[Resolvido] Não consigo resolver vários Malwares (atajitos)

magalhaesrj · Março 25, 2015

Prezados, estou meio que desesperado e não consigo remover alguns malwares em meu PC. Gostaria de ajuda para remove-los.

em anexo uma imagem de alguns que encontrei mas o programa nao remove.

caedurodrigues · Março 25, 2015

Boa tarde magalhaesrj, poste o log do hijackthis segundo a REGRA Nº 02 - Utilizando o Hijackthis. Um grande abraço.

magalhaesrj · Março 25, 2015

Segue o log

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 12:31:10, on 25/03/2015

Platform: Unknown Windows (WinNT 6.02.1008)

MSIE: Internet Explorer v11.0 (11.00.9600.17416)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\TeamViewer\TeamViewer.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files\AVAST Software\Avast\AvastUI.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Users\magalhaes\AppData\Roaming\Dropbox\bin\Dropbox.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

C:\WINDOWS\SysWOW64\DllHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=userinit.exe

O2 - BHO: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\XTab\SupTab.dll (file missing)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

O2 - BHO: G-Buster Browser Defense Itaú Unibanco - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\Program Files (x86)\GbPlugin\gbiehuni.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r

O4 - HKLM\..\Run: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"

O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_93B0EF6D6451A2CCCC2ADFE3A7EE2F96] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window

O4 - Startup: Dropbox.lnk = magalhaes\AppData\Roaming\Dropbox\bin\Dropbox.exe

O8 - Extra context menu item: &Enviar para o OneNote - res://C:\PROGRA~1\MICROS~1\Office14\ONBttnIE.dll/105

O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office14\EXCEL.EXE/3000

O8 - Extra context menu item: Se&nd to OneNote - res://C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105

O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: &Anotações Vinculadas do OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O17 - HKLM\System\CCS\Services\Tcpip\..\{866359DA-FCEF-4B9A-98AC-A6ACA4E75E31}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O20 - Winlogon Notify: GbPluginUni - C:\Program Files (x86)\GbPlugin\gbiehUni.dll

O23 - Service: 70F4EEDB-1367-4b4f-8247-3133551A7415 - Unknown owner - C:\Program Files\shopperz\grunt.exe

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\WINDOWS\System32\alg.exe (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Avast Antivirus (avast! Antivirus) - Avast Software s.r.o. - C:\Program Files\AVAST Software\Avast\AvastSvc.exe

O23 - Service: AvastVBox COM Service (AvastVBoxSvc) - Avast Software - C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe

O23 - Service: Intel® Content Protection HECI Service (cphs) - Intel Corporation - C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe

O23 - Service: csrcc - Unknown owner - C:\Program Files\shopperz\csrcc.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\WINDOWS\system32\fxssvc.exe (file missing)

O23 - Service: Gbp Service (GbpSv) - GAS Tecnologia - C:\PROGRA~2\GbPlugin\GbpSv.exe

O23 - Service: Serviço do Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Tecnologia de armazenamento Intel® Rapid (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\WINDOWS\system32\IEEtwCollector.exe (file missing)

O23 - Service: IHProtect Service - XTab system - C:\Program Files (x86)\XTab\ProtectService.exe

O23 - Service: Intel® Capability Licensing Service Interface - Intel® Corporation - C:\Program Files\Intel\iCLS Client\HeciServer.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Intel® Dynamic Application Loader Host Interface Service (jhi_service) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)

O23 - Service: KMS Server Service (KMSEmulator) - Unknown owner - C:\ProgramData\KMSAuto\KMSES.exe

O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\WINDOWS\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)

O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\WINDOWS\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)

O23 - Service: Net Service Event Handler (Sed) - Navigation Co., Ltd. - C:\Users\magalhaes\AppData\Roaming\ntsvc\ntsvc.exe

O23 - Service: shopperz Updater - Unknown owner - C:\Program Files\shopperz\nseven.exe

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\WINDOWS\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\WINDOWS\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\WINDOWS\system32\sppsvc.exe (file missing)

O23 - Service: Adobe SwitchBoard (SwitchBoard) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

O23 - Service: TeamViewer 10 (TeamViewer) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\WINDOWS\system32\UI0Detect.exe (file missing)

O23 - Service: Intel® Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

O23 - Service: Update NetCrawl - Unknown owner - C:\Program Files (x86)\NetCrawl\updateNetCrawl.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)

O23 - Service: @oem2.inf,%ViaKaraokeSrv.SvcDesc%;VIA Karaoke digital mixer Service (VIAKaraokeService) - Unknown owner - C:\WINDOWS\system32\viakaraokesrv.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\WINDOWS\system32\vssvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\WINDOWS\system32\wbengine.exe (file missing)

O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-320 (WdNisSvc) - Unknown owner - C:\Program Files (x86)\Windows Defender\NisSrv.exe (file missing)

O23 - Service: @%ProgramFiles%\Windows Defender\MpAsDesc.dll,-310 (WinDefend) - Unknown owner - C:\Program Files (x86)\Windows Defender\MsMpEng.exe (file missing)

O23 - Service: WindowsMangerProtect Service (WindowsMangerProtect) - SysTool PasSame LIMITED - C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 12930 bytes

caedurodrigues · Março 25, 2015

Boa tarde magalhaesrj,

Baixe: <> (...par Xplode)

Ou aqui >>AdwCleaner<<

Salve-a na sua Desktop (área de trabalho).

Feche todos os programas e navegadores de internet abertos.

Usuários do Windows Vista ou Windows 7,clique com o direito do mouse sobre o arquivo AdwCleaner.exe,depois clique em:

Clique em Examinar, para iniciar o escaneamento!

Ao término, clique em limpar

Copie o log ou clique "Relatório".

Poste: >>C:\AdwCleaner\AdwCleaner [s0].txt<<

Baixe:<> <(...by Oleg N. Scherbakov)>

Salve-o no desktop!

Desabilite seu antivírus!

Para Windows 7, clique direito em JRT.exe e execute-o como

Aguarde a conclusão e poste o relatório. ( JRT.txt )

Um grande abraço. :thumbsup:

magalhaesrj · Março 25, 2015

# AdwCleaner v4.113 - Logfile created 25/03/2015 at 14:11:14

# Updated 22/03/2015 by Xplode

# Database : 2015-03-23.1 [server]

# Operating system : Windows 8.1 Single Language (x64)

# Username : magalhaes - PC-DESIGN

# Running from : C:\Users\magalhaes\Desktop\adwcleaner_4.113.exe

# Option : Scan

***** [ Services ] *****

Service Found : Update NetCrawl

Service Found : WindowsMangerProtect

Service Found : shopperz Updater

Service Found : IHProtect Service

Service Found : cherimoya

Service Found : csrcc

Service Found : 70F4EEDB-1367-4b4f-8247-3133551A7415

***** [ Files / Folders ] *****

File Found : C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Local Storage\chrome-extension_aaaalipaokhkccgmgkdglfinfnfhflko_0.localstorage

File Found : C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_services.hearstmags.com_0.localstorage-journal

File Found : C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.audienceinsights.net_0.localstorage

File Found : C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.audienceinsights.net_0.localstorage-journal

File Found : C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.williamhill.com_0.localstorage

File Found : C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.williamhill.com_0.localstorage-journal

File Found : C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.best-deals-products.com_0.localstorage-journal

File Found : C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.softonic.com.br_0.localstorage-journal

File Found : C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.best-deals-products.com_0.localstorage-journal

File Found : C:\Users\magalhaes\AppData\Local\mysearchdial-speeddial.crx

File Found : C:\Users\magalhaes\AppData\Roaming\Mozilla\Firefox\Profiles\9zlp1fq2.default\searchplugins\Mysearchdial.xml

File Found : C:\Users\magalhaes\AppData\Roaming\Mozilla\Firefox\Profiles\9zlp1fq2.default\user.js

File Found : C:\WINDOWS\System32\drivers\cherimoya.sys

File Found : C:\WINDOWS\System32\roboot64.exe

Folder Found : C:\Program Files (x86)\Mobogenie

Folder Found : C:\Program Files (x86)\predm

Folder Found : C:\Program Files (x86)\XTab

Folder Found : C:\Program Files\shopperz

Folder Found : C:\ProgramData\Babylon

Folder Found : C:\ProgramData\baidu

Folder Found : C:\ProgramData\IHProtectUpDate

Folder Found : C:\ProgramData\WindowsMangerProtect

Folder Found : C:\Users\MAGALH~1\AppData\Local\Temp\Macwebtoise

Folder Found : C:\Users\magalhaes\AppData\Local\Babylon

Folder Found : C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\aaaalipaokhkccgmgkdglfinfnfhflko

Folder Found : C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\cmaiofennmphjldldcpphcechfnnohja

Folder Found : C:\Users\magalhaes\AppData\Local\FilesFrog Update Checker

Folder Found : C:\Users\magalhaes\AppData\Local\lollipop

Folder Found : C:\Users\magalhaes\AppData\Local\webplayer

Folder Found : C:\Users\magalhaes\AppData\LocalLow\Mysearchdial

Folder Found : C:\Users\magalhaes\AppData\Roaming\Babylon

Folder Found : C:\Users\magalhaes\AppData\Roaming\baidu

Folder Found : C:\Users\magalhaes\AppData\Roaming\Macwebtoise

Folder Found : C:\Users\magalhaes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FilesFrog Update Checker

Folder Found : C:\Users\magalhaes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FLV Player

Folder Found : C:\Users\magalhaes\AppData\Roaming\Mozilla\Firefox\Profiles\9zlp1fq2.default\Extensions\fftoolbar2014@etech.com

Folder Found : C:\Users\magalhaes\AppData\Roaming\Mozilla\Firefox\Profiles\9zlp1fq2.default\Extensions\istart_ffnt@gmail.com

Folder Found : C:\Users\magalhaes\AppData\Roaming\Mozilla\Firefox\Profiles\9zlp1fq2.default\Extensions\searchengine@gmail.com

Folder Found : C:\Users\magalhaes\AppData\Roaming\mystartsearch

Folder Found : C:\Users\magalhaes\AppData\Roaming\Systweak

Folder Found : C:\Users\magalhaes\SupTab

Folder Found : C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Roaming\Systweak

***** [ Scheduled tasks ] *****

Task Found : SomotoUpdateCheckerAutoStart

Task Found : gtaUpt

***** [ Shortcuts ] *****

***** [ Registry ] *****

Data Found : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command [(Default)] - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1427145097&from=slbnew&uid=TOSHIBAXDT01ACA100_23RZ8K9PSXX23RZ8K9PSX

Key Found : HKCU\Software\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}

Key Found : HKCU\Software\Baidu

Key Found : HKCU\Software\BI

Key Found : HKCU\Software\GAMESDESKTOP

Key Found : HKCU\Software\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff

Key Found : HKCU\Software\HomeTab

Key Found : HKCU\Software\InstallCore

Key Found : HKCU\Software\lollipop

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{ABCD0123-1234-5678-ABCD-0123456789AB}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\FLV Player

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance

Key Found : HKCU\Software\Mozilla\Extends

Key Found : HKCU\Software\mysearchdial.com

Key Found : HKCU\Software\SearchProtectWS

Key Found : HKCU\Software\simplytech

Key Found : HKCU\Software\Somoto

Key Found : HKCU\Software\systweak

Key Found : HKCU\Software\TNT2

Key Found : HKCU\Software\UpdateStar

Key Found : HKCU\Software\WajIntEnhance

Key Found : HKCU\Software\Webplayer

Key Found : [x64] HKCU\Software\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}

Key Found : [x64] HKCU\Software\Baidu

Key Found : [x64] HKCU\Software\BI

Key Found : [x64] HKCU\Software\GAMESDESKTOP

Key Found : [x64] HKCU\Software\HomeTab

Key Found : [x64] HKCU\Software\InstallCore

Key Found : [x64] HKCU\Software\lollipop

Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{ABCD0123-1234-5678-ABCD-0123456789AB}

Key Found : [x64] HKCU\Software\mysearchdial.com

Key Found : [x64] HKCU\Software\SearchProtectWS

Key Found : [x64] HKCU\Software\simplytech

Key Found : [x64] HKCU\Software\Somoto

Key Found : [x64] HKCU\Software\systweak

Key Found : [x64] HKCU\Software\TNT2

Key Found : [x64] HKCU\Software\UpdateStar

Key Found : [x64] HKCU\Software\WajIntEnhance

Key Found : [x64] HKCU\Software\Webplayer

Key Found : HKLM\SOFTWARE\Baidu

Key Found : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}

Key Found : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}

Key Found : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}

Key Found : HKLM\SOFTWARE\Classes\Prod.cap

Key Found : HKLM\SOFTWARE\Classes\S

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}

Key Found : HKLM\SOFTWARE\Conduit

Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\eofcbnmajmjmplflapaojjnihcjkigck

Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff

Key Found : HKLM\SOFTWARE\IHProtect

Key Found : HKLM\SOFTWARE\Iminent

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{ABCD0123-1234-5678-ABCD-0123456789AB}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FilesFrog Update Checker

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance

Key Found : HKLM\SOFTWARE\mysearchdial

Key Found : HKLM\SOFTWARE\mystartsearchSoftware

Key Found : HKLM\SOFTWARE\SearchProtect

Key Found : HKLM\SOFTWARE\shopperz

Key Found : HKLM\SOFTWARE\SupDp

Key Found : HKLM\SOFTWARE\SupTab

Key Found : HKLM\SOFTWARE\systweak

Key Found : HKLM\SOFTWARE\Trymedia Systems

Key Found : HKLM\SOFTWARE\Tutorials

Key Found : HKLM\SOFTWARE\Uniblue

Key Found : HKLM\SOFTWARE\WajIntEnhance

Key Found : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}

Key Found : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{28193046-93B0-4A88-923B-2DB1AA023853}

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}

Key Found : [x64] HKLM\SOFTWARE\shopperz

Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [fftoolbar2014@etech.com]

Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [istart_ffnt@gmail.com]

Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [searchengine@gmail.com]

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17416

-\\ Mozilla Firefox v36.0.1 (x86 pt-BR)

[9zlp1fq2.default] - Line Found : user_pref("extensions.enabledAddons", "istart_ffnt%40gmail.com:5.3.7,searchengine%40gmail.com:1.0.0.1027,%7B87F8774F-B485-47E2-A755-A40A8A5E8873%7D:3.10.0.1,%7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:[...]

-\\ Google Chrome v41.0.2272.101

[C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [search Provider] : hxxp://www.shutterstock.com/cat.mhtml?searchterm={searchTerms}&language=en〈=en&search_source=&safesearch=1&version=llv1&media_type=

[C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [search Provider] : hxxp://en.softonic.com/s/{searchTerms}

[C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [search Provider] : hxxp://www.centauro.com.br/browse/searchResults.jsp?_dyncharset=UTF-8&_dynSessConf=3631743065349689591&questionSaved=&catIdSaved=&isSimpleSearchResults=true&searchExecByFormSubmit=true&q_pageSize=48&%2Fatg%2Fcommerce%2Fsearch%2Fcatalog%2FQueryFormHandler.goToPage=1&_D%3A%2Fatg%2Fcommerce%2Fsearch%2Fcatalog%2FQueryFormHandler.goToPage=+&%2Fatg%2Fcommerce%2Fsearch%2Fcatalog%2FQueryFormHandler.searchRequest.docSort=relevance&_D%3A%2Fatg%2Fcommerce%2Fsearch%2Fcatalog%2FQueryFormHandler.searchRequest.docSort=+&%2Fatg%2Fcommerce%2Fsearch%2Fcatalog%2FQueryFormHandler.searchRequest.docSortOrder=descending&_D%3A%2Fatg%2Fcommerce%2Fsearch%2Fcatalog%2FQueryFormHandler.searchRequest.docSortOrder=+&%2Fatg%2Fcommerce%2Fsearch%2Fcatalog%2FQueryFormHandler.searchRequest.multiSearchSession=false&_D%3A%2Fatg%2Fcommerce%2Fsearch%2Fcatalog%2FQueryFormHandler.searchRequest.multiSearchSession=+&%2Fatg%2Fcommerce%2Fsearch%2Fcatalog%2FQueryFormHandler.searchRequest.saveRequest=false&_D%3A%2Fatg%2Fcommerce%2Fsearch%2Fcatalog%2FQueryFormHandler.searchRequest.saveRequest=+&%2Fatg%2Fcommerce%2Fsearch%2Fcatalog%2FQueryFormHandler.searchRequest.pageSize=48&_D%3A%2Fatg%2Fcommerce%2Fsearch%2Fcatalog%2FQueryFormHandler.searchRequest.pageSize=+&%2Fatg%2Fcommerce%2Fsearch%2Fcatalog%2FQueryFormHandler.searchRequest.question={searchTerms}&_D%3A%2Fatg%2Fcommerce%2Fsearch%2Fcatalog%2FQueryFormHandler.searchRequest.question=+&startCategory=rootCategory&%2Fatg%2Fcommerce%2Fsearch%2Fcatalog%2FQueryFormHandler.search=Enviar&_D%3A%2Fatg%2Fcommerce%2Fsearch%2Fcatalog%2FQueryFormHandler.search=+&_DARGS=%2Fnavigation%2Fgadgets%2Fsearch.jsp

[C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [search Provider] : hxxp://idg.receita.fazenda.gov.br/@@busca?SearchableText={searchTerms}

[C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [search Provider] : hxxp://wordpress.org/search/do-search.php?search={searchTerms}

[C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [search Provider] : hxxp://www.softonic.com.br/s/{searchTerms}

[C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [search Provider] : hxxp://search.hao123.com/s?tn=SE_garavast_6upp6eh1&cid=avastbcl&ie=utf-8&wd={searchTerms}

[C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [search Provider] : hxxp://br.ask.com/web?q={searchTerms}

[C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [search Provider] : hxxp://en.softonic.com/s/{searchTerms}

-\\ Comodo Dragon v

[C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Web data] - Found [search Provider] : hxxp://br.ask.com/web?q={searchTerms}

[C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Web data] - Found [search Provider] : hxxp://search.ask.com/web?o=APN10257&doi=2014-07-07&apn_dtid=%5ECMD011%5EYY%5EUS&apn_ptnrs=%5EAGO&q={searchTerms}

[C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\preferences] - Found [Extension] : cmaiofennmphjldldcpphcechfnnohja

[C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\preferences] - Found [Extension] : aaaalipaokhkccgmgkdglfinfnfhflko

-\\ Opera v0.0.0.0

*************************

AdwCleaner[R0].txt - [14871 bytes] - [25/03/2015 14:11:14]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [14931 bytes] ##########

===============

=======

=

==

JRT

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.4.6 (03.22.2015:1)

OS: Windows 8.1 Single Language x64

Ran by magalhaes on 25/03/2015 at 14:11:20,73

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-342643391-3236263706-997985258-1001\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\update netcrawl

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\NetCrawl_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\NetCrawl_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\updateNetCrawl_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\updateNetCrawl_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\NetCrawl_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\NetCrawl_RASMANCS

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\updateNetCrawl_RASAPI32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\updateNetCrawl_RASMANCS

Successfully deleted: [Registry Key] "hkey_current_user\software\apn pip"

Successfully deleted: [Registry Key] "hkey_local_machine\software\askpartnernetwork"

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{28193046-93B0-4A88-923B-2DB1AA023853}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E9410C70-B6AE-41FF-AB71-32F4B279EA5F}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

~~~ Files

Successfully deleted: [File] "C:\ProgramData\duplicaterecord.js"

Successfully deleted: [File] "C:\Users\magalhaes\appdata\local\google\chrome\user data\default\local storage\http_www.superfish.com_0.localstorage-journal"

Successfully deleted: [File] "C:\Users\magalhaes\appdata\local\google\chrome\user data\default\local storage\http_www.wajam.com_0.localstorage-journal"

~~~ Folders

Successfully deleted: [Folder] C:\ProgramData\AlawarWrapper

Successfully deleted: [Folder] "C:\ProgramData\babylon"

Successfully deleted: [Folder] "C:\ProgramData\baidu"

Successfully deleted: [Folder] "C:\ProgramData\baidu security"

Successfully deleted: [Folder] "C:\ProgramData\ihprotectupdate"

Successfully deleted: [Folder] "C:\ProgramData\windowsmangerprotect"

Successfully deleted: [Folder] "C:\Users\magalhaes\AppData\Roaming\babylon"

Successfully deleted: [Folder] "C:\Users\magalhaes\AppData\Roaming\baidu"

Successfully deleted: [Folder] "C:\Users\magalhaes\AppData\Roaming\baidu security"

Successfully deleted: [Folder] "C:\Users\magalhaes\AppData\Roaming\systweak"

Successfully deleted: [Folder] "C:\Users\magalhaes\appdata\local\babylon"

Successfully deleted: [Folder] "C:\Users\magalhaes\appdata\local\filesfrog update checker"

Successfully deleted: [Folder] "C:\Users\magalhaes\appdata\local\lollipop"

Successfully deleted: [Folder] "C:\Users\magalhaes\appdata\local\webplayer"

Successfully deleted: [Folder] "C:\Users\magalhaes\appdata\locallow\mysearchdial"

Successfully deleted: [Folder] "C:\Program Files (x86)\baidu security"

Successfully deleted: [Folder] "C:\Program Files (x86)\mobogenie"

Successfully deleted: [Folder] "C:\Program Files (x86)\predm"

Successfully deleted: [Folder] "C:\Program Files (x86)\xtab"

Successfully deleted: [Folder] "C:\Users\magalhaes\AppData\Roaming\microsoft\windows\start menu\programs\filesfrog update checker"

~~~ FireFox

Successfully deleted: [File] C:\Users\magalhaes\AppData\Roaming\mozilla\firefox\profiles\9zlp1fq2.default\user.js

Successfully deleted: [File] C:\Users\magalhaes\AppData\Roaming\mozilla\firefox\profiles\9zlp1fq2.default\searchplugins\mysearchdial.xml

Successfully deleted: [Folder] C:\Users\magalhaes\AppData\Roaming\mozilla\firefox\profiles\9zlp1fq2.default\extensions\staged

Successfully deleted the following from C:\Users\magalhaes\AppData\Roaming\mozilla\firefox\profiles\9zlp1fq2.default\prefs.js

user_pref("browser.search.searchengine.alias", "mystartsearch");

user_pref("browser.search.searchengine.desc", "this is my first firefox searchEngine");

user_pref("browser.search.searchengine.iconURL", "hxxp://www.mystartsearch.com/web/favicon.ico");

user_pref("browser.search.searchengine.name", "mystartsearch");

user_pref("browser.search.searchengine.ptid", "slbnew");

user_pref("browser.search.searchengine.uid", "TOSHIBAXDT01ACA100_23RZ8K9PSXX23RZ8K9PSX");

user_pref("browser.search.searchengine.url", "hxxp://www.mystartsearch.com/web/?type=dspp&ts=1427145198&from=slbnew&uid=TOSHIBAXDT01ACA100_23RZ8K9PSXX23RZ8K9PSX&q={searchTerms

user_pref("browser.startup.homepage", "hxxp://www.mystartsearch.com/?type=hppp&ts=1427145198&from=slbnew&uid=TOSHIBAXDT01ACA100_23RZ8K9PSXX23RZ8K9PSX");

user_pref("extensions.ffxtlbr@mysearchdial.com.install-event-fired", true);

user_pref("extensions.firefox@mybuzzsearch.com.install-event-fired", true);

user_pref("extensions.irmysearch.aflt", "irmsd1103");

user_pref("extensions.irmysearch.cd", "2XzuyEtN2Y1L1Qzu0E0C0AzzyC0B0ByDyB0D0CtAyCyEzzyEtN0D0Tzu0CyCzyzztN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R");

user_pref("extensions.irmysearch.cr", "1186918451");

user_pref("extensions.irmysearch.instlRef", "");

user_pref("extensions.mysearchdial.aflt", "irmsd1103");

user_pref("extensions.mysearchdial.appId", "{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}");

user_pref("extensions.mysearchdial.cd", "2XzuyEtN2Y1L1Qzu0E0C0AzzyC0B0ByDyB0D0CtAyCyEzzyEtN0D0Tzu0CyCzyzztN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R");

user_pref("extensions.mysearchdial.cntry", "BR");

user_pref("extensions.mysearchdial.cr", "1186918451");

user_pref("extensions.mysearchdial.dfltLng", "");

user_pref("extensions.mysearchdial.dfltSrch", true);

user_pref("extensions.mysearchdial.dnsErr", true);

user_pref("extensions.mysearchdial.dpkLst", "3654782829,1334533236,1121012847,231756876,1895130307,603719297,4288797614,3754950497,426401714,3046281807,752626116,1657571787,32

user_pref("extensions.mysearchdial.excTlbr", false);

user_pref("extensions.mysearchdial.hdrMd5", "95F4518B5FECE855D306D140C850BCCD");

user_pref("extensions.mysearchdial.hmpg", true);

user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0E0C0AzzyC0B0ByDyB0D0CtAyCyEzzyEtN0D0Tzu0CyCzyzztN1L2XzutBtFtBt

user_pref("extensions.mysearchdial.id", "ECA86BB57DC36484");

user_pref("extensions.mysearchdial.instlDay", "16037");

user_pref("extensions.mysearchdial.instlRef", "");

user_pref("extensions.mysearchdial.lastB", "hxxp://start.mysearchdial.com/?f=1&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0E0C0AzzyC0B0ByDyB0D0CtAyCyEzzyEtN0D0Tzu0CyCzyzztN1L2XzutBtFtBtFt

user_pref("extensions.mysearchdial.lastVrsnTs", "1.8.21.018:39:56");

user_pref("extensions.mysearchdial.newTabUrl", "hxxp://start.mysearchdial.com/?f=2&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0E0C0AzzyC0B0ByDyB0D0CtAyCyEzzyEtN0D0Tzu0CyCzyzztN1L2XzutBtFt

user_pref("extensions.mysearchdial.prdct", "mysearchdial");

user_pref("extensions.mysearchdial.prtnrId", "mysearchdial");

user_pref("extensions.mysearchdial.sg", "none");

user_pref("extensions.mysearchdial.srchPrvdr", "Mysearchdial");

user_pref("extensions.mysearchdial.tlbrId", "base");

user_pref("extensions.mysearchdial.tlbrSrchUrl", "hxxp://start.mysearchdial.com/?f=3&a=irmsd1103&cd=2XzuyEtN2Y1L1Qzu0E0C0AzzyC0B0ByDyB0D0CtAyCyEzzyEtN0D0Tzu0CyCzyzztN1L2XzutBt

user_pref("extensions.mysearchdial.vrsn", "1.8.21.0");

user_pref("extensions.mysearchdial.vrsni", "1.8.21.0");

user_pref("extensions.mysearchdial_i.hmpg", true);

user_pref("extensions.mysearchdial_i.newTab", false);

user_pref("extensions.mysearchdial_i.smplGrp", "none");

user_pref("extensions.mysearchdial_i.vrsnTs", "1.8.21.018:39:56");

Emptied folder: C:\Users\magalhaes\AppData\Roaming\mozilla\firefox\profiles\9zlp1fq2.default\minidumps [4 files]

~~~ Chrome

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 25/03/2015 at 14:15:14,36

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

caedurodrigues · Março 25, 2015

Boa tarde magalhaesrj, você executou a ferramenta AdwCleaner na opção Examinar. Execute novamente a ferramenta e clique em Limpar. Poste o relatório.

magalhaesrj · Março 25, 2015

Desculpe!

Veja se agora está correto

# AdwCleaner v4.113 - Logfile created 25/03/2015 at 15:14:42

# Updated 22/03/2015 by Xplode

# Database : 2015-03-23.1 [server]

# Operating system : Windows 8.1 Single Language (x64)

# Username : magalhaes - PC-DESIGN

# Running from : C:\Users\magalhaes\Desktop\adwcleaner_4.113.exe

# Option : Cleaning

***** [ Services ] *****

[#] Service Deleted : Update NetCrawl

[#] Service Deleted : WindowsMangerProtect

Service Deleted : shopperz Updater

[#] Service Deleted : IHProtect Service

[#] Service Deleted : cherimoya

Service Deleted : csrcc

Service Deleted : 70F4EEDB-1367-4b4f-8247-3133551A7415

***** [ Files / Folders ] *****

Folder Deleted : C:\Users\MAGALH~1\AppData\Local\Temp\Macwebtoise

Folder Deleted : C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Roaming\Systweak

Folder Deleted : C:\Program Files\shopperz

Folder Deleted : C:\Users\magalhaes\SupTab

Folder Deleted : C:\Users\magalhaes\AppData\Roaming\mystartsearch

Folder Deleted : C:\Users\magalhaes\AppData\Roaming\Macwebtoise

Folder Deleted : C:\Users\magalhaes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FLV Player

Folder Deleted : C:\Users\magalhaes\AppData\Roaming\Mozilla\Firefox\Profiles\9zlp1fq2.default\Extensions\fftoolbar2014@etech.com

Folder Deleted : C:\Users\magalhaes\AppData\Roaming\Mozilla\Firefox\Profiles\9zlp1fq2.default\Extensions\searchengine@gmail.com

Folder Deleted : C:\Users\magalhaes\AppData\Roaming\Mozilla\Firefox\Profiles\9zlp1fq2.default\Extensions\istart_ffnt@gmail.com

Folder Deleted : C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\cmaiofennmphjldldcpphcechfnnohja

Folder Deleted : C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\aaaalipaokhkccgmgkdglfinfnfhflko

File Deleted : C:\WINDOWS\System32\roboot64.exe

File Deleted : C:\WINDOWS\System32\drivers\cherimoya.sys

File Deleted : C:\Users\magalhaes\AppData\Local\mysearchdial-speeddial.crx

File Deleted : C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_services.hearstmags.com_0.localstorage-journal

File Deleted : C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.softonic.com.br_0.localstorage-journal

File Deleted : C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.best-deals-products.com_0.localstorage-journal

File Deleted : C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.audienceinsights.net_0.localstorage

File Deleted : C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.audienceinsights.net_0.localstorage-journal

File Deleted : C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.best-deals-products.com_0.localstorage-journal

File Deleted : C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.williamhill.com_0.localstorage

File Deleted : C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.williamhill.com_0.localstorage-journal

File Deleted : C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Local Storage\chrome-extension_aaaalipaokhkccgmgkdglfinfnfhflko_0.localstorage

***** [ Scheduled tasks ] *****

Task Deleted : SomotoUpdateCheckerAutoStart

Task Deleted : gtaUpt

***** [ Shortcuts ] *****

***** [ Registry ] *****

Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [fftoolbar2014@etech.com]

Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [searchengine@gmail.com]

Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [istart_ffnt@gmail.com]

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\eofcbnmajmjmplflapaojjnihcjkigck

Key Deleted : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\pflphaooapbgpeakohlggbpidpppgdff

Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap

Key Deleted : HKLM\SOFTWARE\Classes\S

Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect

Key Deleted : HKCU\Software\Mozilla\Extends

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}

Data Restored : HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{ABCD0123-1234-5678-ABCD-0123456789AB}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{ABCD0123-1234-5678-ABCD-0123456789AB}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{28193046-93B0-4A88-923B-2DB1AA023853}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

Key Deleted : HKCU\Software\BI

Key Deleted : HKCU\Software\HomeTab

Key Deleted : HKCU\Software\InstallCore

Key Deleted : HKCU\Software\lollipop

Key Deleted : HKCU\Software\mysearchdial.com

Key Deleted : HKCU\Software\simplytech

Key Deleted : HKCU\Software\Somoto

Key Deleted : HKCU\Software\systweak

Key Deleted : HKCU\Software\UpdateStar

Key Deleted : HKCU\Software\Webplayer

Key Deleted : HKCU\Software\GAMESDESKTOP

Key Deleted : HKCU\Software\Baidu

Key Deleted : HKCU\Software\TNT2

Key Deleted : HKCU\Software\WajIntEnhance

Key Deleted : HKCU\Software\SearchProtectWS

Key Deleted : HKCU\Software\{4E7638A1-6962-4e44-A6B9-F40E84FD6D09}

Key Deleted : HKLM\SOFTWARE\Conduit

Key Deleted : HKLM\SOFTWARE\Iminent

Key Deleted : HKLM\SOFTWARE\mysearchdial

Key Deleted : HKLM\SOFTWARE\SearchProtect

Key Deleted : HKLM\SOFTWARE\SupDp

Key Deleted : HKLM\SOFTWARE\SupTab

Key Deleted : HKLM\SOFTWARE\systweak

Key Deleted : HKLM\SOFTWARE\Trymedia Systems

Key Deleted : HKLM\SOFTWARE\Tutorials

Key Deleted : HKLM\SOFTWARE\Uniblue

Key Deleted : HKLM\SOFTWARE\mystartsearchSoftware

Key Deleted : HKLM\SOFTWARE\shopperz

Key Deleted : HKLM\SOFTWARE\Baidu

Key Deleted : HKLM\SOFTWARE\IHProtect

Key Deleted : HKLM\SOFTWARE\WajIntEnhance

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\FLV Player

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FilesFrog Update Checker

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IMBoosterARP

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IminentToolbar

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mystartsearch uninstall

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WajIntEnhance

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Vosteran.com

Key Deleted : [x64] HKLM\SOFTWARE\shopperz

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17416

-\\ Mozilla Firefox v36.0.1 (x86 pt-BR)

[9zlp1fq2.default\prefs.js] - Line Deleted : user_pref("extensions.enabledAddons", "istart_ffnt%40gmail.com:5.3.7,searchengine%40gmail.com:1.0.0.1027,%7B87F8774F-B485-47E2-A755-A40A8A5E8873%7D:3.10.0.1,%7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:[...]

-\\ Google Chrome v41.0.2272.101

[C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://br.ask.com/web?q={searchTerms}

[C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://search.ask.com/web?o=APN10257&doi=2014-07-07&apn_dtid=%5ECMD011%5EYY%5EUS&apn_ptnrs=%5EAGO&q={searchTerms}

-\\ Comodo Dragon v

[C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://br.ask.com/web?q={searchTerms}

[C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://search.ask.com/web?o=APN10257&doi=2014-07-07&apn_dtid=%5ECMD011%5EYY%5EUS&apn_ptnrs=%5EAGO&q={searchTerms}

[C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\preferences] - Deleted [Extension] : cmaiofennmphjldldcpphcechfnnohja

[C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\preferences] - Deleted [Extension] : aaaalipaokhkccgmgkdglfinfnfhflko

-\\ Opera v0.0.0.0

[C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://br.ask.com/web?q={searchTerms}

[C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://search.ask.com/web?o=APN10257&doi=2014-07-07&apn_dtid=%5ECMD011%5EYY%5EUS&apn_ptnrs=%5EAGO&q={searchTerms}

*************************

AdwCleaner[R0].txt - [15103 bytes] - [25/03/2015 14:11:14]

AdwCleaner[R1].txt - [10475 bytes] - [25/03/2015 15:12:34]

AdwCleaner[s0].txt - [10353 bytes] - [25/03/2015 15:14:42]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [10413 bytes] ##########

caedurodrigues · Março 25, 2015

Boa noite magalhaesrj, desinstale o spyhunter.

Baixe: <ZHPDiag ><> ( ...Nicolas Coolman)

Salve-o no Disco local (C ou D).

Desabilite seu antivírus, e execute ZHPDiag.exe para instalar.

Execute o ícone do pergaminho!

Clique na opção "COMPLETA" e aguarde a conclusão.

Clique OK e,ao concluir, poste o relatório! ( ZHPDiag.txt )

Obs: O relatório por ser extenso deve ser postado em um desses sites:

Acesse: <>

Ou acesse:<>

Um grande abraço. :thumbsup:

magalhaesrj · Março 26, 2015

Segue o relatório

http://cjoint.com/?ECApuAsGmol

caedurodrigues · Março 26, 2015

Boa tarde magalhaes,

Execute este script na ferramenta ZHPFix.

Copie estas informações que estão em vermelho para o Bloco de notas.

Com o Bloco de notas aberto, faça: ctrl+a >> ctrl+c.

À seguir, minimize o Bloco de notas.

Script ZHPFix

SysRestore

O3 - Toolbar: (no name) - [HKLM]{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} Chave orfã

O3 - Toolbar: (no name) - [HKLM]{CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} Chave orfã

O3 - Toolbar\WebBrowser: (no name) - [HKCU]{47833539-D0C5-4125-9FA8-0819E2EAAC93} Chave orfã

O4 - GS\QuickLaunch [magalhaes]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.atajitos.com =>Hijacker.Browsers

O4 - GS\QuickLaunch [magalhaes]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe http://www.atajitos.com =>Hijacker.Browsers

O4 - GS\TaskBar [magalhaes]: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.atajitos.com =>Hijacker.Browsers

O4 - GS\TaskBar [magalhaes]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe http://www.atajitos.com =>Hijacker.Browsers

O4 - GS\Program [magalhaes]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe http://www.atajitos.com =>Hijacker.Browsers

O4 - HKLM\..\Run: [3D BubbleSound] C:\Program Files\BubbleSound\3D BubbleSound.exe (.not file.) =>PUP.BubbleSound

O4 - HKLM\..\Wow6432Node\Run: [uDC Integration] Chave orfã

O4 - HKLM\..\Wow6432Node\Run: [gmsd_br_339] Chave orfã

O23 - Service: KMS Server Service (KMSEmulator) . (...) - C:\ProgramData\KMSAuto\KMSES.exe =>Trojan.AutoKMS

O41 - Driver: (Bfilter) . (. - .) - C:\WINDOWS\system32\drivers\Bfilter.sys (.not file.)

O41 - Driver: (Bfmon) . (. - .) - C:\WINDOWS\system32\drivers\Bfmon.sys (.not file.)

O41 - Driver: (Bnbase) . (. - .) - C:\Windows\System32\drivers\bnba---64.sys (.not file.)

O41 - Driver: (Bndef) . (. - .) - C:\WINDOWS\system32\drivers\bndef64.sys (.not file.)

O41 - Driver: (Bprotect) . (. - .) - C:\WINDOWS\system32\drivers\Bprotect.sys (.not file.)

O42 - Logiciel: SpyHunter - (.Enigma Software Group USA, LLC.) [HKLM][64Bits] -- {4FC9DA9D-F608-454E-8191-D7EFFDCC5726} =>PUP.EnigmaSoftware

O42 - Logiciel: SpyHunter 4 - (.Enigma Software Group, LLC.) [HKLM][64Bits] -- SpyHunter =>PUP.EnigmaSoftware

[HKCU\Software\Baidu Security]

[HKLM\Software\Baidu Security]

[HKLM\Software\EnigmaSoftwareGroup] =>PUP.EnigmaSoftware

[HKLM\Software\Wow6432Node\Baidu Security]

[HKLM\Software\Wow6432Node\Baidu_Drp_pos]

[HKLM\Software\Wow6432Node\EnigmaSoftwareGroup] =>PUP.EnigmaSoftware

[HKLM\Software\Wow6432Node\atajitos]

O43 - CFD: 07/07/2014 - 12:13:55 - [] ----D C:\Program Files (x86)\Baidu-Security-2014-4.4.4.73687

O43 - CFD: 25/03/2015 - 09:08:29 - [] ----D C:\Program Files (x86)\Enigma Software Group =>PUP.EnigmaSoftware

O43 - CFD: 02/05/2014 - 15:05:14 - [] ----D C:\ProgramData\boost_interprocess

O43 - CFD: 21/01/2014 - 17:49:29 - [] ----D C:\ProgramData\KMSAuto =>Trojan.AutoKMS

O43 - CFD: 23/03/2015 - 18:31:53 - [] ----D C:\ProgramData\PC Faster

O43 - CFD: 07/07/2014 - 12:28:44 - [0] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Baidu Antivirus

O43 - CFD: 07/07/2014 - 12:01:22 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hao123-Brazil

O43 - CFD: 24/03/2015 - 18:14:31 - [] ----D C:\Users\magalhaes\AppData\Roaming\Enigma Software Group =>PUP.EnigmaSoftware

O43 - CFD: 25/03/2015 - 09:08:30 - [] ----D C:\Users\magalhaes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter =>Crapware.SpyHunter

O44 - LFC:[MD5.3A1D49071E1D06DCACEEFE8082BBE2B8] - 25/03/2015 - 10:53:47 ---A- . (...) -- C:\spyhunter.fix [1131446] =>Crapware.SpyHunter

O45 - LFCP:[MD5.6F93B2B5FAB764009D4F05D07537A1A7] - 23/03/2015 - 18:25:04 ---A- - C:\Windows\Prefetch\3D BUBBLESOUND.EXE-920EAE65.pf =>PUP.BubbleSound

O45 - LFCP:[MD5.887E06E5C8D60F92C13189594DA47C36] - 23/03/2015 - 18:11:19 ---A- - C:\Windows\Prefetch\GAMESDESKTOP3-BRINSTALLER.TMP-50864629.pf =>Adware.GamesDesktop

O45 - LFCP:[MD5.C60438ED39C9DBB5E7799D727832760A] - 23/03/2015 - 18:11:19 ---A- - C:\Windows\Prefetch\GAMESDESKTOP3-BRINSTALLER.TMP-A1F8767B.pf =>Adware.GamesDesktop

O45 - LFCP:[MD5.F1D19BAEBF3F20D40BC887C62C4B80BF] - 23/03/2015 - 18:17:17 ---A- - C:\Windows\Prefetch\PACKAGE_BUBBLESOUND_INSTALLER-2471ECBA.pf =>PUP.BubbleSound

O45 - LFCP:[MD5.C6768195407DB0207FB39F9DCC3EB927] - 23/03/2015 - 18:17:07 ---A- - C:\Windows\Prefetch\PACKAGE_QUICKREF_P_INSTALLER_-D30BBCEA.pf =>PUP.QuickRef

O45 - LFCP:[MD5.AA245345563417EF49A6E6E96D83598E] - 24/03/2015 - 11:40:43 ---A- - C:\Windows\Prefetch\PREDM.TMP-3FAE61EA.pf =>Adware.Downware

O45 - LFCP:[MD5.A18C4F79597932305E3468DD9F3310EF] - 24/03/2015 - 11:40:25 ---A- - C:\Windows\Prefetch\PREDM.TMP-58A42BA3.pf =>Adware.Downware

O45 - LFCP:[MD5.680207405B116B04DEE3EB9B0DA79627] - 23/03/2015 - 18:17:48 ---A- - C:\Windows\Prefetch\QUICKREF_P_SOFT_PARTNER.TMP-88AB9DE5.pf =>PUP.QuickRef

O45 - LFCP:[MD5.0C9554CADDBC605D5462E455A893EECC] - 25/03/2015 - 10:25:55 ---A- - C:\Windows\Prefetch\SPYHUNTER-INSTALLER.EXE-93E8F4E1.pf =>Crapware.SpyHunter

O45 - LFCP:[MD5.B53F0EA51C6014991EA636BE05F9AAC7] - 24/03/2015 - 18:14:33 ---A- - C:\Windows\Prefetch\SPYHUNTER4.EXE-3B4E3201.pf =>Crapware.SpyHunter

O45 - LFCP:[MD5.FD47E103939592A1487A25BE28A913E8] - 25/03/2015 - 10:40:23 ---A- - C:\Windows\Prefetch\SPYHUNTER4.EXE-C6ED45BC.pf =>Crapware.SpyHunter

O45 - LFCP:[MD5.F91352A911686779D81999273C484A85] - 25/03/2015 - 09:16:18 ---A- - C:\Windows\Prefetch\SPYHUNTERS.EXE-D9AA41AC.pf =>Crapware.SpyHunter

O45 - LFCP:[MD5.156D06CBB8C793C8B170AC3A85FA79A4] - 25/03/2015 - 09:13:23 ---A- - C:\Windows\Prefetch\SPYHUNTERS.EXE-DCFE7CCC.pf =>Crapware.SpyHunter

O45 - LFCP:[MD5.90AEFD22A406DCAFE7982FE6D97FF8A1] - 23/03/2015 - 18:23:57 ---A- - C:\Windows\Prefetch\VOPACKAGE.EXE-2B7684A8.pf =>Adware.Downware

O45 - LFCP:[MD5.964886E5BC482F9C94586A14B4CBE607] - 23/03/2015 - 18:11:19 ---A- - C:\Windows\Prefetch\VUUPCINSTALLER.EXE-2823F475.pf =>PUP.VuuPC

O53 - SMSR:HKLM\...\startupreg\FLV Player [Key] . (...) -- C:\Users\magalhaes\AppData\Local\WebPlayer\FLV Player\WebPlayer.exe (.not file.)

O53 - SMSR:HKLM\...\startupreg\shopperz [Key] . (...) -- C:\Program Files\shopperz\wrex.exe (.not file.) =>PUP.Shopperz

O53 - SMSR:HKLM\...\startupreg\shopperz64 [Key] . (...) -- C:\Program Files\shopperz\wrex64.exe (.not file.) =>PUP.Shopperz

O61 - LFC: 23/03/2015 - 11:01:24 ---A- . (...) -- C:\Users\magalhaes\AppData\Local\Temp\is-N3M01.tmp\quickref_p_soft_partner.exe [1506841] =>PUP.QuickRef

O61 - LFC: 23/03/2015 - 11:01:24 ---A- . (.Software.) -- C:\Users\magalhaes\AppData\Local\Temp\is-BKAES.tmp\package_BubbleSound_installer_multilang.exe [481376] =>PUP.BubbleSound

O61 - LFC: 23/03/2015 - 11:01:24 ---A- . (.Software.) -- C:\Users\magalhaes\AppData\Local\Temp\is-BKAES.tmp\package_quickref_p_installer_multilang.exe [482744] =>PUP.QuickRef

O61 - LFC: 24/03/2015 - 11:00:09 ---A- . (.shopperz.) -- C:\Users\magalhaes\AppData\Local\Microsoft\Windows\INetCache\IE\8HNI119Q\sprz[1].exe [2527976] =>PUP.Shopperz

O61 - LFC: 24/03/2015 - 11:01:51 ---A- . (.Enigma Software Group USA, LLC..) -- C:\Users\magalhaes\AppData\Roaming\Enigma Software Group\sh_installer.exe [3044736] =>PUP.EnigmaSoftware

O61 - LFC: 25/03/2015 - 11:01:57 R--A- . (.Enigma Software Group USA, LLC..) -- C:\Users\magalhaes\Downloads\SpyHunter 4.1.11.0 + Crack\Crack\SpyHunter4.exe [3021720] =>PUP.EnigmaSoftware

O61 - LFC: 25/03/2015 - 11:01:58 R--A- . (...) -- C:\Users\magalhaes\Downloads\SpyHunter 4.1.11.0 + Crack\spyhunterS.exe [15397208] =>Crapware.SpyHunter

SR - | Auto 21/01/2014 277504 | (KMSEmulator) . (...) - C:\ProgramData\KMSAuto\KMSES.exe =>Trojan.AutoKMS

[HKLM\SYSTEM\CurrentControlSet\Services\KMSEmulator] =>Trojan.AutoKMS^

[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{4FC9DA9D-F608-454E-8191-D7EFFDCC5726}] =>PUP.EnigmaSoftware^

[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\SpyHunter] =>PUP.EnigmaSoftware^

[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\shopperz] =>PUP.Shopperz^

[HKLM\Software\Microsoft\Shared Tools\MSConfig\startupreg\shopperz64] =>PUP.Shopperz^

[HKLM\Software\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}] =>Toolbar.Ask

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:3D BubbleSound =>PUP.BubbleSound^

C:\Program Files (x86)\Enigma Software Group =>PUP.EnigmaSoftware^

C:\ProgramData\KMSAuto =>Trojan.AutoKMS^

C:\Users\magalhaes\AppData\Roaming\Enigma Software Group =>PUP.EnigmaSoftware^

C:\Users\magalhaes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter =>Crapware.SpyHunter^

[HKLM\Software\EnigmaSoftwareGroup] =>PUP.EnigmaSoftware^

[HKLM\Software\Wow6432Node\EnigmaSoftwareGroup] =>PUP.EnigmaSoftware^

ServiceStop:KMSEmulator

ServiceStop:Bfilter

ServiceStop:Bfmon

ServiceStop:Bnbase

ServiceStop:Bndef

ServiceStop:Bprotect

EmptyClsid

FirewallRaz

EmptyPrefetch

EmptyTemp

EmptyFlash

Abra a ferramenta ZHPFix. <>

Clique em IMPORTAÇÃO > OK

Clique "GO".

Poste o Relatório!

Um grande abraço. :thumbsup:

< Peço aos visitantes que não utilizem este script em outros computadores,sob risco de danos irreparáveis aos mesmos! >

magalhaesrj · Março 26, 2015

Segue o relatorio

Rapport de ZHPFix 2015.3.18.4 par Nicolas Coolman, Update du 18/03/2015

Fichier d'export Registre :

Run by magalhaes at 26/03/2015 13:45:08

High Elevated Privileges : OK

Windows 8 Home Premium Edition, 64-bit Service Pack 1 (9600)

Reciclagem vazia (00mn 11s)

Prefetcher vazio

========== Softwares ==========

ELIMINÉ: SpyHunter

AUSENTE Uninstall Process: c:\users\magalhaes\appdata\roaming\enigma software group\sh_installer.exe

========== Estado dos serviços ==========

KMSEmulator Parado

Bfilter Parado

Bfmon Parado

Bnbase Parado

Bndef Parado

Bprotect Parado

========== Chaves do Registo ==========

ELIMINÉ Logiciel Key: [HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SpyHunter]

ELIMINÉ: Service: KMSEmulator

ELIMINÉ Driver Key: Bfilter

ELIMINÉ Driver Key: Bfmon

ELIMINÉ Driver Key: Bnbase

ELIMINÉ Driver Key: Bndef

ELIMINÉ Driver Key: Bprotect

ELIMINÉ: HKCU\Software\Baidu Security

ELIMINÉ:* HKLM\Software\Baidu Security

ELIMINÉ:* HKLM\Software\EnigmaSoftwareGroup

ELIMINÉ: HKLM\Software\Wow6432Node\Baidu_Drp_pos

ELIMINÉ: HKLM\Software\Wow6432Node\atajitos

ELIMINÉ:* StartupReg: FLV Player

ELIMINÉ:* StartupReg: shopperz

ELIMINÉ:* StartupReg: shopperz64

ELIMINÉ:* HKLM\Software\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

========== Valores do Registo ==========

ELIMINÉ: Toolbar: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5}

ELIMINÉ: Toolbar: {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F}

ELIMINÉ: Toolbar: {47833539-D0C5-4125-9FA8-0819E2EAAC93}

ELIMINÉ RunValue: 3D BubbleSound

ELIMINÉ RunValue: UDC Integration

ELIMINÉ RunValue: gmsd_br_339

Ausente Valor Perfil Padrão: FirewallRaz :

Ausente Valor Perfil Domínio FirewallRaz :

ELIMINÉ: FirewallRaz (Domain) : {9E3D57FC-7C37-4424-9352-4831E97D029D}

ELIMINÉ: FirewallRaz (Domain) : {548DCF8C-BFF2-4BA4-AA88-FBAF9AC8BCC6}

ELIMINÉ: FirewallRaz (Domain) : NetPres-In-TCP-NoScope

ELIMINÉ: FirewallRaz (Domain) : NetPres-Out-TCP-NoScope

ELIMINÉ: FirewallRaz (None) : NetPres-WSD-In-UDP

ELIMINÉ: FirewallRaz (None) : NetPres-WSD-Out-UDP

ELIMINÉ: FirewallRaz (Public) : NetPres-In-TCP

ELIMINÉ: FirewallRaz (Public) : NetPres-Out-TCP

ELIMINÉ: FirewallRaz (None) : MCX-Prov-Out-TCP

ELIMINÉ: FirewallRaz (None) : MCX-McrMgr-Out-TCP

ELIMINÉ: FirewallRaz (Private) : {CE1C85AC-2E67-42BE-8443-FB9F92054EC0}

ELIMINÉ: FirewallRaz (Private) : {6D3B90D7-A94E-4917-B3AB-0B7BC91D285C}

ELIMINÉ: FirewallRaz (Domain) : {E7985E1D-C36F-4787-80A8-6350D07E9266}

ELIMINÉ: FirewallRaz (None) : {808F1451-4108-46FD-ADBB-F17324B5F0BD}

========== Pastas ==========

Nenhuma pasta CLSID local utilizador vazia

ELIMINÉ Temporários windows (170)

ELIMINÉ Flash Cookies (0)

========== Ficheiros ==========

ELIMINÉ: c:\users\magalhaes\appdata\roaming\microsoft\internet explorer\quick launch\google chrome.lnk (http://www.atajitos.com)

CRIADO: C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

ELIMINÉ: c:\users\magalhaes\appdata\roaming\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk (http://www.atajitos.com)

CRIADO: C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

ELIMINÉ: c:\users\magalhaes\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk (http://www.atajitos.com)

CRIADO: C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk

ELIMINÉ: c:\users\magalhaes\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk (http://www.atajitos.com)

CRIADO: C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk

ELIMINÉ: c:\users\magalhaes\appdata\roaming\microsoft\windows\start menu\programs\internet explorer.lnk (http://www.atajitos.com)

CRIADO: C:\Users\magalhaes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

ELIMINÉ: c:\programdata\kmsauto\kmses.exe

ELIMINÉ: c:\spyhunter.fix

ELIMINÉ: c:\windows\prefetch\3d bubblesound.exe-920eae65.pf

ELIMINÉ: c:\windows\prefetch\gamesdesktop3-brinstaller.tmp-50864629.pf

ELIMINÉ: c:\windows\prefetch\gamesdesktop3-brinstaller.tmp-a1f8767b.pf

ELIMINÉ: c:\windows\prefetch\package_bubblesound_installer-2471ecba.pf

ELIMINÉ: c:\windows\prefetch\package_quickref_p_installer_-d30bbcea.pf

ELIMINÉ: c:\windows\prefetch\predm.tmp-3fae61ea.pf

ELIMINÉ: c:\windows\prefetch\predm.tmp-58a42ba3.pf

ELIMINÉ: c:\windows\prefetch\quickref_p_soft_partner.tmp-88ab9de5.pf

ELIMINÉ: c:\windows\prefetch\spyhunter-installer.exe-93e8f4e1.pf

ELIMINÉ: c:\windows\prefetch\spyhunter4.exe-3b4e3201.pf

ELIMINÉ: c:\windows\prefetch\spyhunter4.exe-c6ed45bc.pf

ELIMINÉ: c:\windows\prefetch\spyhunters.exe-d9aa41ac.pf

ELIMINÉ: c:\windows\prefetch\spyhunters.exe-dcfe7ccc.pf

ELIMINÉ: c:\windows\prefetch\vopackage.exe-2b7684a8.pf

ELIMINÉ: c:\windows\prefetch\vuupcinstaller.exe-2823f475.pf

ELIMINÉ: c:\users\magalhaes\appdata\local\temp\is-n3m01.tmp\quickref_p_soft_partner.exe

ELIMINÉ: c:\users\magalhaes\appdata\local\temp\is-bkaes.tmp\package_bubblesound_installer_multilang.exe

ELIMINÉ: c:\users\magalhaes\appdata\local\temp\is-bkaes.tmp\package_quickref_p_installer_multilang.exe

ELIMINÉ: c:\users\magalhaes\appdata\local\microsoft\windows\inetcache\ie\8hni119q\sprz[1].exe

ELIMINÉ: c:\users\magalhaes\downloads\spyhunter 4.1.11.0 + crack\crack\spyhunter4.exe

ELIMINÉ: c:\users\magalhaes\downloads\spyhunter 4.1.11.0 + crack\spyhunters.exe

ELIMINÉ Temporários windows (616) (2.086.373.364 octets)

ELIMINÉ Flash Cookies (0) (0 octets)

========== Restauração Sistema ==========

Ponto de restauro do sistema criado com sucesso

========== Recapitulativo ==========

16 : Chaves do Registo

22 : Valores do Registo

3 : Pastas

35 : Ficheiros

2 : Softwares

6 : Estado dos serviços

1 : Restauração Sistema

End of clean in 02mn 51s

========== Caminho do ficheiro do relatório ==========

C:\Users\magalhaes\AppData\Roaming\ZHP\ZHPFix[R1].txt - 26/03/2015 13:45:24 [6049]

caedurodrigues · Março 26, 2015

Boa tarde magalhaesrj,

Baixe:<zoek.exe> (...by Smeenk)

Salve na sua Desktop (Área de trabalho) !

Execute o arquivo Zoek.exe.

Usuários do Windows Vista ou Windows 7 clique com o direito sobre o arquivo Zoek.exe, depois clique em

Selecione as linhas em vermelho, clique com o direito sobre a seleção e escolha a opção copiar!

createsrpoint;

iedefaults;

ffdefaults;

CHRdefaults;

shortcutfix;

autoclean;

emptyalltemp;

ipconfig /flushdns;b

emptyfolderscheck;delete

Clique com o direito em qualquer parte branca do Zoek e escolha a opção colar.

Clique , aguarde o scan. Ao final abrirá o bloco de notas com o relatório.

Uma cópia também será salva no seu disco local com o nome zoek-results.txt.

Anexe o zoek-results.txt na sua próxima resposta.

Um grande abraço. :thumbsup:

magalhaesrj · Março 26, 2015

Zoek.exe v5.0.0.0 Updated 26-March-2015

Tool run by magalhaes on 26/03/2015 at 16:52:50,80.

Microsoft Windows 8.1 Single Language 6.3.9600 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\magalhaes\Downloads\zoek.exe [scan all users] [script inserted]

==== System Restore Info ======================

26/03/2015 17:00:38 Zoek.exe System Restore Point Created Successfully.

==== Empty Folders Check ======================

C:\PROGRA~2\DsNET Corp deleted successfully

C:\PROGRA~2\Freemake deleted successfully

C:\PROGRA~2\gmsd_br_332 deleted successfully

C:\Program Files\office.tmp deleted successfully

C:\PROGRA~3\ALM deleted successfully

C:\PROGRA~3\CorelDRAW Graphics Suite X6 deleted successfully

C:\PROGRA~3\CorelDRAW Graphics Suite X6.1 deleted successfully

C:\PROGRA~3\Oracle deleted successfully

C:\Users\magalhaes\AppData\Local\PACE Anti-Piracy deleted successfully

caedurodrigues · Março 26, 2015

Boa noite magalhaesrj, o relatório está incompleto. Poste por favor o relatório na íntegra.

magalhaesrj · Março 27, 2015

Zoek.exe v5.0.0.0 Updated 26-March-2015

Tool run by magalhaes on 26/03/2015 at 17:14:35,50.

Microsoft Windows 8.1 Single Language 6.3.9600 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\magalhaes\Desktop\zoek.exe [scan all users] [script inserted]

==== Older Logs ======================

C:\zoek-results2015-03-26-200147.log 924 bytes

==== System Restore Info ======================

26/03/2015 17:25:53 Zoek.exe System Restore Point Created Successfully.

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command]

@="C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe"

==== Batch Command(s) Run By Tool======================

==== Deleting Files \ Folders ======================

C:\PROGRA~2\Universal Document Converter deleted

C:\Users\magalhaes\AppData\Roaming\03000200-1427145148-0500-0006-000700080009 deleted

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted

C:\Users\magalhaes\AppData\LocalLow\Company deleted

C:\Users\magalhaes\AppData\LocalLow\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A} deleted

C:\windows\SysNative\tasks\060184C3-9766-46a0-B258-F4518A0B2633 deleted

C:\WINDOWS\SysNative\config\systemprofile\Searches deleted

C:\windows\SysNative\GroupPolicy\Machine deleted

C:\windows\SysNative\GroupPolicy\User deleted

C:\windows\SysNative\GroupPolicy\GPT.INI deleted

C:\WINDOWS\Syswow64\GroupPolicy\gpt.ini deleted

C:\Users\magalhaes\AppData\Roaming\unins000.exe deleted

"C:\Users\magalhaes\AppData\Roaming\ntsvc\ntsvc.exe" deleted

"C:\Users\magalhaes\AppData\Roaming\ntsvc" not deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]

"web2pdfextension@web2pdf.adobedotcom"="C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn" [28/05/2014 17:20]

[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]

"{87F8774F-B485-47E2-A755-A40A8A5E8873}"="C:\Users\magalhaes\AppData\Local\GAS Tecnologia\GBBD\uni\xpi" [27/08/2014 16:34]

==== Chromium Look ======================

Google Chrome Version: 41.0.2272.101 (Latest Stable version: 41.0.2272.101)

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions

gomekmidlodglbbmalcneegieacbdmki - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[25/03/2015 09:11]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions

lmjegmlicamnimmfhcmpkclmigmmcbeh - No path found[]

Comodo Drag&Drop Service - magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\aneodkojaglhnkkdbbdnmmmgimlcaogo

Comodo Web Inspector - magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\bdngekjahnmlkinegnhdmmbcfnmbclnn

Comodo Media Downloader - magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Extensions\dihmnpngfonlhjmgkflpnibiaaliendo

Firebug Lite for Google Chrome™ - magalhaes\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmagokdooijbeehmkpknfglimnifench

Jotform Notifier - magalhaes\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpdcoccpkmfifppefclifememfhakacb

Soongz - Youtube player de mÃºsicas - magalhaes\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbnnolclmpccgkjdnipokkcbjlgelanb

Stupeflix Video Maker - magalhaes\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkdmcfnoimoilncpjchamnenebopocem

Cartola for Chrome™ - magalhaes\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkmakjnhammpmefchjkboohfgebblhab

vGet Extension (Video Downloader DLNA) - magalhaes\AppData\Local\Google\Chrome\User Data\Default\Extensions\hniladkejehjfchadikcbjmgjaogciic

Vagalume - magalhaes\AppData\Local\Google\Chrome\User Data\Default\Extensions\ipgcdnbeeiajinajlafjcdfhckglcopd

GBBD GuardiÃ£o - ItaÃº 30 horas - magalhaes\AppData\Local\Google\Chrome\User Data\Default\Extensions\kgmpojlddncminmkddkpoegdjhojjipg

Show media files - magalhaes\AppData\Local\Google\Chrome\User Data\Default\Extensions\khbkckdkhakengfjmejmiabaakdlhaab

Dropbox Shortcut - magalhaes\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbelldokcfkkgejineadomjjcicgghbk

Downloader - magalhaes\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp

Boomerang for Gmail - magalhaes\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdanidgdpmkimeiiojknlnekblgmpdll

imo free video calls and text - magalhaes\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocaebkdojpikfmhmnekiflipcicedobi

Any.do - magalhaes\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocgddccilgpeepgglnlpchkpgamkgmld

Sidekick - magalhaes\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiiaigjnkhngdbnoookogelabohpglmd

Instagram Video Compilation ™ - magalhaes\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkjgkpkhpnpfgldmkimppnbpfnbkoibe

==== Chromium Startpages ======================

C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Preferences

"homepage": ""http://br.hao123.com/?tn=bbl_pay_hp_01_hao123_br&babsrc=HP_ss&mntrId=721B00242CAE6E6C", "http://br.hao123.com/?tn=R0YsXNdDeT_hao123_br&cid=avastbcl", "http://www.mystartsearch.com/?type=hp&ts=1427145097&from=slbnew&uid=TOSHIBAXDT01ACA100_23RZ8K9PSXX23RZ8K9PSX", "http://www.mystartsearch.com/?type=hppp&ts=1427145198&from=slbnew&uid=TOSHIBAXDT01ACA100_23RZ8K9PSXX23RZ8K9PSX", "http://www.google.com.br/" ]

==== Chromium Fix ======================

C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.mlstatic.com_0.localstorage-journal deleted successfully

C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_static.olark.com_0.localstorage-journal deleted successfully

C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_videodownloadconverter.dl.tb.ask.com_0.localstorage-journal deleted successfully

C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_artigos.softonic.com.br_0.localstorage-journal deleted successfully

C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Extensions\hniladkejehjfchadikcbjmgjaogciic deleted successfully

C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiiaigjnkhngdbnoookogelabohpglmd deleted successfully

C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_oiiaigjnkhngdbnoookogelabohpglmd_0.localstorage deleted successfully

C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_oiiaigjnkhngdbnoookogelabohpglmd_0.localstorage-journal deleted successfully

C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oiiaigjnkhngdbnoookogelabohpglmd deleted successfully

==== Set IE to Default ======================

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://www.google.com"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://www.google.com"

"Default_Page_URL"="http://www.google.com"

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]

"Start Page"="http://www.google.com"

"Default_Page_URL"="http://www.google.com"

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://www.google.com"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]

"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"

{E921F400-D383-4B1B-9DE6-FCFCACFC1173} Unknown Url="Not_Found"

==== Reset Google Chrome ======================

C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Preferences was reset successfully

C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully

C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully

C:\Users\magalhaes\AppData\Roaming\Opera Software\Opera Stable\Preferences was reset successfully

C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Web Data was reset successfully

C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully

C:\Users\magalhaes\AppData\Roaming\Opera Software\Opera Stable\Web Data was reset successfully

C:\Users\magalhaes\AppData\Roaming\Opera Software\Opera Stable\Web Data-journal was reset successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-342643391-3236263706-997985258-1001\Software\Microsoft\Internet Explorer\SearchScopes\{E921F400-D383-4B1B-9DE6-FCFCACFC1173} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{E921F400-D383-4B1B-9DE6-FCFCACFC1173} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E921F400-D383-4B1B-9DE6-FCFCACFC1173} deleted successfully

==== Deleting CLSID Registry Values ======================

==== shortcuts on Users Desktops ======================

C:\Users\magalhaes\Desktop\FEMPERJ - Atalho.lnk - C:\Users\magalhaes\Dropbox\Sites\FEMPERJ

C:\Users\magalhaes\Desktop\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Users\magalhaes\Desktop\HiJackThis.lnk - C:\Users\magalhaes\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

C:\Users\magalhaes\Desktop\ZHPDiag.lnk - C:\Program Files (x86)\ZHPDiag\ZHPhep.exe

C:\Users\magalhaes\Desktop\ZHPFix.lnk - C:\Program Files (x86)\ZHPDiag\ZHPFix\ZHPhep.exe

C:\Users\magalhaes\Desktop\PENDRIVE\Photos\2014-04-05 - Condominio Cidade Jardim\DSC_6883 - Atalho.lnk - C:\Users\magalhaes\Desktop\PENDRIVE\Photos\2014-04-05 - Condominio Cidade Jardim\DSC_6883.JPG

C:\Users\magalhaes\Desktop\PENDRIVE\Site\FIFA13\TABELA - Atalho.lnk - C:\Users\magalhaes\Desktop\PENDRIVE\Site\FIFA13\TABELA.xlsm

==== shortcuts in Users Start Menu ======================

C:\Users\magalhaes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\avast antivirus.lnk -

C:\Users\magalhaes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aplicativos do Google Chrome\Any.do.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.atajitos.com/?bd=sc&oem=Cube&uid=TOSHIBAXDT01ACA100_23RZ8K9PSXX23RZ8K9PSX&version=2.2.0.7859&pid=414031160&tid=317

C:\Users\magalhaes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aplicativos do Google Chrome\Awesome Screenshot App.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.atajitos.com/?bd=sc&oem=Cube&uid=TOSHIBAXDT01ACA100_23RZ8K9PSXX23RZ8K9PSX&version=2.2.0.7859&pid=414031160&tid=317

C:\Users\magalhaes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox\Dropbox.lnk - C:\Users\magalhaes\AppData\Roaming\Dropbox\bin\Dropbox.exe /home

C:\Users\magalhaes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox\Uninstall Dropbox.lnk - C:\Users\magalhaes\AppData\Roaming\Dropbox\bin\DropboxUninstaller.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Inicializador de aplicativos do Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.atajitos.com/?bd=sc&oem=Cube&uid=TOSHIBAXDT01ACA100_23RZ8K9PSXX23RZ8K9PSX&version=2.2.0.7859&pid=414031160&tid=317

C:\Users\magalhaes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Gramblr\Gramblr.lnk - C:\Gramblr\Gramblr.exe iconPath=@TargetDir/gramblr.ico

C:\Users\magalhaes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis\HiJackThis.lnk - C:\Users\magalhaes\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk - C:\Users\magalhaes\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup

==== shortcuts in All Users Start Menu ======================

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk - C:\Program Files (x86)\TeamViewer\TeamViewer.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X6\Bitstream Font Navigator.lnk - C:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X6\FontNav\FontNav.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X6\Corel CAPTURE X6.lnk - c:\WINDOWS\Installer\{74FA94F1-9566-4252-9372-E7EAFFEFE209}\NewShortcut8.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X6\Corel CONNECT X6.lnk - C:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X6\Connect\Connect.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X6\Corel PHOTO-PAINT X6.lnk - c:\WINDOWS\Installer\{6F53FB68-6620-423E-B7CD-B8205655B421}\NewShortcut2.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X6\CorelDRAW X6.lnk - c:\WINDOWS\Installer\{C5262276-0075-498B-B80F-7D997482E4DB}\NewShortcut1.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X6\Duplexing Wizard.lnk - c:\WINDOWS\Installer\{C5262276-0075-498B-B80F-7D997482E4DB}\NewShortcut4.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X6\Video Tutorials X6.lnk - C:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X6\VideoBrowser\VideoBrowser.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X6\Documentation\CorelDRAW Graphics Suite X6 Guidebook.lnk - c:\WINDOWS\Installer\{7F9F6864-8CAB-440C-AF44-030D0135666D}\NewShortcut1_2D4561AA1380433B9EC818E5007E4288.exe Help\GB.pdf

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X6\Documentation\Macro Programming Guide.lnk - C:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X6\Data\Macro Programming Guide.pdf

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.atajitos.com/?bd=sc&oem=Cube&uid=TOSHIBAXDT01ACA100_23RZ8K9PSXX23RZ8K9PSX&version=2.2.0.7859&pid=414031160&tid=317

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive\Google Docs.lnk - C:\Program Files (x86)\Google\Drive\googledrivesync.exe --new_document

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive\Google Drive.lnk - C:\Program Files (x86)\Google\Drive\googledrivesync.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive\Google Sheets.lnk - C:\Program Files (x86)\Google\Drive\googledrivesync.exe --new_spreadsheet

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive\Google Slides.lnk - C:\Program Files (x86)\Google\Drive\googledrivesync.exe --new_presentation

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Desinstalar Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\unins000.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Malwarebytes Anti-Malware Notifications.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\Chameleon\Windows\chameleon.chm

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype\Skype para a área de trabalho.lnk -

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP\ZHPDiag.lnk - C:\Program Files (x86)\ZHPDiag\ZHPhep.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP\ZHPFix.lnk - C:\Program Files (x86)\ZHPDiag\ZHPFix\ZHPhep.exe

==== shortcuts in Quick Launch ======================

C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -

C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -

C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -

C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files\Internet Explorer\iexplore.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Adobe After Effects CS6.lnk - C:\Program Files\Adobe\Adobe After Effects CS6\Support Files\AfterFX.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Adobe Illustrator CS6 (64 Bit).lnk - C:\Program Files\Adobe\Adobe Illustrator CS6 (64 Bit)\Support Files\Contents\Windows\Illustrator.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Adobe Photoshop CS6.lnk - C:\Program Files (x86)\Adobe\Adobe Photoshop CS6\Photoshop.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Adobe Premiere Pro CS6.lnk - C:\Program Files\Adobe\Adobe Premiere Pro CS6\Adobe Premiere Pro.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Calculator.lnk - C:\WINDOWS\system32\calc.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\CorelDRAW X6.lnk - c:\Windows\Installer\{C5262276-0075-498B-B80F-7D997482E4DB}\NewShortcut1.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Dreamweaver - Atalho.lnk - C:\Program Files (x86)\Adobe\Adobe Dreamweaver CS6\Dreamweaver.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk -

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\filezilla - Atalho.lnk - C:\Program Files (x86)\FileZilla FTP Client\filezilla.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Flash - Atalho.lnk - C:\Program Files (x86)\Adobe\Adobe Flash CS6\Flash.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Gramblr (2).lnk - C:\Gramblr\Gramblr.exe iconPath=@TargetDir/gramblr.ico

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Gramblr.lnk - C:\Gramblr\Gramblr.exe iconPath=@TargetDir/gramblr.ico

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\InDesign - Atalho.lnk - C:\Program Files (x86)\Adobe\Adobe InDesign CS6\InDesign.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files\Internet Explorer\iexplore.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Notepad.lnk - C:\WINDOWS\system32\notepad.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Project1.lnk - C:\Users\magalhaes\Dropbox\Trade\Project1.exe

C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -

C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -

==== shortcuts After Repair ======================

C:\Users\magalhaes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aplicativos do Google Chrome\Any.do.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aplicativos do Google Chrome\Awesome Screenshot App.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Users\magalhaes\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Inicializador de aplicativos do Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully

HKEY_CURRENT_USER\Software\Policies\Google deleted successfully

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds deleted successfully

==== Empty IE Cache ======================

C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\magalhaes\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\Users\magalhaes\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully

C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\Users\magalhaes\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

C:\Users\magalhaes\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully

C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

C:\Users\magalhaes\AppData\Local\Mozilla\Firefox\Profiles\9zlp1fq2.default\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\magalhaes\AppData\Local\Opera Software\Opera Stable\Cache emptied successfully

C:\Users\magalhaes\AppData\Local\Comodo\Dragon\User Data\Default\Cache emptied successfully

C:\Users\magalhaes\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=446 folders=97 23428582 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully

C:\Users\Default User\AppData\Local\Temp emptied successfully

C:\Users\magalhaes\AppData\Local\Temp will be emptied at reboot

C:\Users\USURIO~1\AppData\Local\Temp emptied successfully

C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully

C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully

C:\WINDOWS\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied

C:\Users\MAGALH~1\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\magalhaes\AppData\Roaming\ntsvc" not found

==== EOF on 26/03/2015 at 18:01:10,12 ======================

caedurodrigues · Março 27, 2015

Boa tarde magalhaesrj,

Baixe:<> <(...by Farbar)>

Ou aqui:<Farbar Recovery Scan Tool 64-bits>

Salve-a na Área de trabalho !

Execute a ferramenta ! Clique "Yes" >> "Scan".

Verifique se as caixinhas em "Whitelist" estão assinaladas.

Em "Optional Scan",deixe marcada a checkbox "Addition.txt".

Será gerado o relatório! (FRST.txt)

Ps: Será gerado,também,o relatório "Addition.txt" que estará disponibilizado na 1ª execução da ferramenta.

Acesse: <>

Ou acesse:<>

Um grande abraço. :thumbsup:

magalhaesrj · Março 27, 2015

Segue

http://cjoint.com/?ECBr3aRLTK8

http://cjoint.com/?ECBr3BkDgQR

caedurodrigues · Março 27, 2015

Boa noite magalhaesrj, informe como está o PC.

Copie estas informações que estão em vermelho,para o Bloco de Notas.

Salve-a com o nome fixlist.txt

Salve-a no mesmo local em que se encontra a FRST

start

CloseProcesses:

HKLM-x32\...\Run: [] => [X]

S2 Sed; C:\Users\magalhaes\AppData\Roaming\ntsvc\ntsvc.exe [X]

S3 BdCameraProtect; \??\C:\Program Files (x86)\Baidu-Security-2014-4.4.4.73687\Baidu Antivirus\BdCameraProtect64.sys [X]

2015-03-24 18:14 - 2015-03-24 18:14 - 00000000 ____D () C:\Program Files\Enigma Software Group

2015-03-23 18:31 - 2013-11-28 17:36 - 00000000 ____D () C:\Users\Public\Documents\Baidu Security

Task: {1DF9A996-C7B8-4DD3-BF96-F6440A926C55} - \060184C3-9766-46a0-B258-F4518A0B2633 No Task File <==== ATTENTION

CMD: ipconfig /flushdns

EmptyTemp:

end

Execute FRST/FRST64 >> Clique "Fix". << Aguarde!

Poste o relatório! (Fixlog.txt)

Um grande abraço. :thumbsup:

< Peço aos visitantes que não utilizem este script em outros computadores,sob risco de danos irreparáveis aos mesmos! >

magalhaesrj · Abril 6, 2015

O PC está bem melhor, não vejo mais os problemas anteriores que estavam me perturbando

segue o relatório

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-03-2015

Ran by magalhaes at 2015-04-06 11:00:14 Run:1

Running from C:\Users\magalhaes\Downloads

Loaded Profiles: magalhaes (Available profiles: magalhaes)

Boot Mode: Normal

==============================================

Content of fixlist:

*****************

start

CloseProcesses:

HKLM-x32\...\Run: [] => [X]

S2 Sed; C:\Users\magalhaes\AppData\Roaming\ntsvc\ntsvc.exe [X]

S3 BdCameraProtect; \??\C:\Program Files (x86)\Baidu-Security-2014-4.4.4.73687\Baidu Antivirus\BdCameraProtect64.sys [X]

2015-03-24 18:14 - 2015-03-24 18:14 - 00000000 ____D () C:\Program Files\Enigma Software Group

2015-03-23 18:31 - 2013-11-28 17:36 - 00000000 ____D () C:\Users\Public\Documents\Baidu Security

Task: {1DF9A996-C7B8-4DD3-BF96-F6440A926C55} - \060184C3-9766-46a0-B258-F4518A0B2633 No Task File <==== ATTENTION

CMD: ipconfig /flushdns

EmptyTemp:

end

*****************

Processes closed successfully.

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value deleted successfully.

Sed => Service deleted successfully.

BdCameraProtect => Service deleted successfully.

C:\Program Files\Enigma Software Group => Moved successfully.

C:\Users\Public\Documents\Baidu Security => Moved successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{1DF9A996-C7B8-4DD3-BF96-F6440A926C55}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1DF9A996-C7B8-4DD3-BF96-F6440A926C55}" => Key deleted successfully.

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\060184C3-9766-46a0-B258-F4518A0B2633" => Key deleted successfully.

========= ipconfig /flushdns =========

Configura o de IP do Windows

Libera o do Cache do DNS Resolver bem-sucedida.

========= End of CMD: =========

EmptyTemp: => Removed 1 GB temporary data.

The system needed a reboot.

==== End of Fixlog 11:01:24 ====

caedurodrigues · Abril 14, 2015

Boa noite magalhaesrj, se não houver mais problemas com o PC, podemos dar o caso por resolvido.

Agora vamos remover as ferramentas utilizadas na desinfecção.

Baixe: <

> (...par Xplode)

Salve-a na sua área de trabalho.

Dê dois cliques no delfix.exe para executá-lo.

Usuários do Windows Vista ou Windows 7,clique com o direito do mouse sobre o arquivo delfix.exe,depois clique em:

Marque as caixinhas, de acordo com a imagem.

Clique no botão Executar.

Reinicie o computador!

Tudo OK ?

Um grande abraço.

Arquivado

[Resolvido] Não consigo resolver vários Malwares (atajitos)

Recommended Posts

magalhaesrj 0

Compartilhar este post

Link para o post

Compartilhar em outros sites

caedurodrigues 19

Compartilhar este post

Link para o post

Compartilhar em outros sites

magalhaesrj 0

Compartilhar este post

Link para o post

Compartilhar em outros sites

caedurodrigues 19

Compartilhar este post

Link para o post

Compartilhar em outros sites

magalhaesrj 0

Compartilhar este post

Link para o post

Compartilhar em outros sites

caedurodrigues 19

Compartilhar este post

Link para o post

Compartilhar em outros sites

magalhaesrj 0

Compartilhar este post

Link para o post

Compartilhar em outros sites

caedurodrigues 19

Compartilhar este post

Link para o post

Compartilhar em outros sites

magalhaesrj 0

Compartilhar este post

Link para o post

Compartilhar em outros sites

caedurodrigues 19

Compartilhar este post

Link para o post

Compartilhar em outros sites

magalhaesrj 0

Compartilhar este post

Link para o post

Compartilhar em outros sites

caedurodrigues 19

Compartilhar este post

Link para o post

Compartilhar em outros sites

magalhaesrj 0

Compartilhar este post

Link para o post

Compartilhar em outros sites

caedurodrigues 19

Compartilhar este post

Link para o post

Compartilhar em outros sites

magalhaesrj 0

Compartilhar este post

Link para o post

Compartilhar em outros sites

caedurodrigues 19

Compartilhar este post

Link para o post

Compartilhar em outros sites

magalhaesrj 0

Compartilhar este post

Link para o post

Compartilhar em outros sites

caedurodrigues 19

Compartilhar este post

Link para o post

Compartilhar em outros sites

magalhaesrj 0

Compartilhar este post

Link para o post

Compartilhar em outros sites

caedurodrigues 19