UMBRELLA REMOÇÃO

# AdwCleaner v3.212 - Relatório criado 17/06/2014 às 23:47:17
# Atualizado 05/06/2014 por Xplode
# Sistema Operacional : Windows 8.1 Single Language (64 bits)
# Usuário : Mara - ACER
# Executando de : C:\Users\Mara\Downloads\AdwCleaner.exe
# Opção : Limpar

***** [ Serviços ] *****

Serviço Deletada : CltMngSvc
Serviço Deletada : ViewPassword
Serviço Deletada : xmkysecqun64

***** [ Arquivos / Pastas ] *****

Pasta Deletada : C:\ProgramData\baidu
Pasta Deletada : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\fst
Pasta Deletada : C:\Program Files (x86)\Bench
Pasta Deletada : C:\Program Files (x86)\Discount Dragon
Pasta Deletada : C:\Program Files (x86)\globalUpdate
Pasta Deletada : C:\Program Files (x86)\predm
Pasta Deletada : C:\Program Files (x86)\SearchProtect
Pasta Deletada : C:\Program Files (x86)\SupraSavings
Pasta Deletada : C:\Program Files (x86)\ViewPassword-soft
Pasta Deletada : C:\Program Files (x86)\fst_br_148
Pasta Deletada : C:\Program Files\003
Pasta Deletada : C:\Program Files\SupraSavings
Pasta Deletada : C:\Users\Mara\AppData\Local\Discount Dragon
Pasta Deletada : C:\Users\Mara\AppData\Local\globalUpdate
Pasta Deletada : C:\Users\Mara\AppData\Local\Pokki
Pasta Deletada : C:\Users\Mara\AppData\Local\PriceMeter
Pasta Deletada : C:\Users\Mara\AppData\Local\SearchProtect
Pasta Deletada : C:\Users\Mara\AppData\Local\fst_br_148
Pasta Deletada : C:\Users\Mara\AppData\Roaming\baidu
Pasta Deletada : C:\Users\Mara\AppData\Roaming\VOPackage
Pasta Deletada : C:\Users\Mara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
Pasta Deletada : C:\Users\Public\Pokki
Pasta Deletada : C:\Users\Public\Documents\baidu
Arquivo Deletada : C:\Users\Mara\AppData\Roaming\Mozilla\Firefox\Profiles\bgbgviy3.default\user.js
Arquivo Deletada : C:\Users\Mara\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
Arquivo Deletada : C:\Users\Mara\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
Arquivo Deletada : C:\Windows\Tasks\bench-sys.job
Arquivo Deletada : C:\Windows\System32\Tasks\bench-sys
Arquivo Deletada : C:\Windows\System32\Tasks\pricemetertask
Arquivo Deletada : C:\Windows\System32\Tasks\pricemeterwatcher
Arquivo Deletada : C:\Windows\Tasks\ViewPassword Update.job
Arquivo Deletada : C:\Windows\System32\Tasks\ViewPassword Update
Arquivo Deletada : C:\Windows\Tasks\ViewPassword_wd.job
Arquivo Deletada : C:\Windows\System32\Tasks\ViewPassword_wd

***** [ Atalhos ] *****


***** [ Registro ] *****

Chave Deletedo : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Valor Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Pokki]
Valor Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [PriceMeterW]
Valor Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [BService]
Valor Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [fst_br_148]
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{10AD2C61-0898-4348-8600-14A342F22AC3}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{26B19FA4-E8A1-4A1B-A163-1A1E46F830DD}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{EA34C851-D481-49F5-A356-3A8B0A8F3B7E}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10AD2C61-0898-4348-8600-14A342F22AC3}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EA34C851-D481-49F5-A356-3A8B0A8F3B7E}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EA34C851-D481-49F5-A356-3A8B0A8F3B7E}
Chave Deletedo : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\CLSID\{EA34C851-D481-49F5-A356-3A8B0A8F3B7E}
Chave Deletedo : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EA34C851-D481-49F5-A356-3A8B0A8F3B7E}
Chave Deletedo : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AA9A4890-4262-4441-8977-E2FFCBFB706C}
Chave Deletedo : HKCU\Software\FreeSoftToday
Chave Deletedo : HKCU\Software\InstallCore
Chave Deletedo : HKCU\Software\Pokki
Chave Deletedo : HKCU\Software\suprasavings
Chave Deletedo : HKCU\Software\Tutorials
Chave Deletedo : HKCU\Software\TutoTag
Chave Deletedo : HKCU\Software\AppDataLow\Software\Supra Savings
Chave Deletedo : HKCU\Software\AppDataLow\Software\suprasavings
Chave Deletedo : HKCU\Software\AppDataLow\Software\ViewPassword
Chave Deletedo : HKLM\Software\Bench
Chave Deletedo : HKLM\Software\SearchProtect
Chave Deletedo : HKLM\Software\Tutorials
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Pokki
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E6B105B8-1F65-4428-9397-1DFD8A03B94D}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VOPackage
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fst_br_148_is1
Chave Deletedo : [x64] HKLM\SOFTWARE\LevelQualityWatcher
Chave Deletedo : [x64] HKLM\SOFTWARE\suprasavings
Chave Deletedo : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\suprasavings
Dados Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll
Dados Deletedo : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll

***** [ Navegadores ] *****

-\\ Internet Explorer v11.0.9600.16518


-\\ Mozilla Firefox v30.0 (pt-BR)

[ Arquivo : C:\Users\Mara\AppData\Roaming\Mozilla\Firefox\Profiles\bgbgviy3.default\prefs.js ]

Linha deletada : user_pref("browser.newtab.url", "hxxp://www.trovi.com/?gd=&ctid=CT3320052&octid=EB_ORIGINAL_CTID&ISID=MB326A2C1-AD4A-4E8B-AD8C-E0435E03A1E1&SearchSource=69&CUI=&SSPV=&Lay=1&UM=5&UP=");
Linha deletada : user_pref("browser.startup.homepage", "hxxp://www.trovi.com/?gd=&ctid=CT3320052&octid=EB_ORIGINAL_CTID&ISID=MB326A2C1-AD4A-4E8B-AD8C-E0435E03A1E1&SearchSource=55&CUI=&UM=5&UP=&SSPV=");

-\\ Google Chrome v

[ Arquivo : C:\Users\Mara\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deletedo [Extension] : bopakagnckmlgajfccecajhnimjiiedh

*************************

AdwCleaner[R0].txt - [7601 octets] - [17/06/2014 23:44:11]
AdwCleaner[S0].txt - [6902 octets] - [17/06/2014 23:47:17]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6962 octets] ##########

Oi Rose. Seja bem vinda ao Fórum PC Brasil.

 No seu PC está constando o antivirus Baidu instalado. Você quer removê-lo ou quer continuar com ele?
________________________________________________________________________________________

Desative temporariamente seu antivírus para evitar conflitos.

 Acesse este link abaixo e clique no primeiro botão da esquerda que é o botão Download Zoek.exe:
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

*Clique com o botão direito do mouse no Zoek.exe e selecione [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

* Selecione e copie todo este texto destacado em vermelho que te passei e cole-o no espaço em branco do Zoek:

*Clique [Run Script]

*Durante o scan uma mensagem parecida com esta abaixo mostrando o progresso do escaneamento será apresentada. Aguarde o término...pode demorar!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

*Caso a reinicialização do PC seja solicitada, clique [OK]

* Poste o log do Zoek que estará em C:\zoek-results.txt em sua próxima resposta.

TÓPICO ARQUIVADO

Caso a autora do tópico necessite, o mesmo será reaberto, para isso deverá entrar em contato com um dos membros da [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] solicitando o desbloqueio.