Remover o istartsurf

Quando abro a página do Chrome ele me redireciona a página do istartsurf. Já removi a pasta de do programa mas o mesmo continua em todos os navegadores.

Boa Tarde! keyka13

> Execute estas ferramentas,na ordem proposta.

> Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > ( ... by Oleg N. Scherbakov )
> Salve-o no desktop!
> Desabilite seu antivírus!
> Para Windows 7,clique direito em JRT.exe e execute-o ... 

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Aguarde a conclusão e poste o relatório. ( JRT.txt )
>
> Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > ( ... par Xplode )
>
> Ou daqui: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] >
> Ao acessar,clique em "Download Now".
>
> Salve-o no desktop!

< [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem] >

> Clique direito em adwcleaner.exe,e escolha sua execução como administrador.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Ps: Dê início ao scan,clicando em "Examinar". 

< [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem] >

> Ao concluir,clique "Limpar" >> Ok >> Ok >> Ok.
> Copie o log ou clique "Relatório".
> Poste: < C:\AdwCleaner\AdwCleaner[S0].txt > 

A+

Boa noite Joram,

Obrigada pela atenção. Segue abaixo os relatórios. P.S.: a data está desconfigurada.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.1 (10.06.2014:1)
OS: Windows 7 Ultimate x86
Ran by usuario on 22/02/2010 at  0:05:38,06
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Search Page



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9CB96984-43C3-4D44-90EF-01466EFCF7BB}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10AD2C61-0898-4348-8600-14A342F22AC3}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{10AD2C61-0898-4348-8600-14A342F22AC3}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\baidu"
Successfully deleted: [Folder] "C:\ProgramData\iepluginservices"
Successfully deleted: [Folder] "C:\ProgramData\windowsmangerprotect"
Successfully deleted: [Folder] "C:\Users\usuario\AppData\Roaming\baidu"
Failed to delete: [Folder] "C:\Program Files\baidu"
Failed to delete: [Folder] "C:\Program Files\suptab"



~~~ FireFox

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\\faststartff@gmail.com
Successfully deleted the following from C:\Users\usuario\AppData\Roaming\mozilla\firefox\profiles\bum5tz84.default\prefs.js

user_pref("browser.search.defaulturl", "hxxps://br.search.yahoo.com/yhs/search");
user_pref("keyword.URL": "hxxp://br.yhs4.search.yahoo.com/yhs/search");
Emptied folder: C:\Users\usuario\AppData\Roaming\mozilla\firefox\profiles\bum5tz84.default\minidumps [53 files]



~~~ Chrome

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 22/02/2010 at  0:09:53,73
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




# AdwCleaner v3.311 - Relatório criado 22/02/2010 às 00:13:08
# Atualizado 30/09/2014 por Xplode
# Sistema Operacional : Windows 7 Ultimate  (32 bits)
# Usuário : usuario - USUARIO-PC
# Executando de : C:\Users\usuario\Desktop\AdwCleaner.exe
# Opção : Limpar

***** [ Serviços ] *****

[#] Serviço Deletada : IePluginServices

***** [ Arquivos / Pastas ] *****

Pasta Deletada : C:\Program Files\baidu
Pasta Deletada : C:\Program Files\SupTab
Pasta Deletada : C:\Users\Public\Documents\baidu
Pasta Deletada : C:\Users\usuario\AppData\Local\Temp\baidu
Arquivo Deletada : C:\Program Files\Mozilla Firefox\browser\searchplugins\istartsurf.xml
Arquivo Deletada : C:\Program Files\Mozilla Firefox\browser\searchplugins\SearchTheWeb.xml
Arquivo Deletada : C:\Users\usuario\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx

***** [ Tarefas ] *****


***** [ Atalhos ] *****


***** [ Registro ] *****

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\SupTab_v5_RASAPI32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\SupTab_v5_RASMANCS
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\wpm_v20_RASAPI32
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\wpm_v20_RASMANCS
Chave Deletedo : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IePluginServices
Chave Deletedo : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Dados Restaurada : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
Chave Deletedo : HKCU\Software\SupHpUISoft
Chave Deletedo : HKLM\SOFTWARE\istartsurfSoftware
Chave Deletedo : HKLM\SOFTWARE\SupDp
Chave Deletedo : HKLM\SOFTWARE\SupTab
Chave Deletedo : HKLM\SOFTWARE\supWindowsMangerProtect
Chave Deletedo : HKLM\SOFTWARE\supWPM

***** [ Navegadores ] *****

-\\ Internet Explorer v8.0.7600.16385

Configurações Restauradas : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

-\\ Mozilla Firefox v29.0.1 (pt-BR)

[ Arquivo : C:\Users\usuario\AppData\Roaming\Mozilla\Firefox\Profiles\bum5tz84.default\prefs.js ]


-\\ Google Chrome v37.0.2062.124

[ Arquivo : C:\Users\usuario\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [7077 octets] - [22/02/2010 00:07:59]
AdwCleaner[R1].txt - [1050 octets] - [09/09/2014 09:25:35]
AdwCleaner[R2].txt - [3178 octets] - [22/02/2010 00:11:20]
AdwCleaner[S0].txt - [7059 octets] - [04/09/2014 14:05:45]
AdwCleaner[S1].txt - [2781 octets] - [22/02/2010 00:13:08]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2841 octets] ##########

Boa Noite! keika13

> Acerte a data de seu computador!
> Execute,na ordem dada estes procedimentos!

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

> Abra a ferramenta AdwCleaner e clique em "Desinstalar".
> Confirme a solicitação!
>
> Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > ( ... by techsupportall.com )
> Salve-a no desktop!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Execute o arquivo Adware-Removal-Tool-v3.5.exe <<

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Dê início a verificação,clicando em Scan.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Ao concluir seu prescan,clique OK.
> Ps: Cada guia irá mostrar o que será removido!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Clique "Next" >> Aguarde!

< Computador >> Windows (C:) >> Program Files >> Adware-Removal-Tool >> Reports >> Repair_Logs_2014_10_dia_h_min_seg.txt <<

> Poste o relatório! 

Abs!

Bom dia Joram,

segue o relatório, mas mesmo após a limpeza ao reiniciar a data e a hora voltaram desconfiguradas.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Adware Removal Tool v3.9
Time: 2014_10_08_09_42_16
OS: Windows 7 - 32 Bit
Account Name: usuario
U0L0S40

\\\\\\\\\\\\\\\\\\\\\\\ Repair Logs \\\\\\\\\\\\\\\\\\\\\\

Deleted - Folder - C:\ProgramData\Baidu Security\PC Faster
Deleted - Folder - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Baidu PC Faster
Deleted - Folder - C:\Users\usuario\Appdata\Roaming\Baidu Security\PC Faster

\\ Rebooting computer : 37 Objects
\\ Reboot Done

Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.Cleaner\Data\0002.MyPCBackup.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.Cleaner\Data\0004.iLivid.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.Cleaner\Data\0005.TornTV.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1179.FilesFrogUpdateChecker.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1122.Mysearchdial.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1063.SnapDo.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1061.SearchProtect.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1088.yontooToolbar.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\Yontoo.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\BrowserDefender.rul.bak
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1168.LessTabs.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\webcake.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1082.PricePeep.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\Tuvaro.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1055.WhiteSmoke.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\WhiteSmokeToolBar.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1143.BrowserPlus2.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1048.MixiDjV30.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\MixiDJ.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1197.Desk365.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\plugscan\data\1179.FilesFrogUpdateChecker.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\plugscan\data\1122.Mysearchdial.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\plugscan\data\1063.SnapDo.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\plugscan\data\1061.SearchProtect.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\plugscan\data\1088.yontooToolbar.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\plugscan\data\Yontoo.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\plugscan\data\BrowserDefender.rul.bak
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\plugscan\data\1168.LessTabs.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\plugscan\data\webcake.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\plugscan\data\1082.PricePeep.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\plugscan\data\Tuvaro.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\plugscan\data\1055.WhiteSmoke.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\plugscan\data\WhiteSmokeToolBar.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\plugscan\data\1143.BrowserPlus2.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\plugscan\data\1048.MixiDjV30.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\plugscan\data\MixiDJ.rul
Deletion Failed - File - C:\program files\Baidu Security\PC Faster\4.0.0.0\plugscan\data\1197.Desk365.rul

\\ Finished

Bom Dia! keyka13

keyka13 escreveu:segue o relatório, mas mesmo após a limpeza ao reiniciar a data e a hora voltaram desconfiguradas.

> Desconfigurações constantes,na data e hora,costumam estar associadas a bateria da Placa Mãe,já requisitando substituição. Contate um Técnico para tal empreitada.

> Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] >  < [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem] > ( ... de Nicolas Coolman )
> Ou [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] << Link!
> Salve-o no disco local! ( C ou D )
> Desabilite seu antivírus e execute "ZHPDiag2.exe",para instalar a ferramenta.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Execute o ícone do pergaminho. ( ZHPDiag )

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Clique "COMPLETA" e aguarde a conclusão!
> Clique OK e,ao concluir,poste o relatório! ( ZHPDiag.txt ) 
> Ps: Como o log será extenso,envie-o à [Tens de ter uma conta e sessão iniciada para poderes visualizar este link].

> Ou acesse: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > 

> Ou acesse: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] >

> Ou anexe-o |[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]| << Link!

> Maiores informações: < |[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]| > << Hospedagem!

A+

Boa tarde Joram,

Segue o Relatório.

Boa Tarde! keyka13

> Seu "Adobe Flash Player 12 Plugin",está desatualizado!
>
> Execute este script na ferramenta ZHPFix.
> Selecione e copie estas informações que estão em vermelho,para o Bloco de Notas.
> Com o Bloco de Notas aberto,faça: ctrl+a >> ctrl+c ( Selecionar e Copiar )
> À seguir,minimize o Bloco de Notas.

Script ZHPFix
FirewallRaz
EmptyPrefetch
EmptyTemp
EmptyFlash
[MD5.933078FAEB8719E3E98A46F70D27095B] [APT] [Baidu PC Faster Service] (.Baidu Inc..) -- C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFasterSvc.exe   [770032]
[MD5.F01CEF89A1059F08877E9FA16970AF88] [APT] [Baidu PC Faster Update] (.Baidu Inc..) -- C:\Program Files\Baidu Security\PC Faster\4.0.0.0\Updater.exe   [1329648]
[MD5.D7F3C10428130DB60FF0318C975F12AB] - (.Baidu Inc. - PC Faster Tray.) -- C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFTray.exe   [1334976] [PID.3832]
[MD5.3B44E6B2C9F52F1ED18A14FBD9ADEB25] - (...) -- C:\Program Files\Baidu Security\PC App Store\4.5.1.6176\AppStoreUtilexe.exe   [1795104] [PID.4000]
[MD5.F01CEF89A1059F08877E9FA16970AF88] - (.Baidu Inc. - Baidu PC Faster Updater.) -- C:\Program Files\Baidu Security\PC Faster\4.0.0.0\Updater.exe   [1329648] [PID.2416]
SR - | Auto 30/06/2014 550432 |  (PCAppStoreSvc_{PCAppStore_4.5.1.6176}) . (.Baidu Inc..) - C:\Program Files\Baidu Security\PC App Store\4.5.1.6176\PCAppStoreSvc.exe
SR - | Auto 06/10/2014 770032 |  (PCFasterSvc_{PCFaster_4.0.0.0}) . (.Baidu Inc..) - C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFasterSvc.exe
SS - | Auto 10/07/1658 0 |  (Update melondrea) . (...) - C:\Program Files\melondrea\updatemelondrea.exe
SS - | Auto 10/07/1658 0 |  (Util melondrea) . (...) - C:\Program Files\melondrea\bin\utilmelondrea.exe
SS - | Demand 10/07/1658 0 |  (SparkUpdater) . (...) - C:\Program Files\Baidu\SparkUpdate\Sparkupdate.exe
O4 - HKLM\..\Run: [Baidu PC Faster 4.0.0.0] . (.Baidu Inc. - PC Faster.) -- C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFaster.exe
O23 - Service: Baidu PC App Store Service 4.5.1.6176 (PCAppStoreSvc_{PCAppStore_4.5.1.6176}) . (.Baidu Inc. - Baidu PC App Store Service.) - C:\Program Files\Baidu Security\PC App Store\4.5.1.6176\PCAppStoreSvc.exe
O23 - Service: Baidu PC Faster Service 4.0.0.0 (PCFasterSvc_{PCFaster_4.0.0.0}) . (.Baidu Inc. - Baidu PC Faster Service.) - C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFasterSvc.exe
O23 - Service: Update melondrea (Update melondrea) . (...) - C:\Program Files\melondrea\updatemelondrea.exe (.not file.)
O23 - Service: Util melondrea (Util melondrea) . (...) - C:\Program Files\melondrea\bin\utilmelondrea.exe (.not file.)
O41 - Driver:  (wStLibG) . (.StdLib - StdLib.) - C:\Windows\System32\drivers\wStLibG.sys
O42 - Logiciel: TBD - TheBetterDeals - TheBetterDeals utiliza algoritmos inteligentes que b - (."TBD".) [HKLM] -- TBD TheBetterDeals
O42 - Logiciel: Baidu Spark Browser - (.Baidu Inc..) [HKLM] -- Spark
O58 - SDL:24/03/2014 - 21:58:02 ---A- . (.StdLib - StdLib.) -- C:\Windows\System32\Drivers\wStLibG.sys   [52920]
O64 - Services: CurCS - 24/03/2014 - C:\Windows\System32\drivers\wStLibG.sys (wStLibG)  .(.StdLib - StdLib.) - LEGACY_WSTLIBG
O64 - Services: CurCS - 06/10/2014 - C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFApiUtil.sys (PCFApiUtil)  .(.Baidu, Inc. - Baidu Antivirus BdApi Driver.) - LEGACY_PCFAPIUTIL
HKLM\SOFTWARE\Microsoft\Tracing\IminentUninstall_RASAPI32
HKLM\SOFTWARE\Microsoft\Tracing\IminentUninstall_RASMANCS
HKLM\SOFTWARE\Microsoft\Tracing\melondrea_0702-81cfb2ef_RASAPI32
HKLM\SOFTWARE\Microsoft\Tracing\melondrea_0702-81cfb2ef_RASMANCS
HKLM\SOFTWARE\Microsoft\Tracing\melondrea_RASAPI32
HKLM\SOFTWARE\Microsoft\Tracing\melondrea_RASMANCS
HKLM\SOFTWARE\Microsoft\Tracing\melondrea_Setup_RASAPI32
HKLM\SOFTWARE\Microsoft\Tracing\melondrea_Setup_RASMANCS
HKLM\SOFTWARE\Microsoft\Tracing\ReimageRepair_RASAPI32
HKLM\SOFTWARE\Microsoft\Tracing\ReimageRepair_RASMANCS
HKLM\SOFTWARE\Microsoft\Tracing\updatemelondrea_RASAPI32
HKLM\SOFTWARE\Microsoft\Tracing\updatemelondrea_RASMANCS
HKLM\SOFTWARE\Microsoft\Tracing\utilmelondrea_RASAPI32
HKLM\SOFTWARE\Microsoft\Tracing\utilmelondrea_RASMANCS
[HKLM\SYSTEM\CurrentControlSet\Services\Update melondrea]
[HKLM\SYSTEM\CurrentControlSet\Services\Util melondrea]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\TBD TheBetterDeals]
C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFaster.exe
C:\Program Files\Baidu\SparkUpdate\Sparkupdate.exe
C:\Program Files\Baidu Security\PC Faster\4.0.0.0
C:\Program Files\melondrea\updatemelondrea.exe
C:\Program Files\melondrea\bin\utilmelondrea.exe
C:\Program Files\Baidu Security\PC Faster
C:\Program Files\Baidu\SparkUpdate
C:\Program Files\Baidu Security
C:\Program Files\melondrea
C:\Windows\Reimage.ini
C:\ProgramData\Log
ServiceDemand:SparkUpdater
ServiceStop:PCAppStoreSvc_{PCAppStore_4.5.1.6176}
ServiceStop:"Update melondrea"
ServiceStop:"Util melondrea"
ServiceStop:wStLibG
ServiceStop:PCFasterSvc_{PCFaster_4.0.0.0}

> Abra a ferramenta ZHPFix. < [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem] >
> Clique IMPORTAÇÃO >> OK.
> Ps: Ao clicar "OK",verifique se o campo está limpo para que receba,somente,as informações do script.
> Clique "GO".
> Poste o relatório!

A+

Boa tarde Joram. Segue o relatório.

Rapport de ZHPFix 2014.8.3.6 par Nicolas Coolman, Update du 03/08/2014
Fichier d'export Registre :
Run by usuario at 08/10/2014 14:48:03
High Elevated Privileges : OK
Windows 7 Ultimate Edition, 32-bit (Build 7600)

Reciclagem vazia (00mn 33s)
Prefetcher vazio

========== Softwares ==========
ELIMINÉ: TBD - TheBetterDeals - TheBetterDeals utiliza algoritmos inteligentes que b
AUSENTE Uninstall Process: c:\program files\baidu\spark\uninst.exe

========== Processo memória ==========
ELIMINA REINICIAR: Memory Process: C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFaster.exe

========== Estado dos serviços ==========
WSTLIBG Parado
PCFAPIUTIL Parado
SparkUpdaterServiço não configurado (demand)
PCAppStoreSvc_{PCAppStore_4.5.1.6176} Parado
"Update melondrea" Parado
"Util melondrea" Parado
wStLibG Parado
PCFasterSvc_{PCFaster_4.0.0.0} Parado

========== Chaves do Registo ==========
ELIMINÉ Logiciel Key: [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spark]
ELIMINÉ: Service: PCAppStoreSvc_{PCAppStore_4.5.1.6176}
ELIMINÉ:³ Service: PCFasterSvc_{PCFaster_4.0.0.0}
ELIMINÉ: Service: Update melondrea
ELIMINÉ: Service: Util melondrea
ELIMINÉ: Service: SparkUpdater
ELIMINÉ Driver Key: wStLibG
ELIMINÉ: HKLM\SOFTWARE\Microsoft\Tracing\IminentUninstall_RASAPI32
ELIMINÉ: HKLM\SOFTWARE\Microsoft\Tracing\IminentUninstall_RASMANCS
ELIMINÉ: HKLM\SOFTWARE\Microsoft\Tracing\melondrea_0702-81cfb2ef_RASAPI32
ELIMINÉ: HKLM\SOFTWARE\Microsoft\Tracing\melondrea_0702-81cfb2ef_RASMANCS
ELIMINÉ: HKLM\SOFTWARE\Microsoft\Tracing\melondrea_RASAPI32
ELIMINÉ: HKLM\SOFTWARE\Microsoft\Tracing\melondrea_RASMANCS
ELIMINÉ: HKLM\SOFTWARE\Microsoft\Tracing\melondrea_Setup_RASAPI32
ELIMINÉ: HKLM\SOFTWARE\Microsoft\Tracing\melondrea_Setup_RASMANCS
ELIMINÉ: HKLM\SOFTWARE\Microsoft\Tracing\ReimageRepair_RASAPI32
ELIMINÉ: HKLM\SOFTWARE\Microsoft\Tracing\ReimageRepair_RASMANCS
ELIMINÉ: HKLM\SOFTWARE\Microsoft\Tracing\updatemelondrea_RASAPI32
ELIMINÉ: HKLM\SOFTWARE\Microsoft\Tracing\updatemelondrea_RASMANCS
ELIMINÉ: HKLM\SOFTWARE\Microsoft\Tracing\utilmelondrea_RASAPI32
ELIMINÉ: HKLM\SOFTWARE\Microsoft\Tracing\utilmelondrea_RASMANCS

========== Valores do Registo ==========
Ausente Valor Perfil Padrão: FirewallRaz :
Ausente Valor Perfil Domínio FirewallRaz :
ELIMINÉ: FirewallRaz (Public) : {9568B610-8C73-4BE6-9FE7-238D2760DD32}
ELIMINÉ: FirewallRaz (Public) : {286A8194-EB63-4D62-B892-E66A36A771F8}
ELIMINÉ: FirewallRaz (Public) : {99FBCD34-0C50-42A5-9EA3-321C57011671}
ELIMINÉ: FirewallRaz (Public) : {CB781D42-EDC1-421C-AEAD-EA2B5AC7B8DE}
ERRO RunValue: Baidu PC Faster 4.0.0.0

========== Pastas ==========
ELIMINÉ Temporários windows (3)
ELIMINÉ Flash Cookies (0)
ELIMINA REINICIAR:** c:\program files\baidu security\pc faster\4.0.0.0
ELIMINA REINICIAR:** c:\program files\baidu security\pc faster
ELIMINA REINICIAR:** c:\program files\baidu security
ELIMINÉ: c:\programdata\log

========== Ficheiros ==========
ELIMINÉ Temporários windows (10) (515.131 octets)
ELIMINÉ Flash Cookies (0) (0 octets)
ELIMINA REINICIAR: c:\program files\baidu security\pc app store\4.5.1.6176\pcappstoresvc.exe
ELIMINA REINICIAR: c:\program files\baidu security\pc faster\4.0.0.0\pcfastersvc.exe
ELIMINA REINICIAR: c:\program files\baidu security\pc faster\4.0.0.0\pcfaster.exe
ELIMINÉ: c:\program files\baidu security\pc app store\4.5.1.6176\pcappstoresvc.exe
ELIMINÉ: c:\windows\system32\drivers\wstlibg.sys
ELIMINÉ: C:\Windows\Reimage.ini

========== Tarefa planificada ==========
ELIMINÉ: Baidu PC Faster Service
ELIMINÉ: Baidu PC Faster Update


========== Recapitulativo ==========
1 : Processo memória
21 : Chaves do Registo
7 : Valores do Registo
6 : Pastas
8 : Ficheiros
2 : Softwares
8 : Estado dos serviços
2 : Tarefa planificada


End of clean in 09mn 35s

========== Caminho do ficheiro do relatório ==========
C:\Users\usuario\AppData\Roaming\ZHP\ZHPFix[R1].txt - 08/10/2014 14:48:37 [3915]

SDS

Boa Tarde! keyka13

> Necessito de novo scan da ferramenta Adware Removal Tool.
> Poste o relatório!
> Após seu scan,execute a ferramenta ZHPDiag,poste seu log. 
> Provavelmente,terei que contruir novo script,mas... bem menor que o primeiro.

A+

Joram,
Mais um "boa tarde". Espero que vc esteja tendo uma boa tarde, pq eu já estou constrangida com a quantidade de trabalho que estou lhe dando.

SDS.

Boa Tarde! keyka13

keyka13 escreveu:Mais um "boa tarde". Espero que vc esteja tendo uma boa tarde, pq eu já estou constrangida com a quantidade de trabalho que estou lhe dando.

> É um prazer ajudá-la...mesmo que fique aqui 100 anos.
>
> Execute este script na ferramenta ZHPFix.
> Selecione e copie estas informações que estão em vermelho,para o Bloco de Notas.
> Com o Bloco de Notas aberto,faça: ctrl+a >> ctrl+c ( Selecionar e Copiar )
> À seguir,minimize o Bloco de Notas.

Script ZHPFix
FirewallRaz
EmptyPrefetch
EmptyTemp
EmptyFlash
[MD5.F01CEF89A1059F08877E9FA16970AF88] [APT] [Baidu PC Faster Update] (.Baidu Inc..) -- C:\Program Files\Baidu Security\PC Faster\4.0.0.0\Updater.exe   [1329648]
[MD5.D7F3C10428130DB60FF0318C975F12AB] - (.Baidu Inc. - PC Faster Tray.) -- C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFTray.exe   [1334976] [PID.3640]
[MD5.3B44E6B2C9F52F1ED18A14FBD9ADEB25] - (...) -- C:\Program Files\Baidu Security\PC App Store\4.5.1.6176\AppStoreUtilexe.exe   [1795104] [PID.2212]
SR - | Auto 30/06/2014 550432 |  (PCAppStoreSvc_{PCAppStore_4.5.1.6176}) . (.Baidu Inc..) - C:\Program Files\Baidu Security\PC App Store\4.5.1.6176\PCAppStoreSvc.exe
SR - | Auto 06/10/2014 770032 |  (PCFasterSvc_{PCFaster_4.0.0.0}) . (.Baidu Inc..) - C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFasterSvc.exe
O4 - HKLM\..\Run: [Baidu PC Faster 4.0.0.0] . (.Baidu Inc. - PC Faster.) -- C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFaster.exe
O23 - Service: Baidu PC App Store Service 4.5.1.6176 (PCAppStoreSvc_{PCAppStore_4.5.1.6176}) . (.Baidu Inc. - Baidu PC App Store Service.) - C:\Program Files\Baidu Security\PC App Store\4.5.1.6176\PCAppStoreSvc.exe
O23 - Service: Baidu PC Faster Service 4.0.0.0 (PCFasterSvc_{PCFaster_4.0.0.0}) . (.Baidu Inc. - Baidu PC Faster Service.) - C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFasterSvc.exe
O64 - Services: CurCS - 06/10/2014 - C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFApiUtil.sys (PCFApiUtil)  .(.Baidu, Inc. - Baidu Antivirus BdApi Driver.) - LEGACY_PCFAPIUTIL
C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.Cleaner\Data\0002.MyPCBackup.rul
C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.Cleaner\Data\0004.iLivid.rul
C:\program files\Baidu Security\PC Faster
ServiceStop:PCFApiUtil
ServiceStop:PCAppStoreSvc_{PCAppStore_4.5.1.6176}
ServiceStop:PCFasterSvc_{PCFaster_4.0.0.0}

> Abra a ferramenta ZHPFix. < [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem] >
> Clique IMPORTAÇÃO >> OK.
> Ps: Ao clicar "OK",verifique se o campo está limpo para que receba,somente,as informações do script.
> Clique "GO".
> Poste o relatório!

A+

Obrigada pela atenção e principalmente pela consideração. Ajudar faz bem, eu sei. O computador que nós estamos consertando é de uma amiga minha e eu espero que ela nos coloque em suas orações ou pelo menos dirija para nós pensamentos positivos (proteção nunca é demais).  Segue o relatório.

Script ZHPFix
FirewallRaz
EmptyPrefetch
EmptyTemp
EmptyFlash
[MD5.F01CEF89A1059F08877E9FA16970AF88] [APT] [Baidu PC Faster Update] (.Baidu Inc..) -- C:\Program Files\Baidu Security\PC Faster\4.0.0.0\Updater.exe   [1329648]
[MD5.D7F3C10428130DB60FF0318C975F12AB] - (.Baidu Inc. - PC Faster Tray.) -- C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFTray.exe   [1334976] [PID.3640]
[MD5.3B44E6B2C9F52F1ED18A14FBD9ADEB25] - (...) -- C:\Program Files\Baidu Security\PC App Store\4.5.1.6176\AppStoreUtilexe.exe   [1795104] [PID.2212]
SR - | Auto 30/06/2014 550432 |  (PCAppStoreSvc_{PCAppStore_4.5.1.6176}) . (.Baidu Inc..) - C:\Program Files\Baidu Security\PC App Store\4.5.1.6176\PCAppStoreSvc.exe
SR - | Auto 06/10/2014 770032 |  (PCFasterSvc_{PCFaster_4.0.0.0}) . (.Baidu Inc..) - C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFasterSvc.exe
O4 - HKLM\..\Run: [Baidu PC Faster 4.0.0.0] . (.Baidu Inc. - PC Faster.) -- C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFaster.exe
O23 - Service: Baidu PC App Store Service 4.5.1.6176 (PCAppStoreSvc_{PCAppStore_4.5.1.6176}) . (.Baidu Inc. - Baidu PC App Store Service.) - C:\Program Files\Baidu Security\PC App Store\4.5.1.6176\PCAppStoreSvc.exe
O23 - Service: Baidu PC Faster Service 4.0.0.0 (PCFasterSvc_{PCFaster_4.0.0.0}) . (.Baidu Inc. - Baidu PC Faster Service.) - C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFasterSvc.exe
O64 - Services: CurCS - 06/10/2014 - C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFApiUtil.sys (PCFApiUtil)  .(.Baidu, Inc. - Baidu Antivirus BdApi Driver.) - LEGACY_PCFAPIUTIL
C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.Cleaner\Data\0002.MyPCBackup.rul
C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.Cleaner\Data\0004.iLivid.rul
C:\program files\Baidu Security\PC Faster
ServiceStop:PCFApiUtil
ServiceStop:PCAppStoreSvc_{PCAppStore_4.5.1.6176}
ServiceStop:PCFasterSvc_{PCFaster_4.0.0.0}

SDS.

Olá! keyka13

> Este não é o relatório! É o script que lhe passei.
> Vc o copiou e postou como se fosse o log,após ZHPFix.

A+

Desculpe, segue o correto.

Rapport de ZHPFix 2014.8.3.6 par Nicolas Coolman, Update du 03/08/2014
Fichier d'export Registre :
Run by usuario at 08/10/2014 16:13:42
High Elevated Privileges : OK
Windows 7 Ultimate Edition, 32-bit (Build 7600)

Reciclagem vazia (00mn 07s)
Prefetcher vazio

========== Processo memória ==========
ELIMINA REINICIAR: Memory Process: C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.Cleaner\Data\0002.MyPCBackup.rul
ELIMINA REINICIAR: Memory Process: C:\program files\Baidu Security\PC Faster\4.0.0.0\Plugins\Plugin.Cleaner\Data\0004.iLivid.rul

========== Estado dos serviços ==========
PCFAPIUTIL Parado
PCFApiUtil Parado
PCAppStoreSvc_{PCAppStore_4.5.1.6176} Parado
PCFasterSvc_{PCFaster_4.0.0.0} Parado

========== Chaves do Registo ==========
ELIMINÉ: Service: PCAppStoreSvc_{PCAppStore_4.5.1.6176}
ELIMINÉ:³ Service: PCFasterSvc_{PCFaster_4.0.0.0}

========== Valores do Registo ==========
Ausente Valor Perfil Padrão: FirewallRaz :
Ausente Valor Perfil Domínio FirewallRaz :
ERRO RunValue: Baidu PC Faster 4.0.0.0

========== Pastas ==========
ELIMINÉ Temporários windows (3)
ELIMINÉ Flash Cookies (0)
ELIMINA REINICIAR:** c:\program files\baidu security\pc faster

========== Ficheiros ==========
ELIMINÉ Temporários windows (5) (1.101.164 octets)
ELIMINÉ Flash Cookies (0) (0 octets)
ELIMINA REINICIAR: c:\program files\baidu security\pc app store\4.5.1.6176\pcappstoresvc.exe
ELIMINA REINICIAR: c:\program files\baidu security\pc faster\4.0.0.0\pcfastersvc.exe
ELIMINA REINICIAR: c:\program files\baidu security\pc faster\4.0.0.0\pcfaster.exe
ELIMINÉ: c:\program files\baidu security\pc app store\4.5.1.6176\pcappstoresvc.exe

========== Tarefa planificada ==========
ELIMINÉ: Baidu PC Faster Update


========== Recapitulativo ==========
2 : Processo memória
2 : Chaves do Registo
3 : Valores do Registo
3 : Pastas
6 : Ficheiros
4 : Estado dos serviços
1 : Tarefa planificada


End of clean in 03mn 02s

========== Caminho do ficheiro do relatório ==========
C:\Users\usuario\AppData\Roaming\ZHP\ZHPFix[R1].txt - 08/10/2014 14:48:37 [3997]
C:\Users\usuario\AppData\Roaming\ZHP\ZHPFix[R2].txt - 08/10/2014 16:13:50 [2132]


SDS.

Boa Tarde! keyka13

> O Baidu PC Faster é renitente,e terá sua finalização por meio de outra ferramenta e não mais ZHPFix.

> Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > ( ... by Farbar )

< [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > 

> Ou aqui,para sistemas 64bit!
> Salve-o no desktop! (Área de trabalho ...)
> Execute a ferramenta! Clique "Yes" >> "Scan".

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Antes de clicar "Scan",verifique se as caixinhas em "Whitelist" estão assinaladas.
> Em "Optional Scan",deixe marcada a checkbox "Addition.txt".
> Ps: Será gerado,também,o relatório "Addition.txt" que estará disponibilizado na 1ª execução da ferramenta.
> Poste o relatório! (FRST.txt + Addition.txt)

A+

Joram,

Segue os relatórios.

SDS

Boa Tarde! keyka13

---
---
AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
---
---
> Vc possui 2 antivírus habilitados em seu PC,e isso não é correto,pois conflitam na proteção do computador.
>
> Copie estas informações que estão em vermelho,para o Bloco de Notas.
> Salve-a com o nome fixlist.txt.
> Salve-a no desktop! ( Área de trabalho ... )

start
(Baidu Inc.) C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFasterSvc.exe
(Baidu Inc.) C:\Program Files\Baidu Security\PC Faster\4.0.0.0\SysOptEngineSvc.exe
(Baidu Inc.) C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFTray.exe
(Baidu Inc.) C:\Program Files\Baidu Security\PC Faster\4.0.0.0\CleanerEngineSvc.exe
(Baidu Inc.) C:\Program Files\Baidu Security\PC Faster\4.0.0.0\LeakRepairSvc.exe
() C:\Program Files\Baidu Security\PC App Store\4.5.1.6176\AppStoreUtilExe.exe
(Baidu Inc.) C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PluginRemoverSvc.exe
(Baidu Inc.) C:\Program Files\Baidu Security\PC Faster\4.0.0.0\liveupdate.exe
HKLM\...\Run: [Baidu PC Faster 4.0.0.0] => C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFaster.exe [1364976 2014-10-06] (Baidu Inc.)
ShellIconOverlayIdentifiers: [BaiduAntivirusIconLock] -> {0A93904A-BB1E-4a0c-9753-B57B9AE272CC} => C:\Program Files\Baidu Security\Baidu Antivirus\BavShx.dll No File
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
U2 PCFasterSvc_{PCFaster_4.0.0.0}; C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFasterSvc.exe [770032 2014-10-06] (Baidu Inc.)
S2 SparkSvc; "C:\Program Files\baidu\Spark\sparkservice.exe" -r [X]
R0 Bhbase; C:\Windows\System32\drivers\Bhbase.sys [47456 2014-03-11] (Baidu, Inc.)
R1 BprotectEx; C:\Windows\System32\drivers\BprotectEx.sys [111424 2014-10-06] (Baidu, Inc.)
S3 PCFApiUtil; C:\Program Files\Baidu Security\PC Faster\4.0.0.0\PCFApiUtil.sys [119168 2014-10-06] (Baidu, Inc.)
U3 mbr; \??\C:\Users\usuario\AppData\Local\Temp\mbr.sys [X]
2014-10-06 19:56 - 2014-10-06 19:58 - 00111424 _____ (Baidu, Inc.) C:\Windows\system32\Drivers\BProtectEx.sys
2014-10-06 19:56 - 2014-10-06 19:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Baidu Spark Browser
2014-10-06 19:56 - 2014-03-11 00:14 - 00047456 _____ (Baidu, Inc.) C:\Windows\system32\Drivers\Bhbase.sys
2014-10-08 15:22 - 2014-03-04 13:46 - 00000000 ____D () C:\Users\Todos os Usuários\Baidu Security
2014-10-08 15:22 - 2014-03-04 13:46 - 00000000 ____D () C:\ProgramData\Baidu Security
2014-10-08 15:22 - 2014-03-04 13:40 - 00000000 ____D () C:\Users\usuario\AppData\Roaming\Baidu Security
2014-10-08 14:45 - 2014-03-04 13:40 - 00000000 ____D () C:\Program Files\Baidu Security
2014-10-06 20:21 - 2014-03-04 13:40 - 00000000 ____D () C:\Users\Public\Documents\Baidu Security
2014-04-15 06:51 - 2014-04-15 06:51 - 00594112 _____ () C:\Program Files\Baidu Security\PC Faster\4.0.0.0\sqlite.dll
2014-06-30 23:14 - 2014-06-30 23:14 - 01795104 _____ () C:\Program Files\Baidu Security\PC App Store\4.5.1.6176\AppStoreUtilExe.exe
2014-06-30 23:14 - 2014-06-30 23:14 - 00517152 _____ () C:\Program Files\Baidu Security\PC App Store\4.5.1.6176\sqlite.dll
Baidu PC Faster (HKLM\...\Baidu PC Faster 4.0.0.0) (Version: 4.0.11.80186 - Baidu Inc.) <==== ATTENTION
MSCONFIG\startupfolder: C:^Users^usuario^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Baidu PC Faster Uninstall 4.0.0.0.lnk => C:\Windows\pss\Baidu PC Faster Uninstall 4.0.0.0.lnk.Startup
MSCONFIG\startupfolder: C:^Users^usuario^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Baidu PC Faster Uninstall HK 4.0.0.0.lnk => C:\Windows\pss\Baidu PC Faster Uninstall HK 4.0.0.0.lnk.Startup
Task: {37A521E7-EDD3-4E40-800A-4C738FE2CC71} - System32\Tasks\SparkUpdater => C:\Program Files\baidu\Spark\SparkUpdate.exe
Task: {554EAA23-13BF-41C0-8029-85CCE6306D16} - System32\Tasks\060184C3-9766-46a0-B258-F4518A0B2633 => Cscript.exe "C:\ProgramData\Baidu Security\PC Faster\Duplicaterecord.js"
C:\ProgramData\FileSplitUpLoad.dll
C:\Users\Todos os Usuários\FileSplitUpLoad.dll
end

> Execute FRST/FRST64 >> Clique "Fix". << Aguarde!
> Poste o relatório! (Fixlog.txt)

A+

Boa noite! Joram,

segue o relatório.

SDS.

keyka13 escreveu:Boa noite! Joram,

segue o relatório.

SDS.

Boa Noite! keyka13

> Bom trabalho! A ferramenta excluiu o Baidu PC Faster.
> Poste novo relatório da ferramenta Adware Removal Tool.
> Já estamos,praticamente,nas etapas finais da desinfecção.

A+

Boa noite! Joram,

O mérito é todo seu pela fantástica orientação. Segue o relatório.

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Adware Removal Tool v3.9
Time: 2010_02_22_00_26_42
OS: Windows 7 - 32 Bit
Account Name: usuario
U0L0S81

\\\\\\\\\\\\\\\\\\\\\\\ Repair Logs \\\\\\\\\\\\\\\\\\\\\\

Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\0002.mypcbackup.rul.VIR
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\0004.ilivid.rul.VIR
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.Cleaner\Data\0002.MyPCBackup.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.Cleaner\Data\0004.iLivid.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.Cleaner\Data\0005.TornTV.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.PluginRemover\data\1179.FilesFrogUpdateChecker.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.PluginRemover\data\1122.Mysearchdial.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.PluginRemover\data\1063.SnapDo.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.PluginRemover\data\1061.SearchProtect.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.PluginRemover\data\1088.yontooToolbar.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.PluginRemover\data\Yontoo.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.PluginRemover\data\BrowserDefender.rul.bak
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.PluginRemover\data\1168.LessTabs.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.PluginRemover\data\webcake.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.PluginRemover\data\1082.PricePeep.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.PluginRemover\data\Tuvaro.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.PluginRemover\data\1055.WhiteSmoke.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.PluginRemover\data\WhiteSmokeToolBar.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.PluginRemover\data\1143.BrowserPlus2.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.PluginRemover\data\1048.MixiDjV30.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.PluginRemover\data\MixiDJ.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\Plugins\Plugin.PluginRemover\data\1197.Desk365.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\plugscan\data\1179.FilesFrogUpdateChecker.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\plugscan\data\1122.Mysearchdial.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\plugscan\data\1063.SnapDo.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\plugscan\data\1061.SearchProtect.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\plugscan\data\1088.yontooToolbar.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\plugscan\data\Yontoo.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\plugscan\data\BrowserDefender.rul.bak
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\plugscan\data\1168.LessTabs.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\plugscan\data\webcake.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\plugscan\data\1082.PricePeep.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\plugscan\data\Tuvaro.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\plugscan\data\1055.WhiteSmoke.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\plugscan\data\WhiteSmokeToolBar.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\plugscan\data\1143.BrowserPlus2.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\plugscan\data\1048.MixiDjV30.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\plugscan\data\MixiDJ.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\4.0.0.0\plugscan\data\1197.Desk365.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.Cleaner\Data\0002.MyPCBackup.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.Cleaner\Data\0004.iLivid.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.Cleaner\Data\0005.TornTV.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1179.FilesFrogUpdateChecker.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1122.Mysearchdial.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1063.SnapDo.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1061.SearchProtect.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1088.yontooToolbar.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\Yontoo.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\BrowserDefender.rul.bak
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1168.LessTabs.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\webcake.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1082.PricePeep.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\Tuvaro.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1055.WhiteSmoke.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\WhiteSmokeToolBar.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1143.BrowserPlus2.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1048.MixiDjV30.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\MixiDJ.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\Plugins\Plugin.PluginRemover\data\1197.Desk365.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\plugscan\data\1179.FilesFrogUpdateChecker.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\plugscan\data\1122.Mysearchdial.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\plugscan\data\1063.SnapDo.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\plugscan\data\1061.SearchProtect.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\plugscan\data\1088.yontooToolbar.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\plugscan\data\Yontoo.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\plugscan\data\BrowserDefender.rul.bak
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\plugscan\data\1168.LessTabs.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\plugscan\data\webcake.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\plugscan\data\1082.PricePeep.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\plugscan\data\Tuvaro.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\plugscan\data\1055.WhiteSmoke.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\plugscan\data\WhiteSmokeToolBar.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\plugscan\data\1143.BrowserPlus2.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\plugscan\data\1048.MixiDjV30.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\plugscan\data\MixiDJ.rul
Deleted - File - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster\4.0.0.0\plugscan\data\1197.Desk365.rul
Deleted - Folder - C:\ProgramData\Baidu Security\PC Faster
Deleted - Folder - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Baidu PC Faster
Deleted - Folder - C:\Users\usuario\Appdata\Roaming\Baidu Security\PC Faster
Deleted - Folder - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR
Deleted - Folder - C:\Users\usuario\Appdata\Roaming\ZHP\Quarantine\pc faster.DIR\PC Faster

\\ Finished


SDS.

Boa noite!

Joram, após suas sábias instruções finalmente o problema foi solucionado. Muito obrigada por sua valiosa ajuda.

SDS.

Caso Resolvido

Caso o autor do tópico necessite, o mesmo será reaberto, para isso deverá entrar em contato com um dos membros da [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] solicitando o desbloqueio.