Como posso remover o sweet page do meu PC.

  Você fez certo, é assim mesmo.

Abra novamente o ( ZHPDiag )

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Clique "SEARCH" ou "PESQUISAR" e aguarde a conclusão.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Clique OK e, ao concluir, poste o relatório ZHPDiag.txt

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

~ Relatório do ZHPDiag v2014.6.23.97 - Nicolas Coolman  (23/6/2014)
~ Iniciado por Eros (24/6/2014 21:11:00)
~ Endereço do Website : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Tradução pelo utilizador
~ Estatuto da versão : Versão atualizada.
~  Lista Branca : Ativado pelo programa
~ Elevação dos Privilégios : OK
~ Controle de Conta de Utilizador : Not Found


---\\ Navegadores Internet
MSIE: Internet Explorer v6.0.2900.2180
GCIE: Google Chrome v35.0.1916.153 (Defaut)

---\\ Informações sobre os produtos Windows
~ Langage: Portugais
Microsoft Windows XP, 32-bit Service Pack 2 (Build 2600)
Windows Automatic Updates : OK
Windows Genuine Advantage : KO

---\\ Softwares de proteçao do sistema
avast! Internet Security v9.0.2018

---\\ Softwares d'optimização do sistema
CCleaner v4.14

---\\ Softwares de partilha do PeerToPeer (P2P)

---\\ Monitoramento dos softwares
Adobe Reader XI
Java 7 Update 60

---\\ Informações sobre o sistema
~ Processor: x86 Family 6 Model 15 Stepping 2, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 2046 MB (60% free)
System Restore: Activé (Enable)
System drive C: has 102 GB (87%) free of 117 GB

---\\ Modo de conexão ao sistema
~ Computer Name: CASA
~ User Name: Eros
~ All Users Names: SUPPORT_388945a0, Nadja, Jéssica, HelpAssistant, Eros, Convidado, Administrador,
~ Unselected Option: 045,061,O62,065,066,080,O82,089
Logged in as Administrator

---\\ As variáveis de ambiente
~ System Unit : C:\
~ %AppZHP% : C:\Documents and Settings\Eros\Dados de aplicativos\ZHP\
~ %AppData% : C:\Documents and Settings\Eros\Dados de aplicativos\
~ %Desktop% : C:\Documents and Settings\Eros\Desktop\
~ %Favorites% : C:\Documents and Settings\Eros\Favoritos\
~ %LocalAppData% : C:\Documents and Settings\Eros\Configurações locais\Dados de aplicativos\
~ %StartMenu% : C:\Documents and Settings\Eros\Menu Iniciar\
~ %Windir% : C:\WINDOWS\
~ %System% : C:\WINDOWS\system32\

---\\ Enumeração das unidades dos discos
A: Floppy drive, Flash card reader, USB Key (Not Inserted)
C: Hard drive, Flash drive, Thumb drive (Free 102 Go of 117 Go)
D: Hard drive, Flash drive, Thumb drive (Free 115 Go of 116 Go)
E: CD-ROM drive (Not Inserted)
G: Floppy drive, Flash card reader, USB Key (Free 1 Go of 2 Go)



---\\ Estado do Centro de Segurança do Windows
~ Security Center: 40 Legitimates Filtered in 00mn 00s



---\\ Pesquisa particular de ficheiros genéricos
[MD5.FA61A19050AE14BEC1A26DE82390DD65] - (.Microsoft Corporation - Windows Explorer.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\Explorer.exe [1034240]
[MD5.398A619CE60090303042D1F8CC68F712] - (.Microsoft Corporation - Internet Extensions para Win32.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\wininet.dll [658432]
[MD5.6F7BDE7A1126DEBF0CC359A54953EFC1] - (.Microsoft Corporation - Aplicativo de logon do Windows NT.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Winlogon.exe [504320]
[MD5.5AC495F4CB807B2B98AD2AD591E6D92E] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496]
[MD5.CDFE4411A69C224BD1D11B2DA92DAC51] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\atapi.sys [95360]
[MD5.CD7D5152DF32B47F4E36F710B35AAE02] - (.Microsoft Corporation - CD-ROM File System Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744]
[MD5.AF9C19B3100FE010496B1A27181FBF72] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [49536]
[MD5.8EC0D923CD6128DE73DDA0DF082BB985] - (.Microsoft Corporation - FIPS Crypto Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\Fips.sys [35072]
[MD5.CBC3DEF409549672B915FB9403D63F74] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.27/10/2004 - 15:21:36.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [138240]
[MD5.FCAD1D4A4724B6FA6F05A5DB7F89443C] - (.Microsoft Corporation - Driver de porta i8042.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [53760]
[MD5.F8AA320C6A0409C0380E5D8A99D76EC6] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [41856]
[MD5.B5A8E215AC29D24D60B4D1250EF05ACE] - (.Microsoft Corporation - IP Network Address Translator.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [134912]
[MD5.64537AA5C003A6AFEEE1DF819062D0D1] - (.Microsoft Corporation - IPSec Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [74752]
[MD5.1FD607FC67F7F7C633C3DA65BFC53D18] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [451456]
[MD5.0C80E410CD2F47134407EE7DD19CC86B] - (.Microsoft Corporation - MBT Transport driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\netBT.sys [162816]
[MD5.B78BE402C3F63DD55521F73876951CDD] - (.Microsoft Corporation - NT File System Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\ntfs.sys [574592]
[MD5.8B225D87CBE08A5CB090BBF9F7DE1D30] - (.Microsoft Corporation - Driver de porta paralela.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80384]
[MD5.98FAEB4A4DCF812BA1C6FCA4AA3E115C] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328]
[MD5.A2CAE2C60BC37E0751EF9DDA7CEAF4AD] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.3/8/2004 - 23:01:16.) -- C:\WINDOWS\system32\Drivers\rdpdr.sys [196864]
[MD5.DDD1A19CD2EDA2D6AE5AB61BAAEB4278] - (.Microsoft Corporation - Redbook Audio Filter Driver.) (.3/8/2004 - 21:36:32.) -- C:\WINDOWS\system32\Drivers\redbook.sys [57984]
[MD5.EB2F82AAEADCC9BAAC66CBA4D714E338] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [53248]
~ Generic Processes:  Scanned in 00mn 00s



---\\ Estatuto dos ficheiros ocultos (Oculto/Total)
~ Mes images (My Pictures) : 1/2
~ Mes musiques (My Musics) : 1/534
~ Mes Videos (My Videos) : 0/0
~ Mes Favoris (My Favorites) : 1/8
~ Mes Documents (My Documents) : 1/651
~ Mon Bureau (My Desktop) : 2/40
~ Menu demarrer (Programs) : 1/36
~ Hidden Files:  Scanned in 00mn 01s



---\\ Processos lançados
[MD5.37D17AE2936867F88EB3C4CBCBC6B8A1] - (.AVAST Software - avast! Service.) -- C:\Arquivos de programas\AVAST Software\Avast\AvastSvc.exe   [50344] [PID.1740]
[MD5.55FF0FFE359702D2E2B99DF5CBB3DD06] - (.AVAST Software - avast! firewall service.) -- C:\Arquivos de programas\AVAST Software\Avast\afwServ.exe   [109048] [PID.1924]
[MD5.E87885A59FDC241B6575943A75E495D9] - (.Oracle Corporation - Java Quick Starter Service.) -- C:\Arquivos de programas\Java\jre7\bin\jqs.exe   [182696] [PID.668]
[MD5.357CDE6C24EB15888E810C6D2787C238] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 169.0.) -- C:\WINDOWS\system32\nvsvc32.exe   [155716] [PID.776]
[MD5.28FECC2B93132BD283226E61C4011171] - (.No owner - Vtune : Display Control Panel.) -- C:\Arquivos de programas\Vtune\TBPanel.exe   [2162688] [PID.1520]
[MD5.5CA0EB9538C6ACEBDC3593FC53527B9D] - (.AVAST Software - avast! Antivirus.) -- C:\Arquivos de programas\AVAST Software\Avast\AvastUI.exe   [3890208] [PID.1572]
[MD5.697E07302EC965393ABC85AD5C2C8D53] - (.Microsoft Corporation - IPoint.exe.) -- C:\Arquivos de programas\Microsoft IntelliPoint\ipoint.exe   [1797008] [PID.1604]
[MD5.EDAD4A8A1D46AFCF9E76B996D55116EB] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe   [256896] [PID.1608]
[MD5.730EAD05B1FC178629F437F8A1D76E27] - (...) -- ystem32\RunDll32.exe   [0] [PID.1708]
[MD5.379C7AC3EBCB636ECDB704E188A96A13] - (.Microsoft Corporation - Application Layer Gateway Service.) -- C:\WINDOWS\System32\alg.exe   [44544] [PID.2176]
[MD5.A5FCD42334CCC682DA1882A54338686C] - (.Google Inc. - Google Chrome.) -- C:\Arquivos de programas\Google\Chrome\Application\chrome.exe   [860488] [PID.3240]
[MD5.79A2C7527829F70FD5E59287B700D47C] - (.Nicolas Coolman - ZHPDiag.) -- C:\Arquivos de programas\ZHPDiag\ZHPDiag.exe   [8071168] [PID.3744]
~ Processes Running:  Scanned in 00mn 01s



---\\ Internet Explorer, Gestão do Proxy (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management:  Scanned in 00mn 00s



---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas
F2 - REG:system.ini: USERINIT=C:\WINDOWS\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Keys:  Scanned in 00mn 00s



---\\ Redireção do ficheiro Hosts (01)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File:  Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 19



---\\ Barras do Internet Explorer (03))
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{01E04581-4EEE-11D0-BFE9-00AA005B4383} Chave orfã
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{0E5CBF21-D15F-11D0-8301-00AA005B4383} Chave orfã
~ Toolbar:  Scanned in 00mn 00s



---\\ Aplicações iniciadas por registo & pastas (04)
O4 - HKLM\..\Run: [Gainward] . (.No owner - Vtune : Display Control Panel.) -- C:\Arquivos de programas\Vtune\TBPanel.exe
O4 - HKLM\..\Run: [JMB36X Configure] . (.JMicron Technology Corp. - JMB36X RAID Configurer.) -- C:\WINDOWS\system32\JMRaidTool.exe
O4 - HKLM\..\Run: [AvastUI.exe] . (.AVAST Software - avast! Antivirus.) -- C:\Arquivos de programas\AVAST Software\Avast\AvastUI.exe
O4 - HKLM\..\Run: [IntelliPoint] . (.Microsoft Corporation - IPoint.exe.) -- C:\Arquivos de programas\Microsoft IntelliPoint\ipoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe   =>.Oracle Corporation
O4 - HKLM\..\Run: [NvCplDaemon] . (.NVIDIA Corporation - NVIDIA Display Properties Extension.) -- C:\WINDOWS\system32\NvCpl.dll   =>.NVIDIA Corporation
O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-21-484763869-2146948623-725345543-1004\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
~ Application:  Scanned in 00mn 00s



---\\ Boutões da barra de ferramentas principal do Internet Explorer (09)
O9 - Extra button: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft Office OneNote Internet Explorer Add-in.) -- C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Arquivos de programas\Microsoft Office\Office12\REFBARH.ICO
O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- C:\Arquivos de programas\Messenger\msmsgs.exe
~ IE Extra Buttons:  Scanned in 00mn 00s



---\\ Piratagem da Opção " Redefinir Configurações da Web " (014)
O14 - IERESET.INF: SEARCH_PAGE_URL=SEARCH_PAGE_URL="&http://home.microsoft.com/intl/br/access/allinone.asp"
O14 - IERESET.INF: SAFESITE_VALUE=SAFESITE_VALUE="search.msn.com.br"
~ IE Paramètres WEB:  Scanned in 00mn 00s



---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} ((no name)) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} ((no name)) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Objets ActiveX:  Scanned in 00mn 00s



---\\ Alteração Dominio/Clientes DNS (017)
O17 - HKLM\System\CCS\Services\Tcpip\..\{041B56BC-AF66-44DC-8BC0-601192A2936E}: DhcpNameServer = 189.4.0.157 189.4.0.152
O17 - HKLM\System\CS1\Services\Tcpip\..\{041B56BC-AF66-44DC-8BC0-601192A2936E}: DhcpNameServer = 189.4.0.157 189.4.0.152
O17 - HKLM\System\CS3\Services\Tcpip\..\{041B56BC-AF66-44DC-8BC0-601192A2936E}: DhcpNameServer = 189.4.0.157 189.4.0.152
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 189.4.0.157 189.4.0.152
~ Domain:  Scanned in 00mn 00s



---\\ Protocolo adicional (018)
O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} . (.Microsoft Corporation - WIA Scripting Layer.) -- C:\WINDOWS\system32\wiascr.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\OFFICE12\MSOXMLMF.dll  =>.Microsoft Corporation
~ Protocole Additionnel:  Scanned in 00mn 00s



---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dll
O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dll
O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agente de rede off-line.) -- C:\WINDOWS\system32\cscdll.dll
O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL de notificação do serviço de logon secu.) -- C:\WINDOWS\system32\sclgntfy.dll
O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\WlNotify.dll
O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\wlnotify.dll
~ Winlogon:  Scanned in 00mn 00s



---\\ Chave do Registo autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} . (.Microsoft Corporation - Biblioteca da interface de usuário do naveg.) -- C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Pré-carregador Browseui - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Biblioteca da interface de usuário do naveg.) -- C:\WINDOWS\system32\browseui.dll
~ STS/SSO:  Scanned in 00mn 00s



---\\ Enumeração Ativa do Ambiente de trabalho & Editor MHTML (024)
O24 - Desktop Component 0: Minha página inicial atual - file:About:Home
O24 - Desktop General: BackupWallPaper - .(...) - C:\WINDOWS\web\wallpaper\Alegria.bmp
O24 - Desktop General: WallPaper - .(...) - C:\WINDOWS\web\wallpaper\Alegria.bmp
~ Desktop Component: 4 Legitimates Filtered in 00mn 00s



---\\ Tarefas planificadas automaticamente (039)
O39 - APT:  - (..) -- C:\WINDOWS\Tasks\060184C3-9766-46a0-B258-F4518A0B2633.job   [450]
~ Scheduled Task: 6 Legitimates Filtered in 00mn 00s



---\\ Drivers lançados ao arranque do sistema (041)
O41 - Driver: (Bnbase) . (. - .) - C:\WINDOWS\system32\drivers\bnbase.sys (.not file.)
~ Drivers: 75 Legitimates Filtered in 00mn 00s



---\\ Software instalados (042)
O42 - Logiciel: BOL MA 3.00 11.00 - (...) [HKLM] -- OnlineBible
O42 - Logiciel: Enciclopédia Barsa CD - (...) [HKLM] -- BarsaCD
O42 - Logiciel: IRPF2013 - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva  - (.Receita Federal do Brasil.) [HKLM] -- IRPF2013
O42 - Logiciel: Receitanet - (.Serpro - Serviço Federal de Processamento de Dados.) [HKLM] -- ECC16E3C-16D1-4DC2-9D8A-6AC06B3005A5
O42 - Logiciel: Vtune 5.9 - (...) [HKLM] -- Vtune_is1
~ Logic: 31 Legitimates Filtered in 00mn 00s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\ForumerIT]  =>Toolbar.Forumer
[HKLM\Software\Cie Argentina]
[HKLM\Software\Quiknowledge]
[HKLM\Software\jumpshot.com]
~ Key Software: 157 Legitimates Filtered in 00mn 00s



---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 3/7/2013 - 16:44:04 - [] ----D C:\Arquivos de programas\Barsa CD
O43 - CFD: 25/9/2013 - 21:49:18 - [] ----D C:\Arquivos de programas\Longman
O43 - CFD: 24/6/2013 - 18:33:14 - [] ----D C:\Arquivos de programas\Serviços on-line
O43 - CFD: 24/6/2013 - 18:52:26 - [] ----D C:\Arquivos de programas\Vtune
O43 - CFD: 24/6/2013 - 18:32:21 - [] ----D C:\Arquivos de programas\Arquivos comuns\Serviços
O43 - CFD: 24/6/2013 - 18:40:06 - [] R---D C:\Documents and Settings\Eros\Menu Iniciar\Programas\Acessórios
O43 - CFD: 21/6/2014 - 10:37:41 - [] R---D C:\Documents and Settings\Eros\Menu Iniciar\Programas\Inicializar
O43 - CFD: 25/9/2013 - 21:53:21 - [] ----D C:\Documents and Settings\Eros\Menu Iniciar\Programas\Longman
O43 - CFD: 23/4/2014 - 05:03:58 - [] ----D C:\Documents and Settings\Eros\Menu Iniciar\Programas\Programas RFB2013
~ Program Folder: 87 Legitimates Filtered in 00mn 00s



---\\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044)
O44 - LFC:[MD5.0DC5AF80D059DEC792B665ED598C6567] - 18/6/2014 - 19:45:01 ---A- . (.SQLite Development Team - SQLite Dynamic Link Library (No TCL).) -- C:\WINDOWS\system32\sqlite3.dll   [536576]
O44 - LFC:[MD5.667BA88F645BBEE710315967236F98C2] - 18/6/2014 - 19:52:07 ---A- . (...) -- C:\Atalho para Disco local (D).lnk   [275]
O44 - LFC:[MD5.A2CE7EAFA03686B74D8E3AFC096242F8] - 18/6/2014 - 21:04:31 ---A- . (...) -- C:\Atalho (2) para Disco local (D).lnk   [275]
O44 - LFC:[MD5.B4D2716BD9F9212FF59B136E6AB790F1] - 23/6/2014 - 21:14:25 ---A- . (...) -- C:\zoek-results2014-06-24-001425.log   [9478]
O44 - LFC:[MD5.D3B81A833A790D041A41C793D3590C78] - 23/6/2014 - 23:19:35 ---A- . (...) -- C:\zoek-results.log   [1195]
O44 - LFC:[MD5.F94F39113C7BDC01B9DF9D7D7F76AF07] - 24/6/2014 - 21:02:20 ---A- . (...) -- C:\WINDOWS\wiaservc.log   [49]
O44 - LFC:[MD5.4D2909CB983E30B2414973A629CF6641] - 24/6/2014 - 21:02:24 ---A- . (...) -- C:\WINDOWS\wiadebug.log   [157]
O44 - LFC:[MD5.08D8829F06A09113C4FE1DBA75B2A4CF] - 24/6/2014 - 21:07:00 ---A- . (...) -- C:\WINDOWS\DFC.INI   [558]
~ Files: 21 Legitimates Filtered in 00mn 04s



---\\ Operações e funções ao arranque do Windows Explorer (046)
O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll
~ ShellExecuteHooks:  Scanned in 00mn 00s



---\\ Image File Execution Options (IFEO) (O50)
O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d
~ IFEO:  Scanned in 00mn 00s



---\\ Chave do registo Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{61ae5d0d-100a-11e3-8aba-000000000010}\AutoRun\command. (...) -- F:\urDrive.exe (.not file.)
~ Keys:  Scanned in 00mn 00s



---\\ Enumeração das chaves do registo PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoInstrumentation"=1
~ MWPE Keys: 2 Legitimates Filtered in 00mn 00s



---\\ Lista dos drivers do sistema (SDL) (O58)
O58 - SDL:5/10/2005 - 14:21:10 R--A- . (.Analog Devices, Inc. - High Definition Audio Function Driver(Release Candidate 1).) -- C:\WINDOWS\system32\Drivers\ADIHdAud.sys   [141312]
O58 - SDL:12/8/2004 - 23:56:20 R--A- . (.No owner - ATK0110 ACPI Utility.) -- C:\WINDOWS\system32\Drivers\ASACPI.sys   [5810]
O58 - SDL:27/4/2004 - 12:26:48 ---A- . (...) -- C:\WINDOWS\system32\Drivers\ASUSHWIO.SYS   [5824]
O58 - SDL:27/5/2014 - 19:45:07 ---A- . (...) -- C:\WINDOWS\system32\Drivers\aswHwid.sys   [24184]  =>.ALWIL Software
O58 - SDL:27/5/2014 - 19:44:56 ---A- . (.ALWIL Software - avast! Filtering NDIS driver.) -- C:\WINDOWS\system32\Drivers\aswNdis.sys   [12112]
O58 - SDL:27/5/2014 - 19:45:07 ---A- . (...) -- C:\WINDOWS\system32\Drivers\aswRvrt.sys   [49944]  =>.ALWIL Software
O58 - SDL:27/5/2014 - 19:45:07 ---A- . (...) -- C:\WINDOWS\system32\Drivers\aswVmm.sys   [180632]  =>.ALWIL Software
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (.RAVISENT Technologies Inc. - CineMaster C 1.2 WDM Main Driver.) -- C:\WINDOWS\system32\Drivers\cinemst2.sys   [262528]
O58 - SDL:27/10/2004 - 15:21:36 ----- . (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) -- C:\WINDOWS\system32\Drivers\Hdaudbus.sys   [138240]
O58 - SDL:27/10/2004 - 15:21:30 ----- . (.Windows (R) Server 2003 DDK provider - High Definition Audio Function Driver v1.0a.) -- C:\WINDOWS\system32\Drivers\Hdaudio.sys   [145920]
O58 - SDL:3/8/2004 - 22:41:40 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\mtlmnt5.sys   [126686]
O58 - SDL:3/8/2004 - 22:41:38 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\mtlstrm.sys   [1309184]
O58 - SDL:3/8/2004 - 22:29:38 ----- . (.Matrox Graphics Inc. - Matrox Parhelia Miniport Driver.) -- C:\WINDOWS\system32\Drivers\mtxparhm.sys   [452736]
O58 - SDL:3/8/2004 - 22:41:40 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\ntmtlfax.sys   [180360]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (.Parallel Technologies, Inc. - Parallel Technologies DirectParallel IO Library.) -- C:\WINDOWS\system32\Drivers\ptilink.sys   [17792]
O58 - SDL:3/8/2004 - 22:41:40 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\recagent.sys   [13776]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\Drivers\secdrv.sys   [27440]
O58 - SDL:11/8/2005 - 10:49:28 R--A- . (.Sensaura - Sensaura WDM 3D Audio Driver.) -- C:\WINDOWS\system32\Drivers\senfilt.sys   [393088]
O58 - SDL:3/8/2004 - 22:41:42 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\slnt7554.sys   [129535]
O58 - SDL:3/8/2004 - 22:41:44 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\slntamr.sys   [404990]
O58 - SDL:3/8/2004 - 22:41:46 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\slnthal.sys   [95424]
O58 - SDL:3/8/2004 - 22:41:46 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\slwdmsup.sys   [13240]
O58 - SDL:16/3/2007 - 10:11:38 ---A- . (.Windows (R) 2000 DDK provider - Display Control Program.) -- C:\WINDOWS\system32\Drivers\TBPanel.sys   [12256]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (.RAVISENT Technologies Inc. - CineMaster C WDM DVD Minidriver.) -- C:\WINDOWS\system32\Drivers\vdmindvd.sys   [58112]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ansi.sys   [9032]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\country.sys   [27097]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\himem.sys   [4896]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\key01.sys   [42809]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\keyboard.sys   [42537]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos.sys   [27900]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos404.sys   [29146]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos411.sys   [29370]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos412.sys   [29274]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos804.sys   [29146]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio.sys   [33984]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio404.sys   [34560]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio411.sys   [35648]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio412.sys   [35424]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio804.sys   [34560]
~ Drivers: 97 Legitimates Filtered in 00mn 01s



---\\ Lista das ferramentas de remoção de vírus (LAT) (063)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1  =>.Nicolas Coolman
~ ADS:  Scanned in 00mn 00s



---\\ Lista dos serviços Legacy du registo (064)
O64 - Services: CurCS - 27/5/2014 - C:\WINDOWS\system32\drivers\aswHwid.sys (aswHwid) .(...) - LEGACY_ASWHWID
~ Legacy: 117 Legitimates Filtered in 00mn 00s



---\\ Associações Shell Spawning (O67)
O67 - Shell Spawning: <.html> [HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 10 Legitimates Filtered in 00mn 00s



---\\ Menu de inicialização Internet (068)
O68 - StartMenuInternet: <>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Arquivos de programas\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Arquivos de programas\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: [HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- c:\arquivos de programas\internet explorer\iexplore.exe
~ Keys:  Scanned in 00mn 00s



---\\ Pesquisa de infeção nos navegadores da Internet (SBI) (069)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Keys:  Scanned in 00mn 00s



---\\ Pesquisa adicional à raiz do sistema (radicular) (SPRF) (O84)
[MD5.333A79F1A3964AF2A17AB2C88AF677DE] [SPRF][13/4/2014] (.No owner - Uninstall Receitanet 1.04.) -- C:\Documents and Settings\Eros\Desktop\Desinstalador.exe   [1605083]
[MD5.BDB0B87D300B3AEB98797FF0A3C54924] [SPRF][9/11/2010] (...) -- C:\Documents and Settings\Eros\Desktop\FSCapture.exe   [1111552]
[MD5.E3C43F58C5299EB2F2C0617A9F205946] [SPRF][10/5/2013] (...) -- C:\Documents and Settings\Eros\Desktop\receitanet.dat   [42]
[MD5.7EEBD2FC5E927CDA3ACC1CFEA699D8FE] [SPRF][10/5/2013] (...) -- C:\Documents and Settings\Eros\Desktop\receitanet.exe   [452096]
~ Files: 4 Legitimates Filtered in 00mn 00s



---\\ Estado general dos serviços não Microsoft (EGS) (SR=Executados, SS=Parados)
SS - | Demand 2/3/2006 225280 |  (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\system32\dmadmin.exe
SS - | Auto 8/6/2014 116648 |  (gupdate) . (.Google Inc..) - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe
SS - | Demand 8/6/2014 116648 |  (gupdatem) . (.Google Inc..) - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe
SR - | Auto 27/5/2014 50344 |  (avast! Antivirus) . (.AVAST Software.) - C:\Arquivos de programas\AVAST Software\Avast\AvastSvc.exe
SR - | Auto 27/5/2014 109048 |  (avast! Firewall) . (.AVAST Software.) - C:\Arquivos de programas\AVAST Software\Avast\afwServ.exe
SR - | Auto 21/6/2014 182696 |  (JavaQuickStarterService) . (.Oracle Corporation.) - C:\Arquivos de programas\Java\jre7\bin\jqs.exe
SR - | Auto 28/11/2007 155716 |  (NVSvc) . (.NVIDIA Corporation.) - C:\WINDOWS\system32\nvsvc32.exe
~ Services:  Scanned in 00mn 05s



---\\ Scâner Aditional (088)
Database Version : 13026 - (23/6/2014)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 0
Dossiers trouvés  (Folders found) : 0
Fichiers trouvés  (Files found) : 1

[HKCU\Software\ForumerIT]   =>Toolbar.Forumer^
~ Additionnel Scan: 121254 Items scanned in 00mn 23s



---\\ Informações complémentaires do módulos
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>.Internet Explorer, Gestão do Proxy (R5)
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>.Barras do Internet Explorer (03))
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>.Aplicações iniciadas por registo & pastas (04)
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>.Image File Execution Options (IFEO) (O50)
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>.Chave do registo Shell MountPoints2 (MPKS) (O51)
~ AMI: 5 Legitimates Filtered in 00mn 00s



---\\ Sumário das deteções encontradas na sua estação
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>Toolbar.Forumer
~ MSI: 1 link(s) detected in 00mn 00s



~ 636 Legitimates filtered by white list
End of the scan (452 lines in 00mn 58s)(0)

~ Relatório do ZHPDiag v2014.6.23.97 - Nicolas Coolman  (23/6/2014)
~ Iniciado por Eros (24/6/2014 21:11:00)
~ Endereço do Website : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Tradução pelo utilizador
~ Estatuto da versão : Versão atualizada.
~  Lista Branca : Ativado pelo programa
~ Elevação dos Privilégios : OK
~ Controle de Conta de Utilizador : Not Found


---\\ Navegadores Internet
MSIE: Internet Explorer v6.0.2900.2180
GCIE: Google Chrome v35.0.1916.153 (Defaut)

---\\ Informações sobre os produtos Windows
~ Langage: Portugais
Microsoft Windows XP, 32-bit Service Pack 2 (Build 2600)
Windows Automatic Updates : OK
Windows Genuine Advantage : KO

---\\ Softwares de proteçao do sistema
avast! Internet Security v9.0.2018

---\\ Softwares d'optimização do sistema
CCleaner v4.14

---\\ Softwares de partilha do PeerToPeer (P2P)

---\\ Monitoramento dos softwares
Adobe Reader XI
Java 7 Update 60

---\\ Informações sobre o sistema
~ Processor: x86 Family 6 Model 15 Stepping 2, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 2046 MB (60% free)
System Restore: Activé (Enable)
System drive C: has 102 GB (87%) free of 117 GB

---\\ Modo de conexão ao sistema
~ Computer Name: CASA
~ User Name: Eros
~ All Users Names: SUPPORT_388945a0, Nadja, Jéssica, HelpAssistant, Eros, Convidado, Administrador,
~ Unselected Option: 045,061,O62,065,066,080,O82,089
Logged in as Administrator

---\\ As variáveis de ambiente
~ System Unit : C:\
~ %AppZHP% : C:\Documents and Settings\Eros\Dados de aplicativos\ZHP\
~ %AppData% : C:\Documents and Settings\Eros\Dados de aplicativos\
~ %Desktop% : C:\Documents and Settings\Eros\Desktop\
~ %Favorites% : C:\Documents and Settings\Eros\Favoritos\
~ %LocalAppData% : C:\Documents and Settings\Eros\Configurações locais\Dados de aplicativos\
~ %StartMenu% : C:\Documents and Settings\Eros\Menu Iniciar\
~ %Windir% : C:\WINDOWS\
~ %System% : C:\WINDOWS\system32\

---\\ Enumeração das unidades dos discos
A: Floppy drive, Flash card reader, USB Key (Not Inserted)
C: Hard drive, Flash drive, Thumb drive (Free 102 Go of 117 Go)
D: Hard drive, Flash drive, Thumb drive (Free 115 Go of 116 Go)
E: CD-ROM drive (Not Inserted)
G: Floppy drive, Flash card reader, USB Key (Free 1 Go of 2 Go)



---\\ Estado do Centro de Segurança do Windows
~ Security Center: 40 Legitimates Filtered in 00mn 00s



---\\ Pesquisa particular de ficheiros genéricos
[MD5.FA61A19050AE14BEC1A26DE82390DD65] - (.Microsoft Corporation - Windows Explorer.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\Explorer.exe [1034240]
[MD5.398A619CE60090303042D1F8CC68F712] - (.Microsoft Corporation - Internet Extensions para Win32.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\wininet.dll [658432]
[MD5.6F7BDE7A1126DEBF0CC359A54953EFC1] - (.Microsoft Corporation - Aplicativo de logon do Windows NT.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Winlogon.exe [504320]
[MD5.5AC495F4CB807B2B98AD2AD591E6D92E] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\AFD.sys [138496]
[MD5.CDFE4411A69C224BD1D11B2DA92DAC51] - (.Microsoft Corporation - IDE/ATAPI Port Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\atapi.sys [95360]
[MD5.CD7D5152DF32B47F4E36F710B35AAE02] - (.Microsoft Corporation - CD-ROM File System Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [63744]
[MD5.AF9C19B3100FE010496B1A27181FBF72] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [49536]
[MD5.8EC0D923CD6128DE73DDA0DF082BB985] - (.Microsoft Corporation - FIPS Crypto Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\Fips.sys [35072]
[MD5.CBC3DEF409549672B915FB9403D63F74] - (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) (.27/10/2004 - 15:21:36.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [138240]
[MD5.FCAD1D4A4724B6FA6F05A5DB7F89443C] - (.Microsoft Corporation - Driver de porta i8042.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [53760]
[MD5.F8AA320C6A0409C0380E5D8A99D76EC6] - (.Microsoft Corporation - IMAPI Kernel Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\Imapi.sys [41856]
[MD5.B5A8E215AC29D24D60B4D1250EF05ACE] - (.Microsoft Corporation - IP Network Address Translator.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [134912]
[MD5.64537AA5C003A6AFEEE1DF819062D0D1] - (.Microsoft Corporation - IPSec Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\IPSec.sys [74752]
[MD5.1FD607FC67F7F7C633C3DA65BFC53D18] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [451456]
[MD5.0C80E410CD2F47134407EE7DD19CC86B] - (.Microsoft Corporation - MBT Transport driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\netBT.sys [162816]
[MD5.B78BE402C3F63DD55521F73876951CDD] - (.Microsoft Corporation - NT File System Driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\ntfs.sys [574592]
[MD5.8B225D87CBE08A5CB090BBF9F7DE1D30] - (.Microsoft Corporation - Driver de porta paralela.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\Parport.sys [80384]
[MD5.98FAEB4A4DCF812BA1C6FCA4AA3E115C] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [51328]
[MD5.A2CAE2C60BC37E0751EF9DDA7CEAF4AD] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.3/8/2004 - 23:01:16.) -- C:\WINDOWS\system32\Drivers\rdpdr.sys [196864]
[MD5.DDD1A19CD2EDA2D6AE5AB61BAAEB4278] - (.Microsoft Corporation - Redbook Audio Filter Driver.) (.3/8/2004 - 21:36:32.) -- C:\WINDOWS\system32\Drivers\redbook.sys [57984]
[MD5.EB2F82AAEADCC9BAAC66CBA4D714E338] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.2/3/2006 - 09:00:00.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [53248]
~ Generic Processes:  Scanned in 00mn 00s



---\\ Estatuto dos ficheiros ocultos (Oculto/Total)
~ Mes images (My Pictures) : 1/2
~ Mes musiques (My Musics) : 1/534
~ Mes Videos (My Videos) : 0/0
~ Mes Favoris (My Favorites) : 1/8
~ Mes Documents (My Documents) : 1/651
~ Mon Bureau (My Desktop) : 2/40
~ Menu demarrer (Programs) : 1/36
~ Hidden Files:  Scanned in 00mn 01s



---\\ Processos lançados
[MD5.37D17AE2936867F88EB3C4CBCBC6B8A1] - (.AVAST Software - avast! Service.) -- C:\Arquivos de programas\AVAST Software\Avast\AvastSvc.exe   [50344] [PID.1740]
[MD5.55FF0FFE359702D2E2B99DF5CBB3DD06] - (.AVAST Software - avast! firewall service.) -- C:\Arquivos de programas\AVAST Software\Avast\afwServ.exe   [109048] [PID.1924]
[MD5.E87885A59FDC241B6575943A75E495D9] - (.Oracle Corporation - Java Quick Starter Service.) -- C:\Arquivos de programas\Java\jre7\bin\jqs.exe   [182696] [PID.668]
[MD5.357CDE6C24EB15888E810C6D2787C238] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 169.0.) -- C:\WINDOWS\system32\nvsvc32.exe   [155716] [PID.776]
[MD5.28FECC2B93132BD283226E61C4011171] - (.No owner - Vtune : Display Control Panel.) -- C:\Arquivos de programas\Vtune\TBPanel.exe   [2162688] [PID.1520]
[MD5.5CA0EB9538C6ACEBDC3593FC53527B9D] - (.AVAST Software - avast! Antivirus.) -- C:\Arquivos de programas\AVAST Software\Avast\AvastUI.exe   [3890208] [PID.1572]
[MD5.697E07302EC965393ABC85AD5C2C8D53] - (.Microsoft Corporation - IPoint.exe.) -- C:\Arquivos de programas\Microsoft IntelliPoint\ipoint.exe   [1797008] [PID.1604]
[MD5.EDAD4A8A1D46AFCF9E76B996D55116EB] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe   [256896] [PID.1608]
[MD5.730EAD05B1FC178629F437F8A1D76E27] - (...) -- ystem32\RunDll32.exe   [0] [PID.1708]
[MD5.379C7AC3EBCB636ECDB704E188A96A13] - (.Microsoft Corporation - Application Layer Gateway Service.) -- C:\WINDOWS\System32\alg.exe   [44544] [PID.2176]
[MD5.A5FCD42334CCC682DA1882A54338686C] - (.Google Inc. - Google Chrome.) -- C:\Arquivos de programas\Google\Chrome\Application\chrome.exe   [860488] [PID.3240]
[MD5.79A2C7527829F70FD5E59287B700D47C] - (.Nicolas Coolman - ZHPDiag.) -- C:\Arquivos de programas\ZHPDiag\ZHPDiag.exe   [8071168] [PID.3744]
~ Processes Running:  Scanned in 00mn 01s



---\\ Internet Explorer, Gestão do Proxy (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management:  Scanned in 00mn 00s



---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas
F2 - REG:system.ini: USERINIT=C:\WINDOWS\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe
F2 - REG:system.ini: VMApplet=rundll32 shell32,Control_RunDLL "sysdm.cpl"
~ Keys:  Scanned in 00mn 00s



---\\ Redireção do ficheiro Hosts (01)
~ Le fichier hosts est sain (The hosts file is clean).
~ Hosts File:  Scanned in 00mn 00s
~ Nombre de lignes (Lines number): 19



---\\ Barras do Internet Explorer (03))
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{01E04581-4EEE-11D0-BFE9-00AA005B4383} Chave orfã
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{0E5CBF21-D15F-11D0-8301-00AA005B4383} Chave orfã
~ Toolbar:  Scanned in 00mn 00s



---\\ Aplicações iniciadas por registo & pastas (04)
O4 - HKLM\..\Run: [Gainward] . (.No owner - Vtune : Display Control Panel.) -- C:\Arquivos de programas\Vtune\TBPanel.exe
O4 - HKLM\..\Run: [JMB36X Configure] . (.JMicron Technology Corp. - JMB36X RAID Configurer.) -- C:\WINDOWS\system32\JMRaidTool.exe
O4 - HKLM\..\Run: [AvastUI.exe] . (.AVAST Software - avast! Antivirus.) -- C:\Arquivos de programas\AVAST Software\Avast\AvastUI.exe
O4 - HKLM\..\Run: [IntelliPoint] . (.Microsoft Corporation - IPoint.exe.) -- C:\Arquivos de programas\Microsoft IntelliPoint\ipoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] . (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe   =>.Oracle Corporation
O4 - HKLM\..\Run: [NvCplDaemon] . (.NVIDIA Corporation - NVIDIA Display Properties Extension.) -- C:\WINDOWS\system32\NvCpl.dll   =>.NVIDIA Corporation
O4 - HKCU\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\CTFMON.exe
O4 - HKUS\S-1-5-21-484763869-2146948623-725345543-1004\..\Run: [ctfmon.exe] . (.Microsoft Corporation - CTF Loader.) -- C:\WINDOWS\system32\ctfmon.exe
~ Application:  Scanned in 00mn 00s



---\\ Boutões da barra de ferramentas principal do Internet Explorer (09)
O9 - Extra button: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft Office OneNote Internet Explorer Add-in.) -- C:\ARQUIV~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Arquivos de programas\Microsoft Office\Office12\REFBARH.ICO
O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} . (.Microsoft Corporation - Windows Messenger.) -- C:\Arquivos de programas\Messenger\msmsgs.exe
~ IE Extra Buttons:  Scanned in 00mn 00s



---\\ Piratagem da Opção " Redefinir Configurações da Web " (014)
O14 - IERESET.INF: SEARCH_PAGE_URL=SEARCH_PAGE_URL="&http://home.microsoft.com/intl/br/access/allinone.asp"
O14 - IERESET.INF: SAFESITE_VALUE=SAFESITE_VALUE="search.msn.com.br"
~ IE Paramètres WEB:  Scanned in 00mn 00s



---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} ((no name)) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} ((no name)) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Objets ActiveX:  Scanned in 00mn 00s



---\\ Alteração Dominio/Clientes DNS (017)
O17 - HKLM\System\CCS\Services\Tcpip\..\{041B56BC-AF66-44DC-8BC0-601192A2936E}: DhcpNameServer = 189.4.0.157 189.4.0.152
O17 - HKLM\System\CS1\Services\Tcpip\..\{041B56BC-AF66-44DC-8BC0-601192A2936E}: DhcpNameServer = 189.4.0.157 189.4.0.152
O17 - HKLM\System\CS3\Services\Tcpip\..\{041B56BC-AF66-44DC-8BC0-601192A2936E}: DhcpNameServer = 189.4.0.157 189.4.0.152
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 189.4.0.157 189.4.0.152
~ Domain:  Scanned in 00mn 00s



---\\ Protocolo adicional (018)
O18 - Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} . (.Microsoft Corporation - WIA Scripting Layer.) -- C:\WINDOWS\system32\wiascr.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\OFFICE12\MSOXMLMF.dll  =>.Microsoft Corporation
~ Protocole Additionnel:  Scanned in 00mn 00s



---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: crypt32chain . (.Microsoft Corporation - Crypto API32.) -- C:\WINDOWS\system32\crypt32.dll
O20 - Winlogon Notify: cryptnet . (.Microsoft Corporation - Crypto Network Related API.) -- C:\WINDOWS\system32\cryptnet.dll
O20 - Winlogon Notify: cscdll . (.Microsoft Corporation - Agente de rede off-line.) -- C:\WINDOWS\system32\cscdll.dll
O20 - Winlogon Notify: ScCertProp . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: Schedule . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: sclgntfy . (.Microsoft Corporation - DLL de notificação do serviço de logon secu.) -- C:\WINDOWS\system32\sclgntfy.dll
O20 - Winlogon Notify: SensLogn . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\WlNotify.dll
O20 - Winlogon Notify: termsrv . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\wlnotify.dll
O20 - Winlogon Notify: wlballoon . (.Microsoft Corporation - DLL comum para receber notificações do Winl.) -- C:\WINDOWS\system32\wlnotify.dll
~ Winlogon:  Scanned in 00mn 00s



---\\ Chave do Registo autorun SharedTaskScheduler (STS) (O22)
O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} . (.Microsoft Corporation - Biblioteca da interface de usuário do naveg.) -- C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Pré-carregador Browseui - {8C7461EF-2B13-11d2-BE35-3078302C2030} . (.Microsoft Corporation - Biblioteca da interface de usuário do naveg.) -- C:\WINDOWS\system32\browseui.dll
~ STS/SSO:  Scanned in 00mn 00s



---\\ Enumeração Ativa do Ambiente de trabalho & Editor MHTML (024)
O24 - Desktop Component 0: Minha página inicial atual - file:About:Home
O24 - Desktop General: BackupWallPaper - .(...) - C:\WINDOWS\web\wallpaper\Alegria.bmp
O24 - Desktop General: WallPaper - .(...) - C:\WINDOWS\web\wallpaper\Alegria.bmp
~ Desktop Component: 4 Legitimates Filtered in 00mn 00s



---\\ Tarefas planificadas automaticamente (039)
O39 - APT:  - (..) -- C:\WINDOWS\Tasks\060184C3-9766-46a0-B258-F4518A0B2633.job   [450]
~ Scheduled Task: 6 Legitimates Filtered in 00mn 00s



---\\ Drivers lançados ao arranque do sistema (041)
O41 - Driver: (Bnbase) . (. - .) - C:\WINDOWS\system32\drivers\bnbase.sys (.not file.)
~ Drivers: 75 Legitimates Filtered in 00mn 00s



---\\ Software instalados (042)
O42 - Logiciel: BOL MA 3.00 11.00 - (...) [HKLM] -- OnlineBible
O42 - Logiciel: Enciclopédia Barsa CD - (...) [HKLM] -- BarsaCD
O42 - Logiciel: IRPF2013 - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva  - (.Receita Federal do Brasil.) [HKLM] -- IRPF2013
O42 - Logiciel: Receitanet - (.Serpro - Serviço Federal de Processamento de Dados.) [HKLM] -- ECC16E3C-16D1-4DC2-9D8A-6AC06B3005A5
O42 - Logiciel: Vtune 5.9 - (...) [HKLM] -- Vtune_is1
~ Logic: 31 Legitimates Filtered in 00mn 00s



---\\ HKCU & HKLM Software Keys
[HKCU\Software\ForumerIT]  =>Toolbar.Forumer
[HKLM\Software\Cie Argentina]
[HKLM\Software\Quiknowledge]
[HKLM\Software\jumpshot.com]
~ Key Software: 157 Legitimates Filtered in 00mn 00s



---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43)
O43 - CFD: 3/7/2013 - 16:44:04 - [] ----D C:\Arquivos de programas\Barsa CD
O43 - CFD: 25/9/2013 - 21:49:18 - [] ----D C:\Arquivos de programas\Longman
O43 - CFD: 24/6/2013 - 18:33:14 - [] ----D C:\Arquivos de programas\Serviços on-line
O43 - CFD: 24/6/2013 - 18:52:26 - [] ----D C:\Arquivos de programas\Vtune
O43 - CFD: 24/6/2013 - 18:32:21 - [] ----D C:\Arquivos de programas\Arquivos comuns\Serviços
O43 - CFD: 24/6/2013 - 18:40:06 - [] R---D C:\Documents and Settings\Eros\Menu Iniciar\Programas\Acessórios
O43 - CFD: 21/6/2014 - 10:37:41 - [] R---D C:\Documents and Settings\Eros\Menu Iniciar\Programas\Inicializar
O43 - CFD: 25/9/2013 - 21:53:21 - [] ----D C:\Documents and Settings\Eros\Menu Iniciar\Programas\Longman
O43 - CFD: 23/4/2014 - 05:03:58 - [] ----D C:\Documents and Settings\Eros\Menu Iniciar\Programas\Programas RFB2013
~ Program Folder: 87 Legitimates Filtered in 00mn 00s



---\\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044)
O44 - LFC:[MD5.0DC5AF80D059DEC792B665ED598C6567] - 18/6/2014 - 19:45:01 ---A- . (.SQLite Development Team - SQLite Dynamic Link Library (No TCL).) -- C:\WINDOWS\system32\sqlite3.dll   [536576]
O44 - LFC:[MD5.667BA88F645BBEE710315967236F98C2] - 18/6/2014 - 19:52:07 ---A- . (...) -- C:\Atalho para Disco local (D).lnk   [275]
O44 - LFC:[MD5.A2CE7EAFA03686B74D8E3AFC096242F8] - 18/6/2014 - 21:04:31 ---A- . (...) -- C:\Atalho (2) para Disco local (D).lnk   [275]
O44 - LFC:[MD5.B4D2716BD9F9212FF59B136E6AB790F1] - 23/6/2014 - 21:14:25 ---A- . (...) -- C:\zoek-results2014-06-24-001425.log   [9478]
O44 - LFC:[MD5.D3B81A833A790D041A41C793D3590C78] - 23/6/2014 - 23:19:35 ---A- . (...) -- C:\zoek-results.log   [1195]
O44 - LFC:[MD5.F94F39113C7BDC01B9DF9D7D7F76AF07] - 24/6/2014 - 21:02:20 ---A- . (...) -- C:\WINDOWS\wiaservc.log   [49]
O44 - LFC:[MD5.4D2909CB983E30B2414973A629CF6641] - 24/6/2014 - 21:02:24 ---A- . (...) -- C:\WINDOWS\wiadebug.log   [157]
O44 - LFC:[MD5.08D8829F06A09113C4FE1DBA75B2A4CF] - 24/6/2014 - 21:07:00 ---A- . (...) -- C:\WINDOWS\DFC.INI   [558]
~ Files: 21 Legitimates Filtered in 00mn 04s



---\\ Operações e funções ao arranque do Windows Explorer (046)
O46 - SEH:ShellExecuteHooks - URL Exec Hook - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - shell32.dll
~ ShellExecuteHooks:  Scanned in 00mn 00s



---\\ Image File Execution Options (IFEO) (O50)
O50 - IFEO:Image File Execution Options - Your Image File Name Here without a path - ntsd -d
~ IFEO:  Scanned in 00mn 00s



---\\ Chave do registo Shell MountPoints2 (MPKS) (O51)
O51 - MPSK:{61ae5d0d-100a-11e3-8aba-000000000010}\AutoRun\command. (...) -- F:\urDrive.exe (.not file.)
~ Keys:  Scanned in 00mn 00s



---\\ Enumeração das chaves do registo PoliciesExplorer (MWPE) (O56)
O56 - MWPE:[HKCU\...\policies\Explorer] - "NoInstrumentation"=1
~ MWPE Keys: 2 Legitimates Filtered in 00mn 00s



---\\ Lista dos drivers do sistema (SDL) (O58)
O58 - SDL:5/10/2005 - 14:21:10 R--A- . (.Analog Devices, Inc. - High Definition Audio Function Driver(Release Candidate 1).) -- C:\WINDOWS\system32\Drivers\ADIHdAud.sys   [141312]
O58 - SDL:12/8/2004 - 23:56:20 R--A- . (.No owner - ATK0110 ACPI Utility.) -- C:\WINDOWS\system32\Drivers\ASACPI.sys   [5810]
O58 - SDL:27/4/2004 - 12:26:48 ---A- . (...) -- C:\WINDOWS\system32\Drivers\ASUSHWIO.SYS   [5824]
O58 - SDL:27/5/2014 - 19:45:07 ---A- . (...) -- C:\WINDOWS\system32\Drivers\aswHwid.sys   [24184]  =>.ALWIL Software
O58 - SDL:27/5/2014 - 19:44:56 ---A- . (.ALWIL Software - avast! Filtering NDIS driver.) -- C:\WINDOWS\system32\Drivers\aswNdis.sys   [12112]
O58 - SDL:27/5/2014 - 19:45:07 ---A- . (...) -- C:\WINDOWS\system32\Drivers\aswRvrt.sys   [49944]  =>.ALWIL Software
O58 - SDL:27/5/2014 - 19:45:07 ---A- . (...) -- C:\WINDOWS\system32\Drivers\aswVmm.sys   [180632]  =>.ALWIL Software
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (.RAVISENT Technologies Inc. - CineMaster C 1.2 WDM Main Driver.) -- C:\WINDOWS\system32\Drivers\cinemst2.sys   [262528]
O58 - SDL:27/10/2004 - 15:21:36 ----- . (.Windows (R) Server 2003 DDK provider - High Definition Audio Bus Driver v1.0a.) -- C:\WINDOWS\system32\Drivers\Hdaudbus.sys   [138240]
O58 - SDL:27/10/2004 - 15:21:30 ----- . (.Windows (R) Server 2003 DDK provider - High Definition Audio Function Driver v1.0a.) -- C:\WINDOWS\system32\Drivers\Hdaudio.sys   [145920]
O58 - SDL:3/8/2004 - 22:41:40 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\mtlmnt5.sys   [126686]
O58 - SDL:3/8/2004 - 22:41:38 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\mtlstrm.sys   [1309184]
O58 - SDL:3/8/2004 - 22:29:38 ----- . (.Matrox Graphics Inc. - Matrox Parhelia Miniport Driver.) -- C:\WINDOWS\system32\Drivers\mtxparhm.sys   [452736]
O58 - SDL:3/8/2004 - 22:41:40 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\ntmtlfax.sys   [180360]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (.Parallel Technologies, Inc. - Parallel Technologies DirectParallel IO Library.) -- C:\WINDOWS\system32\Drivers\ptilink.sys   [17792]
O58 - SDL:3/8/2004 - 22:41:40 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\recagent.sys   [13776]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\Drivers\secdrv.sys   [27440]
O58 - SDL:11/8/2005 - 10:49:28 R--A- . (.Sensaura - Sensaura WDM 3D Audio Driver.) -- C:\WINDOWS\system32\Drivers\senfilt.sys   [393088]
O58 - SDL:3/8/2004 - 22:41:42 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\slnt7554.sys   [129535]
O58 - SDL:3/8/2004 - 22:41:44 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\slntamr.sys   [404990]
O58 - SDL:3/8/2004 - 22:41:46 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\slnthal.sys   [95424]
O58 - SDL:3/8/2004 - 22:41:46 ----- . (.Smart Link - No Comment.) -- C:\WINDOWS\system32\Drivers\slwdmsup.sys   [13240]
O58 - SDL:16/3/2007 - 10:11:38 ---A- . (.Windows (R) 2000 DDK provider - Display Control Program.) -- C:\WINDOWS\system32\Drivers\TBPanel.sys   [12256]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (.RAVISENT Technologies Inc. - CineMaster C WDM DVD Minidriver.) -- C:\WINDOWS\system32\Drivers\vdmindvd.sys   [58112]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ansi.sys   [9032]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\country.sys   [27097]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\himem.sys   [4896]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\key01.sys   [42809]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\keyboard.sys   [42537]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos.sys   [27900]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos404.sys   [29146]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos411.sys   [29370]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos412.sys   [29274]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntdos804.sys   [29146]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio.sys   [33984]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio404.sys   [34560]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio411.sys   [35648]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio412.sys   [35424]
O58 - SDL:2/3/2006 - 09:00:00 ---A- . (...) -- C:\WINDOWS\system32\ntio804.sys   [34560]
~ Drivers: 97 Legitimates Filtered in 00mn 01s



---\\ Lista das ferramentas de remoção de vírus (LAT) (063)
O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1  =>.Nicolas Coolman
~ ADS:  Scanned in 00mn 00s



---\\ Lista dos serviços Legacy du registo (064)
O64 - Services: CurCS - 27/5/2014 - C:\WINDOWS\system32\drivers\aswHwid.sys (aswHwid) .(...) - LEGACY_ASWHWID
~ Legacy: 117 Legitimates Filtered in 00mn 00s



---\\ Associações Shell Spawning (O67)
O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)
~ FASS Keys: 10 Legitimates Filtered in 00mn 00s



---\\ Menu de inicialização Internet (068)
O68 - StartMenuInternet: <chrome.exe> <>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Arquivos de programas\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Arquivos de programas\Google\Chrome\Application\chrome.exe
O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- c:\arquivos de programas\internet explorer\iexplore.exe
~ Keys:  Scanned in 00mn 00s



---\\ Pesquisa de infeção nos navegadores da Internet (SBI) (069)
O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O69 - SBI: SearchScopes [HKCU] {6A1806CD-94D4-4689-BA73-E35EA1EA9990} - (Google) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
~ Keys:  Scanned in 00mn 00s



---\\ Pesquisa adicional à raiz do sistema (radicular) (SPRF) (O84)
[MD5.333A79F1A3964AF2A17AB2C88AF677DE] [SPRF][13/4/2014] (.No owner - Uninstall Receitanet 1.04.) -- C:\Documents and Settings\Eros\Desktop\Desinstalador.exe   [1605083]
[MD5.BDB0B87D300B3AEB98797FF0A3C54924] [SPRF][9/11/2010] (...) -- C:\Documents and Settings\Eros\Desktop\FSCapture.exe   [1111552]
[MD5.E3C43F58C5299EB2F2C0617A9F205946] [SPRF][10/5/2013] (...) -- C:\Documents and Settings\Eros\Desktop\receitanet.dat   [42]
[MD5.7EEBD2FC5E927CDA3ACC1CFEA699D8FE] [SPRF][10/5/2013] (...) -- C:\Documents and Settings\Eros\Desktop\receitanet.exe   [452096]
~ Files: 4 Legitimates Filtered in 00mn 00s



---\\ Estado general dos serviços não Microsoft (EGS) (SR=Executados, SS=Parados)
SS - | Demand 2/3/2006 225280 |  (dmadmin) . (.Microsoft Corp., Veritas Software.) - C:\WINDOWS\system32\dmadmin.exe
SS - | Auto 8/6/2014 116648 |  (gupdate) . (.Google Inc..) - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe
SS - | Demand 8/6/2014 116648 |  (gupdatem) . (.Google Inc..) - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe
SR - | Auto 27/5/2014 50344 |  (avast! Antivirus) . (.AVAST Software.) - C:\Arquivos de programas\AVAST Software\Avast\AvastSvc.exe
SR - | Auto 27/5/2014 109048 |  (avast! Firewall) . (.AVAST Software.) - C:\Arquivos de programas\AVAST Software\Avast\afwServ.exe
SR - | Auto 21/6/2014 182696 |  (JavaQuickStarterService) . (.Oracle Corporation.) - C:\Arquivos de programas\Java\jre7\bin\jqs.exe
SR - | Auto 28/11/2007 155716 |  (NVSvc) . (.NVIDIA Corporation.) - C:\WINDOWS\system32\nvsvc32.exe
~ Services:  Scanned in 00mn 05s



---\\ Scâner Aditional (088)
Database Version : 13026 - (23/6/2014)
Clés trouvées (Keys found) : 0
Valeurs trouvées (Values found) : 0
Dossiers trouvés  (Folders found) : 0
Fichiers trouvés  (Files found) : 1

[HKCU\Software\ForumerIT]   =>Toolbar.Forumer^
~ Additionnel Scan: 121254 Items scanned in 00mn 23s



---\\ Informações complémentaires do módulos
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>.Internet Explorer, Gestão do Proxy (R5)
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>.Barras do Internet Explorer (03))
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>.Aplicações iniciadas por registo & pastas (04)
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>.Image File Execution Options (IFEO) (O50)
~ [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>.Chave do registo Shell MountPoints2 (MPKS) (O51)
~ AMI: 5 Legitimates Filtered in 00mn 00s



---\\ Sumário das deteções encontradas na sua estação
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  =>Toolbar.Forumer
~ MSI: 1 link(s) detected in 00mn 00s



~ 636 Legitimates filtered by white list
End of the scan (452 lines in 00mn 58s)(0)

 Selecione e copie todo o texto destacado em vermelho que te passei.

_____________________________________________________________________________________________________________

 Vá no menu: Iniciar > Todos os programas > ZHP > Clique com o botão direito do mouse sobre o Zhpfix e escolha a opção de Executar como administrador > Clique em Importação > Clique no botão GO > Clique em Oui > Caso queira que os arquivos da lixeira sejam excluídos clique em Oui novamente > Um relatório aparecerá no bloco de notas.

Copie este relatório e poste em sua próxima resposta e nos diga como está o PC depois disto.

Rapport de ZHPFix 2014.4.13.3 par Nicolas Coolman, Update du 13/04/2014
Fichier d'export Registre :
Run by Eros at 24/6/2014 21:31:09
High Elevated Privileges : OK
Windows XP Home Edition Service Pack 2 (Build 2600)

Reciclagem vazia (00mn 02s)
Reparação de atalhos do navegador

========== Chaves do Registo ==========
ELIMINÉ Driver Key: Bnbase
ELIMINÉ: HKCU\Software\ForumerIT
ELIMINÉ: HKLM\Software\Quiknowledge

========== Valores do Registo ==========
ProxyFix : Configuração proxy removida com sucesso
ELIMINÉ ProxyServer Value
ELIMINÉ ProxyEnable Value
ELIMINÉ EnableHttp1_1 Value
ELIMINÉ ProxyHttp1.1 Value
ELIMINÉ ProxyOverride Value

========== Pastas ==========
Nenhuma pasta CLSID local utilizador vazia

========== Ficheiros ==========
ELIMINÉ: c:\windows\tasks\060184c3-9766-46a0-b258-f4518a0b2633.job
ELIMINÉ Temporários windows (26) (104.575.930 octets)
ELIMINÉ Flash Cookies (0) (0 octets)

========== Restauração Sistema ==========
Ponto de restauro do sistema criado com sucesso


========== Recapitulativo ==========
3 : Chaves do Registo
6 : Valores do Registo
1 : Pastas
3 : Ficheiros
1 : Restauração Sistema


End of clean in 00mn 06s

========== Caminho do ficheiro do relatório ==========
C:\Documents and Settings\Eros\Dados de aplicativos\ZHP\ZHPFix[R1].txt - 24/6/2014 21:31:11 [1261]

Olá Power Max,

Meu micro agora é outro. Está muito bom.
Acabou a lentidão e a perturbação com o Sweet Page.
Este fórum é verdadeiro porto seguro para todos que dele precisam.
Power Max, se quiser pode deixar esta parte da mensagem aberta para que outros usuários vejam.
Realmente podemos confiar no Fórum PC Brasil. Aqui se encontram pessoas dedicadas, prestativas e muito atenciosas. Digo isso porque eu não conheço muito de computador e fui ajudado e tive o problema resolvido.

Obrigado a todos do Fórum PC Brasil meu especial obrigado ao ao moderador Power Max quem me suportou para solucionar o problema com Sweet Page.

Eros

Fico feliz que o problema tenha sido resolvido.

Só para finalizar siga estes tutoriais abaixo, por gentileza:

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
_______________________________________________________________________________________________________________________

Para remover os programas usados na limpeza deste PC e criar um novo ponto de restauração seguro e sem problemas, utilize o DelFix seguindo as dicas [Tens de ter uma conta e sessão iniciada para poderes visualizar este link].
_______________________________________________________________________________________________________________________

Foi um prazer ajudar. Conte sempre conosco!

Olá Max,

Sei que fazer o bem nem sempre é fácil. mas gostaria de te incentivar a continuar fazendo-o.
Deus terá um imenso prazer em te abençoar assim como você tem abençoado outros que nem tem noção de como você é.
Amigo Max, recomendarei o Fórum PC Brasil onde eu estiver. Porque o Fórum PC Brasil é 1000!

Max que Deus te abençoe muito mesmo,

Estarei orando por você a partir das 20h30 de hoje, Deus seja contigo por onde andares.

Com um caloroso abraço e que Jesus seja o teu guia nesta jornada de ajudar outros como fez comigo.


De seu amigo,

Eros

CASO RESOLVIDO

Caso o autor do tópico necessite, o mesmo será reaberto, para isso deverá entrar em contato com um dos membros da [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] solicitando o desbloqueio.