"Attention Required" para algumas paginas

Logfile of HijackThis v1.99.1
Scan saved at 21:57:06, on 30/10/2014
Platform: Unknown Windows (WinNT 6.01.3505 SP1)
MSIE: Internet Explorer v11.0 (11.00.9600.17344)

Running processes:
C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe
C:\ProgramData\DatacardService\DCSHelper.exe
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Ivan\Downloads\hijackthis_sfx\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: Ad-Aware Security Toolbar - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\adawareDx.dll
O2 - BHO: Auxiliar de Conexão de Conta da Microsoft - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Ad-Aware Security Toolbar - {6c97a91e-4524-4019-86af-2aa2d567bf5c} - C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\adawareDx.dll
O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [mcpltui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
O4 - HKLM\..\Run: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Baidu Antivirus] "C:\Program Files (x86)\Baidu-Security-2014-4.4.4.82804\Baidu Antivirus\BavTray.exe" -auto
O4 - HKLM\..\Run: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe"
O4 - HKCU\..\RunOnce: [adawarebp] reg.exe delete "HKCU\Software\AppDataLow\Software\adawarebp" /f
O4 - HKCU\..\RunOnce: [adawarebp_XP] reg.exe delete "HKCU\Software\adawarebp" /f
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Enviar para Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Enviar para Dispositivo &Bluetooth... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O11 - Options group: [INTERNATIONAL] International
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~2\mcafee\msc\mcsniepl.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: CompIBBrd - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Program Files (x86)\Scpad\scpLIB.dll
O23 - Service: SAS Core Service (!SASCORE) - SUPERAntiSpyware.com - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Advanced SystemCare Service 7 (AdvancedSystemCareService7) - IObit - C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCService.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_58afa5ca50c7b5e7\AESTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Baidu Antivirus Service (BAVSvc) - Baidu, Inc. - C:\Program Files (x86)\Baidu-Security-2014-4.4.4.82804\Baidu Antivirus\BAVSvc.exe
O23 - Service: Baidu Hips Service (BHipsSvc) - Baidu, Inc. - C:\Program Files (x86)\Baidu-Security-2014-4.4.4.82804\Baidu Antivirus\BHipsSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: SW Distributed TS Coordinator Service (CoordinatorServiceHost) - Dassault Systèmes SolidWorks Corp. - C:\Program Files (x86)\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Serviço do Google Update (gupdate) (gupdate) - Unknown owner - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc (file missing)
O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Unknown owner - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc (file missing)
O23 - Service: Sentinel LDK License Manager (hasplms) - Unknown owner - C:\Windows\system32\hasplms.exe (file missing)
O23 - Service: McAfee Home Network (HomeNetSvc) - Unknown owner - C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe" /McCoreSvc (file missing)
O23 - Service: HWDeviceService64.exe - Unknown owner - C:\ProgramData\DatacardService\HWDeviceService64.exe" -/service (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Ad-Aware Service 11 (LavasoftAdAwareService11) - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware Antivirus\Ad-Aware Antivirus\11.4.6792.0\AdAwareService.exe
O23 - Service: LiveUpdate (LiveUpdateSvc) - IObit - C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe
O23 - Service: Intel(R) Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc (file missing)
O23 - Service: McAfee AP Service (McAPExe) - McAfee, Inc. - C:\Program Files\McAfee\MSC\McAPExe.exe
O23 - Service: McAfee Activation Service (McAWFwk) - McAfee, Inc. - c:\PROGRA~1\mcafee\msc\mcawfwk.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe
O23 - Service: McAfee Personal Firewall Service (McMPFSvc) - Unknown owner - C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe" /McCoreSvc (file missing)
O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - Unknown owner - C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe" /McCoreSvc (file missing)
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\mcafee\VirusScan\mcods.exe
O23 - Service: McAfee Platform Services (mcpltsvc) - Unknown owner - C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe" /McCoreSvc (file missing)
O23 - Service: McAfee Proxy Service (McProxy) - Unknown owner - C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe" /McCoreSvc (file missing)
O23 - Service: McAfee Anti-Malware Core (mfecore) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - Unknown owner - C:\Windows\system32\mfevtps.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - Unknown owner - C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe" /McCoreSvc (file missing)
O23 - Service: OpcEnum - OPC Foundation - C:\Windows\SysWOW64\OpcEnum.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: Roxio Hard Drive Watcher 12 (RoxWatch12) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files (x86)\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_58afa5ca50c7b5e7\STacSV64.exe
O23 - Service: TurboBoost - Intel(R) Corporation - C:\Program Files\Intel\TurboBoost\TurboBoost.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: Intel(R) Management & Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe
O23 - Service: VMware USB Arbitration Service (VMUSBArbService) - VMware, Inc. - C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: DW WLAN Tray Service (wltrysvc) - Unknown owner - C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE" "C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %PROGRAMFILES%\Windows Media Player\wmpnetwk.exe (file missing)

Boa Noite! ivanskalla

> Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > ( ... par Xplode )
>
> Ou daqui: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] >
> Ao acessar,clique em "Download Now".
>
> Salve-o no desktop!

< [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem] >

> Clique direito em adwcleaner.exe,e escolha sua execução como administrador.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Ps: Dê início ao scan,clicando em "Examinar". 

< [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem] >

> Ao concluir,clique "Limpar" >> Ok >> Ok >> Ok.
> Copie o log ou clique "Relatório".
> Poste: < C:\AdwCleaner\AdwCleaner[S0].txt > 

A+

# AdwCleaner v4.001 - Relatório criado 31/10/2014 às 00:30:13
# DB v2014-10-26.6
# Atualizado 20/10/2014 por Xplode
# Sistema Operacional : Windows 7 Home Premium Service Pack 1 (64 bits)
# Usuário : Ivan - IVAN-PC
# Executando de : C:\Users\Ivan\Downloads\AdwCleaner (1).exe
# Opção : Limpar

***** [ Serviços ] *****


***** [ Arquivos / Pastas ] *****

Pasta Deletada : C:\Users\Ivan\AppData\LocalLow\adawaretb
Pasta Deletada : C:\Users\Ivan\AppData\Roaming\Mozilla\Firefox\Profiles\745nvraa.default-1378911805485\adawaretb
Pasta Deletada : C:\ProgramData\baidu
Pasta Deletada : C:\Users\Public\Documents\baidu
Pasta Deletada : C:\Program Files (x86)\Toolbar Cleaner

***** [ Tarefas ] *****


***** [ Atalhos ] *****


***** [ Registro ] *****

Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}
Valor Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{6C97A91E-4524-4019-86AF-2AA2D567BF5C}]
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\CLSID\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Chave Deletedo : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C97A91E-4524-4019-86AF-2AA2D567BF5C}
Valor Deletedo : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{6C97A91E-4524-4019-86AF-2AA2D567BF5C}]
Chave Deletedo : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62155D33-3CE2-401E-8967-5A270628A3D5}
Chave Deletedo : HKCU\Software\AppDataLow\Software\adawarebp
Chave Deletedo : HKLM\SOFTWARE\adawaretb
Chave Deletedo : HKLM\SOFTWARE\Toolbar Cleaner
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adawaretb
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Toolbar Cleaner

***** [ Navegadores ] *****

-\\ Internet Explorer v11.0.9600.17344


-\\ Mozilla Firefox v33.0.1 (x86 pt-BR)


-\\ Google Chrome v38.0.2125.111


*************************

AdwCleaner[R2].txt - [2686 octets] - [26/10/2014 00:47:17]
AdwCleaner[R3].txt - [442 octets] - [26/10/2014 01:01:59]
AdwCleaner[R4].txt - [2533 octets] - [29/10/2014 23:35:34]
AdwCleaner[R5].txt - [2976 octets] - [29/10/2014 23:47:23]
AdwCleaner[R6].txt - [2175 octets] - [30/10/2014 00:26:52]
AdwCleaner[R7].txt - [3174 octets] - [30/10/2014 00:53:02]
AdwCleaner[R8].txt - [3197 octets] - [31/10/2014 00:24:37]
AdwCleaner[S2].txt - [2471 octets] - [26/10/2014 00:54:23]
AdwCleaner[S3].txt - [2721 octets] - [29/10/2014 23:50:00]
AdwCleaner[S4].txt - [3055 octets] - [30/10/2014 01:01:27]
AdwCleaner[S5].txt - [3046 octets] - [31/10/2014 00:30:13]

########## EOF - C:\AdwCleaner\AdwCleaner[S5].txt - [3106 octets] ##########

Ainda não resolveu, continua aparecendo o mesmo site, infelizmente

Bom Dia! ivanskalla

> Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > ( ... by techsupportall.com )
> Salve-a no desktop!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Execute o arquivo Adware-Removal-Tool-v3.9.1.exe <<

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

> Dê início a verificação,clicando em Scan.

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

> Ao concluir seu prescan,clique OK.
> Ps: Cada guia irá mostrar o que será removido!

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

> Clique "Next" >> Aguarde!

< Computador >> Windows (C:) >> Program Files >> Adware-Removal-Tool >> Reports >> Repair_Logs_2014_10_dia_h_min_seg.txt <<

> Poste o relatório! 

A+

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

Adware Removal Tool v3.9
Time: 2014_10_31_18_13_52
OS: Windows 7 - 64 Bit
Account Name: Ivan
U0L0S27

\\\\\\\\\\\\\\\\\\\\\\\ Repair Logs \\\\\\\\\\\\\\\\\\\\\\

Deleted - File - C:\Users\Ivan\Appdata\Local\JDownloader v2.0\cfg\subconf_filesfrog.net.ejs
Deleted - Folder - C:\ProgramData\SolidWorks\SolidWorks 2010\design library\routing\conduit
Deleted - RegistryValueData - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2A0F3D1B-0909-4FF4-B272-609CCE6054E7}:dllname
Deleted - RegistryValueData - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2A0F3D1B-0909-4FF4-B272-609CCE6054E7}:masterclsid
Deleted - RegistryValueData - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}:dllname
Deleted - RegistryValueData - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{472734EA-242A-422B-ADF8-83D1E48CC825}:dllname
Deleted - RegistryValueData - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}:dllname
Deleted - RegistryValueData - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}:dllname
Deleted - RegistryValueData - HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\99ebbfd5_0:
Deleted - RegistryValueData - HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\ad3b3afa_0:
Deleted - RegistryValueData - HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\Currentversion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}:publisher
Deleted - RegistryKey - HKEY_CURRENT_USER\SOFTWARE:Ad-Aware Search Protection
Deleted - RegistryKey - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility:{2A0F3D1B-0909-4FF4-B272-609CCE6054E7}
Deleted - RegistryKey - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility:{2EECD738-5844-4A99-B4B6-146BF802613B}
Deleted - RegistryKey - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility:{472734EA-242A-422B-ADF8-83D1E48CC825}
Deleted - RegistryKey - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility:{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Deleted - RegistryKey - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility:{98889811-442D-49DD-99D7-DC866BE87DBC}

\\ Finished

Ainda não foi resolvido

ivanskalla escreveu:Ainda não foi resolvido

Boa Noite! ivanskalla

> Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] >
> Retire-a do zip!
> Execute-a e selecione a linguagem "portuguese(br)".
> Selecione e verifique se as mudanças poderão ser feitas em "Todas placas de rede",ou na que você está usando.
> Ps: Você pode fazer backup dos seus DNS's,clicando em "Backup".
> Existe a opção "Reiniciar DNS",que é conhecida como flush dns.
> Clique "DNS mais rápido".

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Será efetuada uma pesquisa!

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Ao término,o programa mostrará os DNS´s mais rápidos. 
> Basta clicar: "Aplicar servidores DNS",para concluir!
> Informe!

A+

Fiz tudo exatamente de acordo com oque disse, mas ainda estou com o mesmo problema

Boa Noite! ivanskalla

> Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > ( ... by OldTimer Tools )

> Salve-o no desktop! 
> Duplo clique em OTL.exe >> Executar ou [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Ps: Tendo dificuldades ao executar OTL.exe,delete o arquivo e baixe-o [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] ou [Tens de ter uma conta e sessão iniciada para poderes visualizar este link].

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Configure a ferramenta,segundo a screenshot!
> Em "Exame Extra do Registro",assinale "Nenhum".

SAVEMBR:0
*crack* /s 
*keygen* /s 
*serial* /s 
*AutoKMS* /s
*loader* /s
*netsvcs*
*msconfig*
*activex*
*drivers32*
%SYSTEMDRIVE%\*.*
%APPDATA%\Local\*.
%APPDATA%\*.exe /s
%APPDATA%\*.
%systemdrive%\drivers\*.exe
%USERPROFILE%\AppData\Local\*.*
%USERPROFILE%\AppData\Roaming\*.*
%systemroot%\*. /mp /s
%systemroot%\system32\*.ini
%systemroot%\Tasks\*.*
%systemroot%\system32\tasks\*.* /s /64
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\system32\drivers\*.* /90
%systemroot%\assembly\tmp\*.* /S /MD5
%systemroot%\assembly\temp\*.* /S /MD5
%systemroot%\assembly\GAC\*.* /S /MD5
%systemroot%\assembly\GAC_32\*.* /S /MD5
%systemroot%\assembly\GAC_64\*.* /S /MD5
%systemroot%\system32\config\systemprofile\AppData\Local\*.*
%windir%\ServiceProfiles\LocalService\AppData\Local\Temp\*.*
%windir%\ServiceProfiles\NetworkService\AppData\Local\Temp\*.*
%systemdrive%\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.*
%systemdrive%\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.* 
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

> Copie estas informações que estão em vermelho,para o Bloco de Notas.
> Salve-as em Meus Documentos ou desktop,com o nome scan. << Texto!
> Clique na área "Exames Personalizados/Correções".

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] 

> Clique em Ok para procurar um arquivo com exame personalizado.
> Clique "Abrir". ( scan.txt )

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] 

> Após colar as informações na área branca,clique em [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] 

> Concluindo,poste o relatório: OTL.txt << Link ao relatório!

> Para enviar,acesse: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] >

> Maiores informações: < |[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]| >

Abs!

Não consigo fazer o download do arquivo em nenhum dos links em questão, esta aparecendo esta mesma maldita mensagem.

ivanskalla escreveu:Não consigo fazer o download do arquivo em nenhum dos links em questão, esta aparecendo esta mesma maldita mensagem.

Boa Noite! ivanskalla

> Quando surge a mensagem,aparece algum captcha ,para ser digitado,dando algum acesso?

A+

Tentei Hoje novamente baixar o arquivo, deu certo, estou passando o programa conforme as instruções, logo mais posto o relatorio e espero resolver.

Ok.
Fiz conforme instruções, tentei no dia seguinte fazer download do arquivo e deu certo, antes não estava aparecendo qualquer captcha.
Segue o link de arquivo do relatorio.
[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
A mensagem persiste.

Boa Tarde! ivanskalla

> Execute o OTL.exe.
> Copie estas informações que estão em vermelho,para o campo clipboard da ferramenta. ( "Exames Personalizados Correções" ) 

:OTL
O2:64bit: - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: []  File not found
O13 - gopher Prefix: missing
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
[2014/10/31 00:51:49 | 000,000,000 | ---D | C] -- C:\Users\Ivan\AppData\Roaming\Baidu
[2014/10/31 00:35:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Baidu
[2014/10/31 00:35:19 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Baidu
[2014/10/29 22:39:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Baidu Security
[2014/10/29 22:38:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Baidu-Security-2014-4.4.4.82804
[14 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2014/11/01 14:07:34 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1967382788-1474785530-657225906-1000Core1cfc52c419c9fa0.job
[2014/07/11 23:15:11 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2014/07/11 23:15:11 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2014/07/11 23:15:11 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2014/07/11 23:15:11 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2014/07/11 23:15:11 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/06/05 21:30:25 | 000,034,304 | ---- | C] () -- C:\Users\Ivan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2014/10/31 00:51:49 | 000,000,000 | ---D | M] -- C:\Users\Ivan\AppData\Roaming\Baidu
[2014/08/31 12:58:46 | 000,000,924 | ---- | C] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1967382788-1474785530-657225906-1000UA.job
[2014/08/31 13:00:08 | 000,000,902 | ---- | C] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1967382788-1474785530-657225906-1000Core1cfc52c419c9fa0.job
[1 \Users\Ivan\Desktop\Ivan\Jogos\call of duty\*.tmp files -> \Users\Ivan\Desktop\Ivan\Jogos\call of duty\*.tmp -> ]
[14 \Windows\System32\*.tmp files -> \Windows\System32\*.tmp -> ]
[14 \Windows\SysWOW64\*.tmp files -> \Windows\SysWOW64\*.tmp -> ]
[2014/10/31 00:50:40 | 000,662,367 | ---- | M] () -- \ProgramData\IObit\ASCDownloader\Downloader.log
[2014/09/24 23:19:13 | 000,013,012 | ---- | M] () -- \ProgramData\IObit\ASCDownloader\Toolbox_Downloader.log
[2014/10/31 00:50:40 | 000,662,367 | ---- | M] () -- \Users\All Users\IObit\ASCDownloader\Downloader.log
[2014/09/24 23:19:13 | 000,013,012 | ---- | M] () -- \Users\All Users\IObit\ASCDownloader\Toolbox_Downloader.log
[2014/10/31 00:50:40 | 000,662,367 | ---- | M] () -- \Users\Todos os Usuários\IObit\ASCDownloader\Downloader.log
[2014/09/24 23:19:13 | 000,013,012 | ---- | M] () -- \Users\Todos os Usuários\IObit\ASCDownloader\Toolbox_Downloader.log
[2014/10/31 00:51:49 | 000,000,000 | ---D | M] -- C:\Users\Ivan\AppData\Roaming\Baidu

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes]
"Gopher"="gopher://"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command]
""=""%1" %*"

:Files
ipconfig /flushdns /c
ipconfig /renew /c
netsh winsock reset catalog /c

:Commands 
[CREATERESTOREPOINT]
[resethosts] 
[emptytemp] 
[purity] 
[Reboot]

> Clique no botão Consertar >> Aguarde a conclusão!
> O computador vai reiniciar! 
> Ao surgir,novamente,clique "Executar". 

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Para versões em Inglês,clique em Run Fix que é o mesmo que Consertar.
> Poste o relatório: C:\_OTL\MovedFiles\*.log 

A+

All processes killed
========== OTL ==========
64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\\gopher|:gopher:// /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\grooveLocalGWS\ deleted successfully.
File Protocol\Handler\grooveLocalGWS - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ms-help\ deleted successfully.
File Protocol\Handler\ms-help - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype4com\ deleted successfully.
File Protocol\Handler\skype4com - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlmailhtml\ deleted successfully.
File Protocol\Handler\wlmailhtml - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlpg\ deleted successfully.
File Protocol\Handler\wlpg - No CLSID value found not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
C:\Users\Ivan\AppData\Roaming\Baidu\Baidu Antivirus\Upload folder moved successfully.
C:\Users\Ivan\AppData\Roaming\Baidu\Baidu Antivirus folder moved successfully.
C:\Users\Ivan\AppData\Roaming\Baidu folder moved successfully.
C:\ProgramData\Baidu\Baidu Antivirus folder moved successfully.
C:\ProgramData\Baidu\Antivirus folder moved successfully.
C:\ProgramData\Baidu folder moved successfully.
C:\Users\Public\Documents\Baidu\Common\I18N folder moved successfully.
C:\Users\Public\Documents\Baidu\Common folder moved successfully.
C:\Users\Public\Documents\Baidu folder moved successfully.
C:\ProgramData\Baidu Security folder moved successfully.
C:\Program Files (x86)\Baidu-Security-2014-4.4.4.82804\Baidu Antivirus folder moved successfully.
C:\Program Files (x86)\Baidu-Security-2014-4.4.4.82804 folder moved successfully.
C:\Windows\SysWow64\sho14AD.tmp deleted successfully.
C:\Windows\SysWow64\sho3065.tmp deleted successfully.
C:\Windows\SysWow64\sho416.tmp deleted successfully.
C:\Windows\SysWow64\sho62CC.tmp deleted successfully.
C:\Windows\SysWow64\sho6867.tmp deleted successfully.
C:\Windows\SysWow64\sho70B0.tmp deleted successfully.
C:\Windows\SysWow64\sho8102.tmp deleted successfully.
C:\Windows\SysWow64\sho8A22.tmp deleted successfully.
C:\Windows\SysWow64\sho9A2.tmp deleted successfully.
C:\Windows\SysWow64\shoBC8D.tmp deleted successfully.
C:\Windows\SysWow64\shoD2EA.tmp deleted successfully.
C:\Windows\SysWow64\shoE0FE.tmp deleted successfully.
C:\Windows\SysWow64\shoEC1D.tmp deleted successfully.
C:\Windows\SysWow64\shoF191.tmp deleted successfully.
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1967382788-1474785530-657225906-1000Core1cfc52c419c9fa0.job moved successfully.
C:\Windows\PEV.exe moved successfully.
C:\Windows\MBR.exe moved successfully.
C:\Windows\sed.exe moved successfully.
C:\Windows\grep.exe moved successfully.
C:\Windows\zip.exe moved successfully.
C:\Users\Ivan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini moved successfully.
Folder C:\Users\Ivan\AppData\Roaming\Baidu\ not found.
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1967382788-1474785530-657225906-1000UA.job moved successfully.
File C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1967382788-1474785530-657225906-1000Core1cfc52c419c9fa0.job not found.
\Users\Ivan\Desktop\Ivan\Jogos\call of duty\00000001.TMP deleted successfully.
File move failed. \ProgramData\IObit\ASCDownloader\Downloader.log scheduled to be moved on reboot.
File move failed. \ProgramData\IObit\ASCDownloader\Toolbox_Downloader.log scheduled to be moved on reboot.
File move failed. \Users\All Users\IObit\ASCDownloader\Downloader.log scheduled to be moved on reboot.
File move failed. \Users\All Users\IObit\ASCDownloader\Toolbox_Downloader.log scheduled to be moved on reboot.
File move failed. \Users\Todos os Usuários\IObit\ASCDownloader\Downloader.log scheduled to be moved on reboot.
File move failed. \Users\Todos os Usuários\IObit\ASCDownloader\Toolbox_Downloader.log scheduled to be moved on reboot.
Folder C:\Users\Ivan\AppData\Roaming\Baidu\ not found.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\\"Gopher"|"gopher://" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\\""|""%1" %*" /E : value set successfully!
========== FILES ==========
< ipconfig /flushdns /c >
Configura‡Æo de IP do Windows
Libera‡Æo do Cache do DNS Resolver bem-sucedida.
C:\Users\Ivan\Downloads\cmd.bat deleted successfully.
C:\Users\Ivan\Downloads\cmd.txt deleted successfully.
< ipconfig /renew /c >
Configura‡Æo de IP do Windows
Nenhuma opera‡Æo pode ser executada em ConexÆo de Rede sem Fio 2 enquanto a
m¡dia estiver desconectada.
Nenhuma opera‡Æo pode ser executada em ConexÆo de Rede Bluetooth enquanto a
m¡dia estiver desconectada.
Adaptador de Rede sem Fio ConexÆo de Rede sem Fio 2:
Estado da m¡dia. . . . . . . . . . . . . . : m¡dia desconectada
Sufixo DNS espec¡fico de conexÆo. . . . . . :
Adaptador Ethernet ConexÆo de Rede Bluetooth:
Estado da m¡dia. . . . . . . . . . . . . . : m¡dia desconectada
Sufixo DNS espec¡fico de conexÆo. . . . . . :
Adaptador de Rede sem Fio ConexÆo de Rede sem Fio:
Sufixo DNS espec¡fico de conexÆo. . . . . . :
Endere‡o IPv6 de link local . . . . . . . . : fe80::a847:4fbd:1210:4a82%11
Endere‡o IPv4. . . . . . . . . . . . . . . : 192.168.1.100
M scara de Sub-rede . . . . . . . . . . . . : 255.255.255.0
Gateway PadrÆo. . . . . . . . . . . . . . . : 192.168.1.1
Adaptador Ethernet VMware Network Adapter VMnet1:
Sufixo DNS espec¡fico de conexÆo. . . . . . :
Endere‡o IPv6 de link local . . . . . . . . : fe80::4935:b4ea:62fc:3e3f%32
Endere‡o IPv4. . . . . . . . . . . . . . . : 192.168.234.1
M scara de Sub-rede . . . . . . . . . . . . : 255.255.255.0
Gateway PadrÆo. . . . . . . . . . . . . . . :
Adaptador Ethernet VMware Network Adapter VMnet8:
Sufixo DNS espec¡fico de conexÆo. . . . . . :
Endere‡o IPv6 de link local . . . . . . . . : fe80::ccfd:fdde:552:8165%33
Endere‡o IPv4. . . . . . . . . . . . . . . : 192.168.30.1
M scara de Sub-rede . . . . . . . . . . . . : 255.255.255.0
Gateway PadrÆo. . . . . . . . . . . . . . . :
C:\Users\Ivan\Downloads\cmd.bat deleted successfully.
C:\Users\Ivan\Downloads\cmd.txt deleted successfully.
< netsh winsock reset catalog /c >
Catálogo Winsock redefinido com êxito.
Reinicie o computador para concluir a redefinição.
C:\Users\Ivan\Downloads\cmd.bat deleted successfully.
C:\Users\Ivan\Downloads\cmd.txt deleted successfully.
========== COMMANDS ==========
System Restore Service not available.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Ivan
->Temp folder emptied: 59581523 bytes
->Temporary Internet Files folder emptied: 58664 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 3049873 bytes
->Google Chrome cache emptied: 124855770 bytes
->Flash cache emptied: 865 bytes

User: Public

User: Todos os Usuários

User: Usuário Padrão
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 10853996 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 42888672 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 666 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 230,00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 11022014_153141

Files\Folders moved on Reboot...
File move failed. \ProgramData\IObit\ASCDownloader\Downloader.log scheduled to be moved on reboot.
File move failed. \ProgramData\IObit\ASCDownloader\Toolbox_Downloader.log scheduled to be moved on reboot.
File move failed. \Users\All Users\IObit\ASCDownloader\Downloader.log scheduled to be moved on reboot.
File move failed. \Users\All Users\IObit\ASCDownloader\Toolbox_Downloader.log scheduled to be moved on reboot.
File move failed. \Users\Todos os Usuários\IObit\ASCDownloader\Downloader.log scheduled to be moved on reboot.
File move failed. \Users\Todos os Usuários\IObit\ASCDownloader\Toolbox_Downloader.log scheduled to be moved on reboot.
C:\Users\Ivan\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Ivan\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
File move failed. C:\Windows\temp\vmware-SISTEMA\vmauthd.log scheduled to be moved on reboot.
C:\Windows\temp\vmware-SISTEMA\vmware-usbarb-2776.log moved successfully.
File move failed. C:\Windows\temp\TmpFile1 scheduled to be moved on reboot.
File move failed. C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Tudo ocoreu como esperado, foi um processo rapido, meu computador teve uma inicialização de desktop nitidamente mais rapida, porem a mensagem ainda esta aparecendo.

Boa Tarde! ivanskalla

> Tecle: Windows+R >> Na caixa "Executar",digite:

notepad %windir%\system32\drivers\etc\hosts

> Clique OK.
> Ps: Abrirá um arquivo texto!
> Copie e cole seu conteúdo para análise.
>
> Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > ( ... by Adlice Software ) ( 32 bits version )

> Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]  > ( ... by Adlice Software ) ( 64 bits version )

> Salve-o no desktop! [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Feche aplicativos que estejam abertos!
> Execute RogueKiller.exe e aceite a Eula,caso solicite!
> Se o "Filtro SmartScreen" bloquear o anti-malware,clique em "Mais informações" >> "Executar de qualquer maneira"

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] 

> Aguarde a finalização de seu Pre-scan,que se inicia automáticamente.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Dê início ao diagnóstico,clicando no botão "Verificar". 
> Poste o relatório ao concluir: RKreport[1].txt

A+

Boa tarde Joram!
Eu não entendi muito bem este passo, eu executei o comando e abriu um texto do bloco de notas que eu deveria colocar este conteudo do texto para analise, porem não entendi onde devo colocar este texto para analise, estou em duvida neste passo.

O RogueKiller ja esta em execução e realizando a verificação.

RogueKiller V10.0.4.0 (x64) [Oct 29 2014] por Adlice Software
mail : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Feedback : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Site : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Blog : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Sistema Operacional : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Iniciou : Modo normal
Usuário : Ivan [Administrador]
Modo : Escanear -- Data : 11/02/2014 19:02:59

¤¤¤ Processos : 0 ¤¤¤

¤¤¤ Registro : 12 ¤¤¤
[Suspicious.Path] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce | {90120000-0030-0000-0000-0000000FF1CE} : C:\Windows\system32\cmd.exe /C del "C:\ProgramData\Microsoft Help\Rgstrtn.lck" /Q /A:H -> Encontrado
[Suspicious.Path] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce | {90120000-0030-0000-0000-0000000FF1CE} : C:\Windows\system32\cmd.exe /C del "C:\ProgramData\Microsoft Help\Rgstrtn.lck" /Q /A:H -> Encontrado
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce | {90120000-0030-0000-0000-0000000FF1CE} : C:\Windows\system32\cmd.exe /C del "C:\ProgramData\Microsoft Help\Rgstrtn.lck" /Q /A:H -> Encontrado
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce | {90120000-0030-0000-0000-0000000FF1CE} : C:\Windows\system32\cmd.exe /C del "C:\ProgramData\Microsoft Help\Rgstrtn.lck" /Q /A:H -> Encontrado
[PUM.SearchPage] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Search Page : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] -> Encontrado
[PUM.SearchPage] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Search Page : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] -> Encontrado
[PUM.SearchPage] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Search Page : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] -> Encontrado
[PUM.SearchPage] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Search Page : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] -> Encontrado
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Encontrado
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Encontrado
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Encontrado
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Encontrado

¤¤¤ Tarefas : 2 ¤¤¤
[Suspicious.Path] \\060184C3-9766-46a0-B258-F4518A0B2633 -- C:\Windows\system32\CScript.exe ("C:\ProgramData\Baidu Security\Duplicaterecord.js") -> Encontrado
[Suspicious.Path] \\iolo System Checkup -- C:\ProgramData\iolo\scustask.lnk (/toaster) -> Encontrado

¤¤¤ Arquivos : 0 ¤¤¤

¤¤¤ Arquivos de hosts : 2 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost
[C:\Windows\System32\drivers\etc\hosts] ::1 localhost

¤¤¤ Antirootkit : 0 (Driver: Carregado) ¤¤¤

¤¤¤ Navegadores : 0 ¤¤¤

¤¤¤ Verificação da MBR : ¤¤¤
+++++ PhysicalDrive0: WDC WD5000BEVT-75A0RT0 +++++
--- User ---
[MBR] f9f27d4e20ee3bd05aca5ec878a2696b
[BSP] 3f2e75b4d3c938dff271b992dcd2cb9d : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 149 MB
1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 311296 | Size: 12540 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 25993216 | Size: 464244 MB
User = LL1 ... OK
User = LL2 ... OK

Este é o relatorio realizado pelo programa, porem não sei se executei corretamente todos os passo necessarios

ivanskalla escreveu:Boa tarde Joram!
Eu não entendi muito bem este passo, eu executei o comando e abriu um texto do bloco de notas que eu deveria colocar este conteudo do texto para analise, porem não entendi onde devo colocar este texto para analise, estou em duvida neste passo.

O RogueKiller ja esta em execução e realizando a verificação.

Boa Noite! ivanskalla

> Muito simples! Basta copiar e colar o texto,aqui no seu Post.
>
> Abra,novamente,a ferramenta RogueKiller e na guia Registro,marque as caixinhas e clique Deletar.
> Poste o relatório!

A+

ok.
O resultado do comando DOS é :

127.0.0.1 localhost
::1 localhost


Somente isto.
Fiz o segundo passo, clicar em deletar na ferramenta RogueKiller

Segue o relatorio:

RogueKiller V10.0.4.0 (x64) [Oct 29 2014] por Adlice Software
mail : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Feedback : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Site : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
Blog : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

Sistema Operacional : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Iniciou : Modo normal
Usuário : Ivan [Administrador]
Modo : Deletar -- Data : 11/02/2014 20:05:45

¤¤¤ Processos : 0 ¤¤¤

¤¤¤ Registro : 12 ¤¤¤
[Suspicious.Path] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce | {90120000-0030-0000-0000-0000000FF1CE} : C:\Windows\system32\cmd.exe /C del "C:\ProgramData\Microsoft Help\Rgstrtn.lck" /Q /A:H [7][x][x][x][x][x] -> Deletado
[Suspicious.Path] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce | {90120000-0030-0000-0000-0000000FF1CE} : C:\Windows\system32\cmd.exe /C del "C:\ProgramData\Microsoft Help\Rgstrtn.lck" /Q /A:H -> ERROR [2]
[Suspicious.Path] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce | {90120000-0030-0000-0000-0000000FF1CE} : C:\Windows\system32\cmd.exe /C del "C:\ProgramData\Microsoft Help\Rgstrtn.lck" /Q /A:H -> ERROR [2]
[Suspicious.Path] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce | {90120000-0030-0000-0000-0000000FF1CE} : C:\Windows\system32\cmd.exe /C del "C:\ProgramData\Microsoft Help\Rgstrtn.lck" /Q /A:H -> ERROR [2]
[PUM.SearchPage] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Search Page : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] -> Não selecionado
[PUM.SearchPage] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Search Page : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] -> Não selecionado
[PUM.SearchPage] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Search Page : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] -> Não selecionado
[PUM.SearchPage] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Search Page : [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] -> Não selecionado
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Não selecionado
[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Não selecionado
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Não selecionado
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Não selecionado

¤¤¤ Tarefas : 2 ¤¤¤
[Suspicious.Path] \\060184C3-9766-46a0-B258-F4518A0B2633 -- C:\Windows\system32\CScript.exe ("C:\ProgramData\Baidu Security\Duplicaterecord.js") -> Deletado
[Suspicious.Path] \\iolo System Checkup -- C:\ProgramData\iolo\scustask.lnk (/toaster) -> Deletado

¤¤¤ Arquivos : 0 ¤¤¤

¤¤¤ Arquivos de hosts : 2 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost
[C:\Windows\System32\drivers\etc\hosts] ::1 localhost

¤¤¤ Antirootkit : 0 (Driver: Carregado) ¤¤¤

¤¤¤ Navegadores : 0 ¤¤¤

¤¤¤ Verificação da MBR : ¤¤¤
+++++ PhysicalDrive0: WDC WD5000BEVT-75A0RT0 +++++
--- User ---
[MBR] f9f27d4e20ee3bd05aca5ec878a2696b
[BSP] 3f2e75b4d3c938dff271b992dcd2cb9d : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 149 MB
1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 311296 | Size: 12540 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 25993216 | Size: 464244 MB
User = LL1 ... OK
User = LL2 ... OK


============================================
RKreport_SCN_11022014_190259.log

A mensagem ainda aparece

ivanskalla escreveu:A mensagem ainda aparece

Boa Noite! ivanskalla

> Pelo visto,vc está sem o Hosts,pois segundo o comando proposto,não veio informações completas do Hosts.

< [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] >

> Vá a esta página,e execute o Fix it ali proposto.

> Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > ( ... by Smeenk )

< [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem] [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] >

> Salve-o ao desktop!
> Desabilite seu antivírus!
> Para Windows 7,execute zoek.exe como administrador.

resethosts;
autoclean; 

> Copie e cole estas informações,que estão em vermelho,no campo da ferramenta.
> Clique "Run Script". 

Zoek.exe is running now. 
Do not start any browser windows, they will be closed automatically. 
Please wait! This window will close when finished. 
A logfile will open afterwards and can also be found on your systemdrive as zoek-results.log

> Surgirão informações,pedindo-lhe que aguarde o surgimento do relatório.
> Ps: Essas informações,podem permanecer estáticas na tela por 20 minutos ou mais.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

> Confirme o reboot!

zoek.hta failed by unknown error.
Restart computer, and try again.

> Ps: Ao obter algum erro,reinicie o PC e execute,novamente,a ferramenta.
> Poste o relatório,que estará em C:\zoek-results.txt << 

A+