow6432Node\Orolix]
[HKLM\Software\Wow6432Node\Program DJ]
[HKLM\Software\Wow6432Node\RkSoft]
[HKLM\Software\Wow6432Node\USBDriverFlag]
[HKLM\Software\Wow6432Node\WSED]
~ Key Software: 244 Legitimates Filtered in 00mn 00s

---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 27/09/2012 - 19:37:59 - [] ----D C:\Program Files (x86)\Ares
O43 - CFD: 26/01/2013 - 20:55:46 - [] ----D C:\Program Files (x86)\Claro 3G
O43 - CFD: 08/05/2012 - 08:33:22 - [] ----D C:\Program Files (x86)\LockKey
O43 - CFD: 14/01/2013 - 08:36:17 - [] ----D C:\Program Files (x86)\MundoBiblico
O43 - CFD: 08/11/2012 - 11:43:00 - [] ----D C:\Program Files (x86)\RkSoft
O43 - CFD: 25/11/2012 - 12:25:09 - [] ----D C:\Program Files (x86)\TIM
O43 - CFD: 20/02/2014 - 16:34:02 - [] ----D C:\Program Files (x86)\TIM Communicator
O43 - CFD: 09/07/2013 - 11:32:40 - [0] ----D C:\Program Files (x86)\VIVO ZAP
O43 - CFD: 08/05/2012 - 08:34:13 - [] ----D C:\Program Files (x86)\WSED
O43 - CFD: 20/02/2014 - 16:34:02 - [] ----D C:\ProgramData\OrolixCommunicator
O43 - CFD: 27/12/2012 - 15:16:00 - [] ----D C:\ProgramData\Softouch
O43 - CFD: 08/05/2012 - 08:35:26 - [] ----D C:\ProgramData\Win732
O43 - CFD: 08/05/2012 - 08:35:25 - [] ----D C:\ProgramData\Win764
O43 - CFD: 08/05/2012 - 08:34:28 - [] ----D C:\ProgramData\XP32
O43 - CFD: 27/12/2012 - 15:16:00 - [] ----D C:\Users\Aleluia\AppData\Roaming\Softouch
O43 - CFD: 25/11/2012 - 12:25:09 - [] ----D C:\Users\Aleluia\AppData\Roaming\TIM
O43 - CFD: 27/09/2012 - 19:38:01 - [] ----D C:\Users\Aleluia\AppData\Local\Ares
O43 - CFD: 02/02/2013 - 12:15:34 - [] ----D C:\Users\Aleluia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TagSoft
~ Program Folder: 166 Legitimates Filtered in 00mn 00s

---\\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044)
O44 - LFC:[MD5.8E9E3CBA08EC47245B277110835CF305] - 07/05/2014 - 19:23:13 ---A- . (.The OpenVPN Project - TAP-Win32 Virtual Network Driver.) -- C:\Windows\System32\Drivers\tap0901.sys [38216]
O44 - LFC:[MD5.BD3CB5AC7696FD6CB1A850BFE16B6606] - 07/05/2014 - 20:01:38 ---A- . (...) -- C:\Windows\certutil.log [3621]
O44 - LFC:[MD5.C90122A144F8EA6B54D38CEC7B6D70CE] - 07/05/2014 - 22:50:29 ---A- . (...) -- C:\Windows\System32\prfc0416.dat [4119168]
O44 - LFC:[MD5.B20A07B78C51744CCAB95B47550B2C79] - 07/05/2014 - 22:50:29 ---A- . (...) -- C:\Windows\System32\prfh0416.dat [4873824]
O44 - LFC:[MD5.CC7AA7B42CF418FC3D926913490048F8] - 08/05/2014 - 11:36:58 ---A- . (...) -- C:\Windows\zoek-delete.exe [24064]
O44 - LFC:[MD5.C2888827395836BC0B5877BF33A1E4A8] - 08/05/2014 - 12:18:06 ---A- . (...) -- C:\zoek-results.log [20038]
O44 - LFC:[MD5.87FB9899C8FA8F614F8D999C68706051] - 24/04/2014 - 12:23:46 ---A- . (.StdLib - StdLib.) -- C:\Windows\System32\Drivers\{42e50651-9669-456e-9081-d5a836274274}w64.sys [61112] =>PUP.LinkiDoo
O44 - LFC:[MD5.F911578DA931B1ECA46127F7E93F35CB] - 27/04/2014 - 17:10:40 ---A- . (...) -- C:\Windows\unins000.exe [715038]
O44 - LFC:[MD5.1B2B0B7FA7937CD057AA6ED27273EC68] - 27/04/2014 - 17:10:42 ---A- . (...) -- C:\Windows\System32\lagarith.dll [148992]
O44 - LFC:[MD5.28EF5BD32C7E368BDC4C4B0D141CA59B] - 27/04/2014 - 17:10:43 ---A- . (...) -- C:\Windows\unins000.dat [1997]
O44 - LFC:[MD5.D10C62FF24D46105D0C7F2A52204A792] - 27/04/2014 - 21:35:58 ---A- . (...) -- C:\Windows\win.ini [713]
~ Files: 47 Legitimates Filtered in 00mn 06s

---\\ Operações e funções ao arranque do Windows Explorer (046)
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook [64Bits] - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL
~ ShellExecuteHooks: Scanned in 00mn 00s

---\\ Pesquisa de infeções nos drivers (HKLM)(TDSD) (O52)
O52 - TDSD: \Drivers32\"VIDC.LAGS"="lagarith.dll" . (...) -- C:\Windows\System32\lagarith.dll
O52 - TDSD: \drivers.desc\"lagarith.dll"="Lagarith lossless codec [LAGS]" . (...) -- C:\Windows\System32\lagarith.dll
~ TDSD: 4 Legitimates Filtered in 00mn 00s

---\\ Enumeração das chaves do registo PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorUser"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 18 Legitimates Filtered in 00mn 00s

---\\ Enumeração das chaves do registo PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s

---\\ Lista dos drivers do sistema (SDL) (O58)
O58 - SDL:17/01/2013 - 21:07:36 R--A- . (.360.cn - 360HipsOEM.) -- C:\Windows\System32\Drivers\360FltOEM.sys [288688]
O58 - SDL:09/11/2009 - 11:22:46 ---A- . (.Haier Inc. - USB/Serial Device Driver.) -- C:\Windows\System32\Drivers\3GDatausbser64.sys [120832]
O58 - SDL:13/07/2009 - 22:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:26/06/2009 - 15:43:42 ---A- . (.Windows (R) Win 7 DDK provider - Embedded System Control.) -- C:\Windows\System32\Drivers\EMSC.sys [16752]
O58 - SDL:10/06/2009 - 17:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:26/03/2011 - 10:37:12 ---A- . (.MBB Incorporated - CDROM Filter.) -- C:\Windows\System32\Drivers\massfilter.sys [11776]
O58 - SDL:13/07/2009 - 22:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
O58 - SDL:09/04/2014 - 22:21:02 ---A- . (.The OpenVPN Project - TAP-Win32 Virtual Network Driver.) -- C:\Windows\System32\Drivers\tap0901.sys [38216]
O58 - SDL:18/03/2013 - 16:51:08 ---A- . (.Apple, Inc. - Apple Mobile Device USB Driver.) -- C:\Windows\System32\Drivers\usbaapl64.sys [54784]
O58 - SDL:24/04/2014 - 12:23:46 ---A- . (.StdLib - StdLib.) -- C:\Windows\System32\Drivers\{42e50651-9669-456e-9081-d5a836274274}w64.sys [61112] =>PUP.LinkiDoo
O58 - SDL:26/06/2009 - 15:43:42 ---A- . (.Windows (R) Win 7 DDK provider - Embedded System Control.) -- C:\Windows\SysWOW64\drivers\EMSC.sys [13680]
~ Drivers: 85 Legitimates Filtered in 00mn 08s

---\\ Lista das ferramentas de remoção de vírus (LAT) (063)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s

---\\ Menu de inicialização Internet (068)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\Aleluia\AppData\Local\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s

---\\ Pesquisa de infeção nos navegadores da Internet (SBI) (069)
O69 - SBI: SearchScopes [HKCU] Web - (Web) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} [DefaultScope] - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Keys: Scanned in 00mn 00s

---\\ Pesquisa adicional à raiz do sistema (radicular) (SPRF) (O84)
[MD5.3423CE16DA5F241E49F8999E835300FD] [SPRF][10/06/2012] (.Por Marcelo Ribeiro de Oliveira - 20/05/201 - A Bíblia Sagrada Versão Digital 6.7 Freeware Setup.) -- C:\Users\Aleluia\Desktop\ABSVD67Setup.exe [2205098]
[MD5.6A23617835EBFC0999582E5D6700E9B3] [SPRF][02/02/2013] (.TagSoft - TagComércio.) -- C:\Users\Aleluia\Desktop\store_free.exe [6241822]
~ Files: 2 Legitimates Filtered in 00mn 00s

---\\ Estado general dos serviços não Microsoft (EGS) (SR=Executados, SS=Parados)
SS - | Auto 23/12/2012 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 23/12/2012 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 22/10/2004 73728 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
SS - | Auto 10/07/1658 0 | (KMService) . (...) - C:\Windows\system32\srvany.exe =>Hijacker.Office
SS - | Demand 13/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SS - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 18/12/2013 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 07/01/2014 43336 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 22/10/2010 953632 | (btwdins) . (.Broadcom Corporation..) - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
SR - | Demand 13/07/2009 27136 | C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll (hpqcxs08) . (.Hewlett-Packard Co..) - C:\Windows\System32\svchost.exe
SR - | Auto 13/07/2009 27136 | C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll (hpqddsvc) . (.Hewlett-Packard Co..) - C:\Windows\System32\svchost.exe
SR - | Auto 14/03/2011 346976 | (HWDeviceService64.exe) . (...) - C:\ProgramData\DatacardService\HWDeviceService64.exe
SR - | Auto 05/11/2010 13336 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
SR - | Demand 06/02/2014 641352 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SR - | Auto 11/03/2014 23808 | (MsMpSvc) . (.Microsoft Corporation.) - c:\Program Files\Microsoft Security Client\MsMpEng.exe
SR - | Auto 20/07/2012 8186368 | (MySQL) . (...) - C:\MySQL\bin\mysqld.exe
SR - | Auto 13/07/2009 27136 | C:\Windows\system32\HPZinw12.dll (Net Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe
SR - | Auto 20/04/2010 27040 | (OrolixDeviceMonitor) . (.Orolix Desenvolvimento de Software LTDA..) - C:\Program Files (x86)\TIM Communicator\module\devicemon.exe
SR - | Auto 13/07/2009 27136 | C:\Windows\system32\HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe
SR - | Auto 01/11/2011 270672 | (UI Assistant Service) . (...) - C:\Program Files (x86)\Connection Manager\AssistantServices.exe
SR - | Auto 15/10/2013 48128 | (wltrysvc) . (.Broadcom Corporation.) - C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRYSVC.exe
SR - | Auto 13/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 07s

---\\ Scâner Aditional (088)
Database Version : 13045 - (08/05/2014)
Clés trouvées (Keys found) : 1
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 0

[HKLM\SYSTEM\CurrentControlSet\Services\KMService] =>Hijacker.Office^
~ Additionnel Scan: 290146 Items scanned in 00mn 22s

---\\ Sumário das deteções encontradas na sua estação
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Hijacker.Office
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.LinkiDoo
~ MSI: 2 link(s) detected in 00mn 00s

~ 771 Legitimates filtered by white list
End of the scan (483 lines in 01mn 32s)(0)

por saraapereira1 Qui 08 maio 2014, 18:45

~ Relatório do ZHPDiag v2014.5.8.57 - Nicolas Coolman (08/05/2014)
~ Iniciado por Aleluia (08/05/2014 18:27:22)
~ Endereço do Website : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Fóruns de suporte gratuito para desinfecção : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Tradução pelo utilizador
~ Estatuto da versão :
~ Lista Branca : Ativado pelo programa
~ Elevação dos Privilégios : OK
~ Controle de Conta de Utilizador : Deactivate by user

---\\ Navegadores Internet
MSIE: Internet Explorer v11.0.9600.17105
GCIE: Google Chrome v34.0.1847.131 (Defaut)

---\\ Informações sobre os produtos Windows
~ Langage: Portugais
Windows 7 Home Basic, 64-bit Service Pack 1 (Build 7601)
Windows Server License Manager Script : OK
Software Protection Service (Protection logicielle) : OK
Key Management Service client information : KO
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ Softwares de proteçao do sistema
Microsoft Security Client PT-BR Language Pack v2.1.1116.0
Windows Defender W7

---\\ Softwares d'optimização do sistema

---\\ Softwares de partilha do PeerToPeer (P2P)

---\\ Monitoramento dos softwares
Adobe Flash Player 10 ActiveX
Adobe Reader X

---\\ Informações sobre o sistema
~ Processor: Intel64 Family 6 Model 37 Stepping 5, GenuineIntel
~ Operating System: 64 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3765 MB (56% free)
System Restore: Activé (Enable)
System drive C: has 370 GB (80%) free of 461 GB

---\\ Modo de conexão ao sistema
~ Computer Name: ALELUIA-TECNO
~ User Name: Aleluia
~ All Users Names: Convidado, Aleluia, Administrador,
~ Unselected Option: 045,061,O62,065,066,080,O82,089
Logged in as Administrator

---\\ As variáveis de ambiente
~ System Unit : C:\
~ %AppZHP% : C:\Users\Aleluia\AppData\Roaming\ZHP\
~ %AppData% : C:\Users\Aleluia\AppData\Roaming\
~ %Desktop% : C:\Users\Aleluia\Desktop\
~ %Favorites% : C:\Users\Aleluia\Favorites\
~ %LocalAppData% : C:\Users\Aleluia\AppData\Local\
~ %StartMenu% : C:\Users\Aleluia\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumeração das unidades dos discos
C: Hard drive, Flash drive, Thumb drive (Free 370 Go of 461 Go)
D: CD-ROM drive (Not Inserted)
F: Floppy drive, Flash card reader, USB Key (Not Inserted)
Q: Hard drive, Flash drive, Thumb drive (Free 0 Go of 0 Go)

---\\ Estado do Centro de Segurança do Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
~ Security Center: 44 Legitimates Filtered in 00mn 00s

---\\ Pesquisa particular de ficheiros genéricos
[MD5.332FEAB1435662FC6C672E25BEB37BE3] - (.Microsoft Corporation - Windows Explorer.) (.25/02/2011 - 03:19:30.) -- C:\Windows\Explorer.exe [2871808]
[MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Aplicativo de Inicialização do Windows.) (.13/07/2009 - 22:39:52.) -- C:\Windows\System32\Wininit.exe [129024]
[MD5.F220BA78AB542C70211D73AE4729B2CD] - (.Microsoft Corporation - Internet Extensions para Win32.) (.06/03/2014 - 03:22:40.) -- C:\Windows\System32\wininet.dll [2260480]
[MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Aplicativo de Logon do Windows.) (.21/11/2010 - 00:24:29.) -- C:\Windows\System32\Winlogon.exe [390656]
[MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Biblioteca de Licenciamento de Software.) (.21/11/2010 - 00:24:16.) -- C:\Windows\System32\sppcomapi.dll [232448]
[MD5.79059559E89D06E8B80CE2944BE20228] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.27/09/2013 - 22:09:10.) -- C:\Windows\system32\Drivers\AFD.sys [497152]
[MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.13/07/2009 - 22:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128]
[MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 20:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160]
[MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456]
[MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.21/11/2010 - 00:24:32.) -- C:\Windows\system32\Drivers\DfsC.sys [102400]
[MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368]
[MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Driver de porta i8042.) (.13/07/2009 - 20:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472]
[MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.13/07/2009 - 21:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224]
[MD5.A5D9106A73DC88564C825D317CAC68AC] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.26/04/2011 - 23:40:40.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208]
[MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.21/11/2010 - 00:23:51.) -- C:\Windows\system32\Drivers\netBT.sys [261632]
[MD5.1A29A59A4C5BA6F8C85062A613B7E2B2] - (.Microsoft Corporation - Driver do Sistema de Arquivos NT.) (.23/01/2014 - 23:37:55.) -- C:\Windows\system32\Drivers\ntfs.sys [1684928]
[MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Driver de porta paralela.) (.13/07/2009 - 21:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280]
[MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.21/11/2010 - 00:24:33.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536]
[MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.13/07/2009 - 21:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184]
[MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.21/11/2010 - 00:24:32.) -- C:\Windows\system32\Drivers\tdx.sys [119296]
[MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.21/11/2010 - 00:23:47.) -- C:\Windows\system32\Drivers\volsnap.sys [295808]
~ Generic Processes: Scanned in 00mn 00s

---\\ Estatuto dos ficheiros ocultos (Oculto/Total)
~ Mes images (My Pictures) : 2/156
~ Mes musiques (My Musics) : 1/991
~ Mes Videos (My Videos) : 1/78
~ Mes Favoris (My Favorites) : 1/22
~ Mes Documents (My Documents) : 9/1417
~ Mon Bureau (My Desktop) : 4/3843
~ Menu demarrer (Programs) : 1/33
~ Hidden Files: Scanned in 00mn 02s

---\\ Processos lançados
[MD5.349AB4F70E2AC44970894E7F03E1576E] - (.Huawei Technologies Co., Ltd. - DataCardMonitor MFC Application.) -- C:\ProgramData\DatacardService\DCSHelper.exe [236384] [PID.1600]
[MD5.C948AC73822CA662CF44185B909EA18B] - (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.exe [720064] [PID.2804]
[MD5.70EA13A41C0D9D31343EC203A629F801] - (.Ares Development Group - Ares p2p for windows.) -- C:\Program Files (x86)\Ares\Ares.exe [3209216] [PID.2844]
[MD5.B54921381A950C8215FB363B485C432B] - (.Hewlett-Packard Co. - HP Digital Imaging Monitor.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [270336] [PID.3036]
[MD5.4BF3C4F9327BB33190603829C9F5E781] - (.Facebook - Facebook Messenger.) -- C:\Users\Aleluia\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe [248240] [PID.3064]
[MD5.51138BEEA3E2C21EC44D0932C71762A8] - (...) -- ysWOW64\RunDll32.exe [0] [PID.2104]
[MD5.4A73AB8412D3AA6CFAD24051FF9DBFA7] - (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160] [PID.3264]
[MD5.11947F50905DC85A44FE2B409857413B] - (.No owner - LockKey.) -- C:\Program Files (x86)\LockKey\LockKey.exe [801392] [PID.3620]
[MD5.A73731A0B0A165907799E9AFB461F856] - (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [296096] [PID.3696]
[MD5.C637FC4638A96165256B28D38DE7B953] - (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208] [PID.3780]
[MD5.2894C8A3A3F7B18F53262CDEB1F7DF8E] - (...) -- C:\Program Files (x86)\Connection Manager\UIexec.exe [153424] [PID.3808]
[MD5.B4E6C1B28AF8806008CB654C716ABAFA] - (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392] [PID.3840]
[MD5.F16EEA6CCA9D8A7D1193AE80E43FBBC7] - (.Hewlett-Packard Co. - HP CUE Status Root.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe [168960] [PID.4340]
[MD5.8A9FACCB684500829F7D0BCC67B386CC] - (.Hewlett-Packard Co. - HP CUE Alert Popup Window Objects.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe [559104] [PID.4940]
[MD5.883008A9B5BFF94A153D99DBA54CB5C1] - (.Hewlett-Packard - GPCore COM object.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe [362496] [PID.5136]
[MD5.542459D16B416D054161007FC9B1246E] - (.Google Inc. - Google Chrome.) -- C:\Users\Aleluia\AppData\Local\Google\Chrome\Application\chrome.exe [841032] [PID.4252]
[MD5.CCD09CA21C1946AF24834512BD9A6FCA] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [7873536] [PID.5080]
[MD5.B362181ED3771DC03B4141927C80F801] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [65432] [PID.1632]
[MD5.F518545E5B7623AD49ABE7F8776EFA46] - (.Apple Inc. - YSLoader.exe.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [43336] [PID.1764]
[MD5.47EFDB5472E76B4FC91259FC4B3B659A] - (...) -- C:\MySQL\bin\mysqld.exe [8186368] [PID.1776]
[MD5.EA83547B253F5FEFC870DD0D04737EC2] - (.Orolix Desenvolvimento de Software LTDA. - USB Device monitor.) -- C:\Program Files (x86)\TIM Communicator\module\devicemon.exe [27040] [PID.2072]
[MD5.7E6B107120108B3A15BFECE0DE3201DB] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files (x86)\Google\Update\1.3.23.9\GoogleCrashHandler.exe [228744] [PID.2264]
[MD5.39B1D0A636A400304565D4521FAD6D77] - (.Microsoft Corporation - Microsoft Application Virtualization Virtua.) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [207528] [PID.3432]
[MD5.BE463B423C33C038ADCE0EDB6C2FD208] - (...) -- C:\Program Files (x86)\Connection Manager\AssistantServices.exe [270672] [PID.3516]
[MD5.77C5A741A7452812F278EF2C18478862] - (.Microsoft Corporation - Microsoft Application Virtualization Client.) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [523944] [PID.408]
[MD5.FD557A50A65E44041CD2FCEF4BEB04DB] - (.Microsoft Corporation - Microsoft Office Client Virtualization Serv.) -- C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.exe [822504] [PID.3272]
[MD5.8FFF9083252C16FE3960173722605E9E] - (.Intel Corporation - IAStorDataSvc.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [13336] [PID.3328]
~ Processes Running: Scanned in 00mn 01s

---\\ Google Chrome, Arranque,Pesquisa,Extensões (G0,G1,G2)
C:\Users\Aleluia\AppData\Local\Google\Chrome\User Data\Default\Preferences
G2 - GCE: Preference [User Data\Default] [ahfgeienlihckogmohjhadlkjgocpleb] Loja v.0.2 (Activé)
G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)
G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)

---\\ Pasta de extensão do Google Chrome
~ Google Lines Browser: 10 Legitimates Filtered in 00mn 00s

---\\ Internet Explorer, Gestão do Proxy (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s

---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s

---\\ Redireção do ficheiro Hosts (01)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File: Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 21

---\\ Aplicações iniciadas por registo & pastas (04)
O4 - HKLM\..\Run: [IgfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gerenciador de áudio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe (.not file.)
O4 - HKLM\..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] . (.Broadcom Corporation - Broadcom 802.11 Network Adapter Wireless Ne.) -- C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRAY.exe
O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Google Installer.) -- C:\Users\Aleluia\AppData\Local\Google\Update\GoogleUpdate.exe
O4 - HKCU\..\Run: [Facebook Update] . (.Facebook Inc. - Facebook Installer.) -- C:\Users\Aleluia\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKCU\..\Run: [OfficeSyncProcess] . (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.exe
O4 - HKCU\..\Run: [ares] . (.Ares Development Group - Ares p2p for windows.) -- C:\Program Files (x86)\Ares\Ares.exe
O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_DBDF8A44B2E2569C1DC03EE3E53DB07D] . (.Google Inc. - Google Chrome.) -- C:\Users\Aleluia\AppData\Local\Google\Chrome\Application\chrome.exe
O4 - HKLM\..\Wow6432Node\Run: [IAStorIcon] . (.Intel Corporation - IAStorIcon.) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Wow6432Node\Run: [LockKey] . (.No owner - LockKey.) -- C:\Program Files (x86)\LockKey\LockKey.exe
O4 - HKLM\..\Wow6432Node\Run: [WSED] . (.TODO: - TODO: .) -- C:\Program Files (x86)\WSED\WSED.exe
O4 - HKLM\..\Wow6432Node\Run: [BCSSync] . (.Microsoft Corporation - Microsoft Office 2010 component.) -- C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe =>.Microsoft Corporation
O4 - HKLM\..\Wow6432Node\Run: [hpqSRMon] . (.Hewlett-Packard - HpqSRmon.) -- C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Wow6432Node\Run: [TkBellExe] . (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe =>.RealNetworks, Inc
O4 - HKLM\..\Wow6432Node\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe =>.Adobe Systems Incorporated
O4 - HKLM\..\Wow6432Node\Run: [HP Software Update] . (.Hewlett-Packard - hpwuSchd Application.) -- C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe =>.Hewlett-Packard Co
O4 - HKLM\..\Wow6432Node\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
O4 - HKLM\..\Wow6432Node\Run: [UIExec] . (...) -- C:\Program Files (x86)\Connection Manager\UIexec.exe
O4 - HKLM\..\Wow6432Node\Run: [iTunesHelper] . (.Apple Inc. - iTunesHelper.) -- C:\Program Files (x86)\iTunes\iTunesHelper.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [Google Update] . (.Google Inc. - Google Installer.) -- C:\Users\Aleluia\AppData\Local\Google\Update\GoogleUpdate.exe
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [Facebook Update] . (.Facebook Inc. - Facebook Installer.) -- C:\Users\Aleluia\AppData\Local\Facebook\Update\FacebookUpdate.exe
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [OfficeSyncProcess] . (.Microsoft Corporation - Microsoft Office Document Cache.) -- C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.exe
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [ares] . (.Ares Development Group - Ares p2p for windows.) -- C:\Program Files (x86)\Ares\Ares.exe
O4 - HKUS\S-1-5-21-1798105164-1853435045-4239063915-1000\..\Run: [GoogleChromeAutoLaunch_DBDF8A44B2E2569C1DC03EE3E53DB07D] . (.Google Inc. - Google Chrome.) -- C:\Users\Aleluia\AppData\Local\Google\Chrome\Application\chrome.exe
~ Application: Scanned in 00mn 00s

---\\ Boutões da barra de ferramentas principal do Internet Explorer (09)
O9 - Extra button: &Enviar para o OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\MICROS~3\Office14\ONBttnIE.dll =>.Microsoft Corporation
O9 - Extra button: &Anotações Vinculadas do OneNote [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\MICROS~3\Office14\ONBTTN~1.dll =>.Microsoft Corporation
O9 - Extra button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 [64Bits] - {CCA281CA-C863-46ef-9331-5C8D4460577F} . (...) -- C:\Program Files\WIDCOMM\Bluetooth Software\bt_hot_icon.ico
~ IE Extra Buttons: Scanned in 00mn 00s

---\\ Alteração Dominio/Clientes DNS (017)
O17 - HKLM\System\CCS\Services\Tcpip\..\{680AC1A4-4A09-49E5-8715-D03BD9079B39}: NameServer = 200.169.117.221 200.169.117.222
O17 - HKLM\System\CCS\Services\Tcpip\..\{94F6B527-2087-4EA1-A9A3-A150221EB843}: DhcpNameServer = 172.20.10.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{9664848F-5400-4A33-A0F6-CF9F732C12E8}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{ED4402BF-608D-42FB-98E7-491F904B860E}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{F675FB36-63BE-4C55-BE56-01A77E6B84A7}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CS1\Services\Tcpip\..\{680AC1A4-4A09-49E5-8715-D03BD9079B39}: NameServer = 200.169.117.221 200.169.117.222
O17 - HKLM\System\CS1\Services\Tcpip\..\{94F6B527-2087-4EA1-A9A3-A150221EB843}: DhcpNameServer = 172.20.10.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{9664848F-5400-4A33-A0F6-CF9F732C12E8}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{ED4402BF-608D-42FB-98E7-491F904B860E}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{F675FB36-63BE-4C55-BE56-01A77E6B84A7}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CS2\Services\Tcpip\..\{680AC1A4-4A09-49E5-8715-D03BD9079B39}: NameServer = 200.169.117.221 200.169.117.222
O17 - HKLM\System\CS2\Services\Tcpip\..\{94F6B527-2087-4EA1-A9A3-A150221EB843}: DhcpNameServer = 172.20.10.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{9664848F-5400-4A33-A0F6-CF9F732C12E8}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{ED4402BF-608D-42FB-98E7-491F904B860E}: DhcpNameServer = 10.0.0.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{F675FB36-63BE-4C55-BE56-01A77E6B84A7}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
~ Domain: Scanned in 00mn 00s

---\\ Protocolo adicional (018)
O18 - Handler: wlpg [64Bits] - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (...) --
O18 - Filter: text/xml [64Bits] - {807573E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.dll =>.Microsoft Corporation
~ Protocole Additionnel: Scanned in 00mn 00s

---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll
~ Winlogon: Scanned in 00mn 00s

---\\ Lista dos serviços NT não Microsoft e não desativados (023)
O23 - Service: HWDeviceService64.exe (HWDeviceService64.exe) . (.No owner - DCSHOST.) - C:\ProgramData\DatacardService\HWDeviceService64.exe
O23 - Service: KMService (KMService) . (...) - C:\Windows\SysWOW64\srvany.exe =>Hijacker.Office
O23 - Service: MySQL (MySQL) . (...) - C:\MySQL\bin\mysqld.exe
O23 - Service: Orolix Device Monitor (OrolixDeviceMonitor) . (.Orolix Desenvolvimento de Software LTDA. - USB Device monitor.) - C:\Program Files (x86)\TIM Communicator\module\devicemon.exe
~ Services: 11 Legitimates Filtered in 00mn 03s

---\\ Tarefas planificadas automaticamente (039)
O39 - APT: - (..) -- C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1798105164-1853435045-4239063915-1000Core [914]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1798105164-1853435045-4239063915-1000UA [936]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore [1066]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA [1070]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1798105164-1853435045-4239063915-1000Core [1034]
O39 - APT: - (..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1798105164-1853435045-4239063915-1000UA [1086]
~ Scheduled Task: 15 Legitimates Filtered in 00mn 03s

---\\ Drivers lançados ao arranque do sistema (041)
O41 - Driver: (Bfilter) . (. - .) - C:\Windows\system32\drivers\Bfilter.sys (.not file.)
O41 - Driver: (Bfmon) . (. - .) - C:\Windows\system32\drivers\Bfmon.sys (.not file.)
O41 - Driver: (Bnbase) . (. - .) - C:\Windows\System32\drivers\bnbasex64.sys (.not file.)
O41 - Driver: (Bndef) . (. - .) - C:\Windows\system32\drivers\bndef64.sys (.not file.)
O41 - Driver: (Bprotect) . (. - .) - C:\Windows\system32\drivers\Bprotect.sys (.not file.)
O41 - Driver: ({42e50651-9669-456e-9081-d5a836274274}w64) . (.StdLib - StdLib.) - C:\Windows\System32\drivers\{42e50651-9669-456e-9081-d5a836274274}w64.sys =>PUP.LinkiDoo
~ Drivers: 66 Legitimates Filtered in 00mn 00s

---\\ Software instalados (042)
O42 - Logiciel: A Bíblia Sagrada Versão Digital 6.7 Freeware - (.Por Marcelo Ribeiro de Oliveira - 20/05/2010.) [HKLM][64Bits] -- A Bíblia Sagrada Versão Digital 6.7 Freeware_is1
O42 - Logiciel: Ares 2.1.8 - (.Ares Development Group.) [HKLM][64Bits] -- Ares
O42 - Logiciel: Biblia Eletrônica 3.6.4 - (.RkSoft Softwares Ltda.) [HKLM][64Bits] -- Biblia Eletrônica_is1
O42 - Logiciel: Claro 3G - (...) [HKLM][64Bits] -- {93D34EE3-99B3-4DB1-8B0A-0A657466F90D}
O42 - Logiciel: LockKey - (...) [HKLM][64Bits] -- InstallShield_{AF192694-4B15-4AC1-92F3-1B02E98C08BD}
O42 - Logiciel: Mundo Bíblico - (.Ideias Sem Fim.) [HKLM][64Bits] -- {FAD8C014-4637-45F3-BD56-285A90F39D36}_is1
O42 - Logiciel: TIM Communicator - (...) [HKLM][64Bits] -- OrolixCommunicator
O42 - Logiciel: TIMWEB.exe - (...) [HKLM][64Bits] -- lcgsm_is1
~ Logic: 32 Legitimates Filtered in 00mn 00s

---\\ HKCU & HKLM Software Keys
[HKCU\Software\Ares]
[HKCU\Software\DefaultPackStatus]
[HKCU\Software\OrolixCommunicator]
[HKCU\Software\Orolix]
[HKCU\Software\RkSoft]
[HKLM\Software\Wow6432Node\Claro 3G]
[HKLM\Software\Wow6432Node\LockKey]
[HKLM\Software\Wow6432Node\Orolix]
[HKLM\Software\Wow6432Node\Program DJ]
[HKLM\Software\Wow6432Node\RkSoft]
[HKLM\Software\Wow6432Node\USBDriverFlag]
[HKLM\Software\Wow6432Node\WSED]
~ Key Software: 244 Legitimates Filtered in 00mn 00s

---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 27/09/2012 - 19:37:59 - [] ----D C:\Program Files (x86)\Ares
O43 - CFD: 26/01/2013 - 20:55:46 - [] ----D C:\Program Files (x86)\Claro 3G
O43 - CFD: 08/05/2012 - 08:33:22 - [] ----D C:\Program Files (x86)\LockKey
O43 - CFD: 14/01/2013 - 08:36:17 - [] ----D C:\Program Files (x86)\MundoBiblico
O43 - CFD: 08/11/2012 - 11:43:00 - [] ----D C:\Program Files (x86)\RkSoft
O43 - CFD: 25/11/2012 - 12:25:09 - [] ----D C:\Program Files (x86)\TIM
O43 - CFD: 20/02/2014 - 16:34:02 - [] ----D C:\Program Files (x86)\TIM Communicator
O43 - CFD: 09/07/2013 - 11:32:40 - [0] ----D C:\Program Files (x86)\VIVO ZAP
O43 - CFD: 08/05/2012 - 08:34:13 - [] ----D C:\Program Files (x86)\WSED
O43 - CFD: 20/02/2014 - 16:34:02 - [] ----D C:\ProgramData\OrolixCommunicator
O43 - CFD: 27/12/2012 - 15:16:00 - [] ----D C:\ProgramData\Softouch
O43 - CFD: 08/05/2012 - 08:35:26 - [] ----D C:\ProgramData\Win732
O43 - CFD: 08/05/2012 - 08:35:25 - [] ----D C:\ProgramData\Win764
O43 - CFD: 08/05/2012 - 08:34:28 - [] ----D C:\ProgramData\XP32
O43 - CFD: 27/12/2012 - 15:16:00 - [] ----D C:\Users\Aleluia\AppData\Roaming\Softouch
O43 - CFD: 25/11/2012 - 12:25:09 - [] ----D C:\Users\Aleluia\AppData\Roaming\TIM
O43 - CFD: 27/09/2012 - 19:38:01 - [] ----D C:\Users\Aleluia\AppData\Local\Ares
O43 - CFD: 02/02/2013 - 12:15:34 - [] ----D C:\Users\Aleluia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TagSoft
~ Program Folder: 166 Legitimates Filtered in 00mn 00s

---\\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044)
O44 - LFC:[MD5.8E9E3CBA08EC47245B277110835CF305] - 07/05/2014 - 19:23:13 ---A- . (.The OpenVPN Project - TAP-Win32 Virtual Network Driver.) -- C:\Windows\System32\Drivers\tap0901.sys [38216]
O44 - LFC:[MD5.BD3CB5AC7696FD6CB1A850BFE16B6606] - 07/05/2014 - 20:01:38 ---A- . (...) -- C:\Windows\certutil.log [3621]
O44 - LFC:[MD5.C90122A144F8EA6B54D38CEC7B6D70CE] - 07/05/2014 - 22:50:29 ---A- . (...) -- C:\Windows\System32\prfc0416.dat [4119168]
O44 - LFC:[MD5.B20A07B78C51744CCAB95B47550B2C79] - 07/05/2014 - 22:50:29 ---A- . (...) -- C:\Windows\System32\prfh0416.dat [4873824]
O44 - LFC:[MD5.CC7AA7B42CF418FC3D926913490048F8] - 08/05/2014 - 11:36:58 ---A- . (...) -- C:\Windows\zoek-delete.exe [24064]
O44 - LFC:[MD5.C2888827395836BC0B5877BF33A1E4A8] - 08/05/2014 - 12:18:06 ---A- . (...) -- C:\zoek-results.log [20038]
O44 - LFC:[MD5.87FB9899C8FA8F614F8D999C68706051] - 24/04/2014 - 12:23:46 ---A- . (.StdLib - StdLib.) -- C:\Windows\System32\Drivers\{42e50651-9669-456e-9081-d5a836274274}w64.sys [61112] =>PUP.LinkiDoo
O44 - LFC:[MD5.F911578DA931B1ECA46127F7E93F35CB] - 27/04/2014 - 17:10:40 ---A- . (...) -- C:\Windows\unins000.exe [715038]
O44 - LFC:[MD5.1B2B0B7FA7937CD057AA6ED27273EC68] - 27/04/2014 - 17:10:42 ---A- . (...) -- C:\Windows\System32\lagarith.dll [148992]
O44 - LFC:[MD5.28EF5BD32C7E368BDC4C4B0D141CA59B] - 27/04/2014 - 17:10:43 ---A- . (...) -- C:\Windows\unins000.dat [1997]
O44 - LFC:[MD5.D10C62FF24D46105D0C7F2A52204A792] - 27/04/2014 - 21:35:58 ---A- . (...) -- C:\Windows\win.ini [713]
~ Files: 47 Legitimates Filtered in 00mn 06s

---\\ Operações e funções ao arranque do Windows Explorer (046)
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL
O46 - SEH:ShellExecuteHooks - Groove GFS Stub Execution Hook [64Bits] - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL
~ ShellExecuteHooks: Scanned in 00mn 00s

---\\ Pesquisa de infeções nos drivers (HKLM)(TDSD) (O52)
O52 - TDSD: \Drivers32\"VIDC.LAGS"="lagarith.dll" . (...) -- C:\Windows\System32\lagarith.dll
O52 - TDSD: \drivers.desc\"lagarith.dll"="Lagarith lossless codec [LAGS]" . (...) -- C:\Windows\System32\lagarith.dll
~ TDSD: 4 Legitimates Filtered in 00mn 00s

---\\ Enumeração das chaves do registo PoliciesSystem (MWPS) (O55)
O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorUser"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0
O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0
O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0
~ MWPS: 18 Legitimates Filtered in 00mn 00s

---\\ Enumeração das chaves do registo PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1
~ MWPE Keys: 3 Legitimates Filtered in 00mn 00s

---\\ Lista dos drivers do sistema (SDL) (O58)
O58 - SDL:17/01/2013 - 21:07:36 R--A- . (.360.cn - 360HipsOEM.) -- C:\Windows\System32\Drivers\360FltOEM.sys [288688]
O58 - SDL:09/11/2009 - 11:22:46 ---A- . (.Haier Inc. - USB/Serial Device Driver.) -- C:\Windows\System32\Drivers\3GDatausbser64.sys [120832]
O58 - SDL:13/07/2009 - 22:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496]
O58 - SDL:26/06/2009 - 15:43:42 ---A- . (.Windows (R) Win 7 DDK provider - Embedded System Control.) -- C:\Windows\System32\Drivers\EMSC.sys [16752]
O58 - SDL:10/06/2009 - 17:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232]
O58 - SDL:26/03/2011 - 10:37:12 ---A- . (.MBB Incorporated - CDROM Filter.) -- C:\Windows\System32\Drivers\massfilter.sys [11776]
O58 - SDL:13/07/2009 - 22:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656]
O58 - SDL:09/04/2014 - 22:21:02 ---A- . (.The OpenVPN Project - TAP-Win32 Virtual Network Driver.) -- C:\Windows\System32\Drivers\tap0901.sys [38216]
O58 - SDL:18/03/2013 - 16:51:08 ---A- . (.Apple, Inc. - Apple Mobile Device USB Driver.) -- C:\Windows\System32\Drivers\usbaapl64.sys [54784]
O58 - SDL:24/04/2014 - 12:23:46 ---A- . (.StdLib - StdLib.) -- C:\Windows\System32\Drivers\{42e50651-9669-456e-9081-d5a836274274}w64.sys [61112] =>PUP.LinkiDoo
O58 - SDL:26/06/2009 - 15:43:42 ---A- . (.Windows (R) Win 7 DDK provider - Embedded System Control.) -- C:\Windows\SysWOW64\drivers\EMSC.sys [13680]
~ Drivers: 85 Legitimates Filtered in 00mn 08s

---\\ Lista das ferramentas de remoção de vírus (LAT) (063)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman
~ ADS: Scanned in 00mn 00s

---\\ Menu de inicialização Internet (068)
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\Aleluia\AppData\Local\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe
~ Keys: Scanned in 00mn 00s

---\\ Pesquisa de infeção nos navegadores da Internet (SBI) (069)
O69 - SBI: SearchScopes [HKCU] Web - (Web) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} [DefaultScope] - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Keys: Scanned in 00mn 00s

---\\ Pesquisa adicional à raiz do sistema (radicular) (SPRF) (O84)
[MD5.3423CE16DA5F241E49F8999E835300FD] [SPRF][10/06/2012] (.Por Marcelo Ribeiro de Oliveira - 20/05/201 - A Bíblia Sagrada Versão Digital 6.7 Freeware Setup.) -- C:\Users\Aleluia\Desktop\ABSVD67Setup.exe [2205098]
[MD5.6A23617835EBFC0999582E5D6700E9B3] [SPRF][02/02/2013] (.TagSoft - TagComércio.) -- C:\Users\Aleluia\Desktop\store_free.exe [6241822]
~ Files: 2 Legitimates Filtered in 00mn 00s

---\\ Estado general dos serviços não Microsoft (EGS) (SR=Executados, SS=Parados)
SS - | Auto 23/12/2012 116648 | (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 23/12/2012 116648 | (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
SS - | Demand 22/10/2004 73728 | (IDriverT) . (.Macrovision Corporation.) - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
SS - | Auto 10/07/1658 0 | (KMService) . (...) - C:\Windows\system32\srvany.exe =>Hijacker.Office
SS - | Demand 13/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
SS - | Demand 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation
SR - | Auto 18/12/2013 65432 | (AdobeARMservice) . (.Adobe Systems Incorporated.) - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
SR - | Auto 07/01/2014 43336 | (Apple Mobile Device) . (.Apple Inc..) - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
SR - | Auto 22/10/2010 953632 | (btwdins) . (.Broadcom Corporation..) - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
SR - | Demand 13/07/2009 27136 | C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll (hpqcxs08) . (.Hewlett-Packard Co..) - C:\Windows\System32\svchost.exe
SR - | Auto 13/07/2009 27136 | C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll (hpqddsvc) . (.Hewlett-Packard Co..) - C:\Windows\System32\svchost.exe
SR - | Auto 14/03/2011 346976 | (HWDeviceService64.exe) . (...) - C:\ProgramData\DatacardService\HWDeviceService64.exe
SR - | Auto 05/11/2010 13336 | (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
SR - | Demand 06/02/2014 641352 | (iPod Service) . (.Apple Inc..) - C:\Program Files\iPod\bin\iPodService.exe
SR - | Auto 11/03/2014 23808 | (MsMpSvc) . (.Microsoft Corporation.) - c:\Program Files\Microsoft Security Client\MsMpEng.exe
SR - | Auto 20/07/2012 8186368 | (MySQL) . (...) - C:\MySQL\bin\mysqld.exe
SR - | Auto 13/07/2009 27136 | C:\Windows\system32\HPZinw12.dll (Net Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe
SR - | Auto 20/04/2010 27040 | (OrolixDeviceMonitor) . (.Orolix Desenvolvimento de Software LTDA..) - C:\Program Files (x86)\TIM Communicator\module\devicemon.exe
SR - | Auto 13/07/2009 27136 | C:\Windows\system32\HPZipm12.dll (Pml Driver HPZ12) . (.Hewlett-Packard.) - C:\Windows\System32\svchost.exe
SR - | Auto 01/11/2011 270672 | (UI Assistant Service) . (...) - C:\Program Files (x86)\Connection Manager\AssistantServices.exe
SR - | Auto 15/10/2013 48128 | (wltrysvc) . (.Broadcom Corporation.) - C:\Program Files\Broadcom\Broadcom 802.11 Network Adapter\WLTRYSVC.exe
SR - | Auto 13/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe
~ Services: Scanned in 00mn 07s

---\\ Scâner Aditional (088)
Database Version : 13045 - (08/05/2014)
Clés trouvées (Keys found) : 1
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 0
Fichiers trouvés (Files found) : 0

[HKLM\SYSTEM\CurrentControlSet\Services\KMService] =>Hijacker.Office^
~ Additionnel Scan: 290146 Items scanned in 00mn 22s

---\\ Sumário das deteções encontradas na sua estação
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Hijacker.Office
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>PUP.LinkiDoo
~ MSI: 2 link(s) detected in 00mn 00s

~ 771 Legitimates filtered by white list
End of the scan (483 lines in 01mn 32s)(0)

por **Power Max** Qui 08 maio 2014, 18:47

Selecione e copie todo o texto destacado em vermelho que te passei.
_____________________________________________________________________________________________________________

Certificado 772309

Vá no menu: Iniciar > Todos os programas > ZHP > Clique com o botão direito do mouse sobre o Zhpfix e escolha a opção de Executar como administrador > Clique em Importação > Clique no botão GO > Clique em Oui > Caso queira que os arquivos da lixeira sejam excluídos clique em Oui novamente > Um relatório aparecerá no bloco de notas.

Copie este relatório e poste em sua próxima resposta.

por **Danii** Sáb 24 maio 2014, 13:42

TÓPICO ARQUIVADO

Como a autora não respondeu por mais de 15 dias, o tópico foi arquivado. Caso a autora do tópico necessite, o mesmo será reaberto, para isso deverá entrar em contato com um dos membros da [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] solicitando o desbloqueio.

por Conteúdo patrocinado

Certificado

Certificado

Re: Certificado

Relatório Adwcleaner

Re: Certificado

relatório Zoek

Re: Certificado

Re: Certificado

JRT

Re: Certificado

Re: Certificado

Re: Certificado

relatório ZHP

Re: Certificado

Re: Certificado

Re: Certificado

Re: Certificado

Re: Certificado

Re: Certificado

Re: Certificado

Re: Certificado

Re: Certificado

Seg	Ter	Qua	Qui	Sex	Sáb	Dom
1	2	3	4	5	6	7
8	9	10	11	12	13	14
15	16	17	18	19	20	21
22	23	24	25	26	27	28
29	30