Bom Dia! alvotarget

|- Baixe: < ZHPDiag2.exe > < /applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/NicolasCoolman.jpg&key=31eaca9d787a5cb7b785eaca882cfe95bdd41bfffaf35086b6e7ecf044ef83cf" alt="NicolasCoolman.jpg" /> > ( ... de Nicolas Coolman )
|- Salve-o no disco local! ( C ou D )
|- Execute o ícone do pergaminho. ( ZHPDiag )

/applications/core/interface/imageproxy/imageproxy.php?img=http://t.imgbox.com/abynh7jv.jpg&key=ee7d09348473b69422ef5ab11ff0d2d086965ec987da7749e85df564d187958c" alt="abynh7jv.jpg" />

|- Clique: "CONFIGURE"

/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/ZHPDiag_Options2_zps5a090bf7.jpg&key=269ede7850f894bdb202345a802babedd4bd051961394ac9c4b64b6e0cabe0fb" alt="ZHPDiag_Options2_zps5a090bf7.jpg" />

|- Clique: "Options" >> "All" >> OK

/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/ZHPDiag_FullAnalysis_zps60157826.jpg&key=9a3e7b46c42cf532cd8868e36df357452e71710372d1c3194e82d5d315a29c4e" alt="ZHPDiag_FullAnalysis_zps60157826.jpg" />

|- Clique: "CONFIGURE" >> "Full Analysis"
|- Aguarde a conclusão!
|- Caso ocorra travamentos e não possa obter o log,aborte a verificação completa e faça a customizada.

|- Volte a janela principal da ferramenta.

/applications/core/interface/imageproxy/imageproxy.php?img=http://t.imgbox.com/adcYraWj.jpg&key=b2552a4f5897e0c5956bacf7e42705af1284fe6525a19929f57781f15169a5f3" alt="adcYraWj.jpg" />

|- Clique "SEARCH e aguarde a conclusão!
|- Ou clique "Options" >> "None".

/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/ZHPDiag_AdditionalScan_zps21f11520.jpg&key=bcab741827ec6a811f27dcac4f05e08cbb599ed6a4dae592add724dd43cc9ca5" alt="ZHPDiag_AdditionalScan_zps21f11520.jpg" />

|- Marque,apenas,a opção "Additional Scan (O88)".

~ Unselected Option:

O1,039,O40,O41,O42,O43,O44,O45,O46,O47,
O48,O49,O50,O51,O52,O53,O54,O55,O56,O57,
O58,O59,O60,O61,O62,O63,O64,O65,O66,O67,
O68,O69,O80,O81,O82,O83,O84,O85,O86,O87,
O89,O90,O91,O92
####

|- Ps: Desta forma,estas opções serão desabilitadas!
|- Clique OK e,ao concluir,poste o relatório! ( ZHPDiag.txt )

A+

Olá! Boa tarde.

Aqui vai o relatório!

~ Relatório do ZHPDiag v2013.8.17.25 - Nicolas Coolman (17/08/2013)
~ Iniciado por User (17/08/2013 16:29:12)
~ Endereço do Website : http://nicolascoolman.webs.com
~ Tradução pelo utilizador
~ Estatuto da versão : Versão atualizada.
~ Lista Branca : Ativado pelo programa
~ Elevação dos Privilégios : OK
~ Controle de Conta de Utilizador : Deactivate by user

---\\ Navegadores Internet
MSIE: Internet Explorer v9.0.8112.16421
MFIE: Mozilla Firefox 20.0.1 (Defaut)
MFIE: Mozilla Firefox 4.0.1 (Defaut)
GCIE: Google Chrome v28.0.1500.95
OPIE: Opera v11.52

---\\ Informações sobre os produtos Windows
~ Langage: Portugais
Windows 7 Ultimate Edition, 32-bit (Build 7600)
Windows Server License Manager Script : OK
Software Protection Service (Protection logicielle) : KO
Windows Automatic Updates : OK
Windows Activation Technologies : OK

---\\ Softwares de proteçao do sistema
COMODO Internet Security v6.0.2566.2708
Malwarebytes Anti-Malware versão 1.70.0.1100
ESET Online Scanner v3
Windows Defender W7

---\\ Softwares d'optimização do sistema

---\\ Softwares de compartilha do PeerToPeer (P2P)
Pando Media Booster v2.6.0.8
µTorrent v3.1.0 =>P2P.µTorrent

---\\ Monitoramento dos softwares
Adobe Flash Player 11 Plugin
Adobe Reader XI
Java 7 Update 17

---\\ Informações sobre o sistema
~ Processor: x86 Family 6 Model 37 Stepping 5, GenuineIntel
~ Operating System: 32 Bits
Boot mode: Normal (Normal boot)
Total RAM: 3575 MB (58% free)
System Restore: Activé (Enable)
System drive C: has 20 GB (28%) free of 68 GB

---\\ Modo de conexão ao sistema
~ Computer Name: USER-PC
~ User Name: User
~ All Users Names: User, UpdatusUser, Convidado, Administrador,
~ Unselected Option: 01,039,040,041,042, O43,044,045,046,047,048, 49,O50,O51,ivers,O53,O54,O55,O56,057,O58,O59, 60,061,O62,063,064,065,066,O67,068,069,080,O81,O82,O83,ados,O84,O85,O86,O87,089, O2,090,091,O92,O93
Logged in as Administrator

---\\ As variáveis de ambiente
~ System Unit : C:\
~ %AppData% : C:\Users\User\AppData\Roaming\
~ %Desktop% : C:\Users\User\Desktop\
~ %Favorites% : C:\Users\User\Favorites\
~ %LocalAppData% : C:\Users\User\AppData\Local\
~ %StartMenu% : C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\
~ %Windir% : C:\Windows\
~ %System% : C:\Windows\System32\

---\\ Enumeração das unidades dos discos
A:\ Floppy drive, Flash card reader, USB Key (Not Inserted)
C:\ Hard drive, Flash drive, Thumb drive (Free 20 Go of 68 Go)
D:\ Hard drive, Flash drive, Thumb drive (Free 319 Go of 863 Go)
E:\ CD-ROM drive (Not Inserted)

---\\ Estado do Centro de Segurança do Windows
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime : Out Of Date
~ Security Center: 38 Legitimates Filtered in 00mn 00s

---\\ Pesquisa particular de ficheiros genéricos
[MD5.2626FC9755BE22F805D3CFA0CE3EE727] - (.Microsoft Corporation - Windows Explorer.) (.12/03/2012 - 14:32:31.) -- C:\Windows\Explorer.exe [2614272]
[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Aplicativo de Inicialização do Windows.) (.13/07/2009 - 22:14:45.) -- C:\Windows\System32\Wininit.exe [96256]
[MD5.03728C624D05C2F157BBD46F6B7F6EA0] - (.Microsoft Corporation - Internet Extensions para Win32.) (.19/03/2013 - 18:54:35.) -- C:\Windows\System32\wininet.dll [1129472]
[MD5.37CDB7E72EB66BA85A87CBE37E7F03FD] - (.Microsoft Corporation - Aplicativo de Logon do Windows.) (.12/03/2012 - 14:32:31.) -- C:\Windows\System32\Winlogon.exe [285696]
[MD5.58C94EAE54BF0C5E2B80B2E5E7744D4C] - (.Microsoft Corporation - Biblioteca de Licenciamento de Software.) (.13/07/2009 - 22:16:15.) -- C:\Windows\System32\sppcomapi.dll [193024]
[MD5.0DB7A48388D54D154EBEC120461A0FCD] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.12/03/2012 - 14:43:31.) -- C:\Windows\system32\Drivers\AFD.sys [338944]
[MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.13/07/2009 - 22:26:15.) -- C:\Windows\system32\Drivers\atapi.sys [21584]
[MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 20:11:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656]
[MD5.BA6E70AA0E6091BC39DE29477D866A77] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.13/07/2009 - 20:11:26.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544]
[MD5.83D1ECEA8FAAE75604C0FA49AC7AD996] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.12/03/2012 - 14:43:50.) -- C:\Windows\system32\Drivers\DfsC.sys [78336]
[MD5.717A2207FD6F13AD3E664C7D5A43C7BF] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.13/07/2009 - 20:50:56.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544]
[MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - Driver de porta i8042.) (.13/07/2009 - 20:11:24.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896]
[MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.13/07/2009 - 20:54:29.) -- C:\Windows\system32\Drivers\IpNat.sys [101888]
[MD5.CA7570E42522E24324A12161DB14EC02] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.12/03/2012 - 14:46:13.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123392]
[MD5.DD52A733BF4CA5AF84562A5E2F963B91] - (.Microsoft Corporation - MBT Transport driver.) (.13/07/2009 - 20:12:21.) -- C:\Windows\system32\Drivers\netBT.sys [187904]
[MD5.3795DCD21F740EE799FB7223234215AF] - (.Microsoft Corporation - Driver do Sistema de Arquivos NT.) (.13/07/2009 - 22:20:44.) -- C:\Windows\system32\Drivers\ntfs.sys [1210432]
[MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - Driver de porta paralela.) (.13/07/2009 - 20:45:35.) -- C:\Windows\system32\Drivers\Parport.sys [79360]
[MD5.D9F91EAFEC2815365CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13/07/2009 - 20:54:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848]
[MD5.C5FF95883FFEF704D50C40D21CFB3AB5] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.13/07/2009 - 21:02:58.) -- C:\Windows\system32\Drivers\rdpdr.sys [133120]
[MD5.3E21C083B8A01CB70BA1F09303010FCE] - (.Microsoft Corporation - SMB Transport driver.) (.13/07/2009 - 20:53:41.) -- C:\Windows\system32\Drivers\smb.sys [71168]
[MD5.CB39E896A2A83702D1737BFD402B3542] - (.Microsoft Corporation - TDI Translation Driver.) (.13/07/2009 - 20:12:11.) -- C:\Windows\system32\Drivers\tdx.sys [74240]
[MD5.59F06B4968E58BC83DFC56CA4517960E] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.06/09/2012 - 13:48:29.) -- C:\Windows\system32\Drivers\volsnap.sys [245616]
~ Generic Processes: Scanned in 00mn 00s

---\\ Estatuto dos ficheiros ocultos (Oculto/Total)
~ Mes images (My Pictures) : 2/480
~ Mes musiques (My Musics) : 1/8
~ Mes Videos (My Videos) : 1/8
~ Mes Favoris (My Favorites) : 1/7
~ Mes Documents (My Documents) : 3/2002
~ Mon Bureau (My Desktop) : 2/266
~ Menu demarrer (Programs) : 1/49
~ Hidden Files: Scanned in 00mn 00s

---\\ Processos lançados au arranque du sistema
[MD5.702FDEA429C9418E82DA17176D71A257] - (.Comodo Security Solutions Inc. - livePCsupport launcher system service.) -- C:\Program Files\Common Files\COMODO\launcher_service.exe [70352] [PID.800]
[MD5.2784C071EC57DCDBA6D4A2A017F56CD4] - (.NVIDIA Corporation - NVIDIA Driver Helper Service, Version 320.4.) -- C:\Windows\system32\nvvsvc.exe [640288] [PID.820]
[MD5.2222073BE0232E70A397B8302293AA9D] - (.NVIDIA Corporation - Stereo Vision Control Panel API Server.) -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [413472] [PID.844]
[MD5.40AF6E444E938BF485B97D97E462AA33] - (.GAS Tecnologia - G-Buster Browser Defense - Service.) -- C:\Program Files\GbPlugin\gbpsv.exe [409640] [PID.872]
[MD5.3B854A0EEAFBFDF2C6430A43C360B91E] - (.COMODO - COMODO Internet Security.) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [4801304] [PID.1068]
[MD5.FC3644BBF2AB02A9B5EE910DBFF096B3] - (.AMD - AMD External Events Service Module.) -- C:\Windows\system32\atiesrxx.exe [176128] [PID.1168]
[MD5.892C3473096A9979C1BAE8518E7E1ED2] - (.AMD - AMD External Events Client Module.) -- C:\Windows\system32\atieclxx.exe [380928] [PID.1440]
[MD5.C5FE9DDA1A982FC3CBA26BB80EDDAE8A] - (.NVIDIA Corporation - NVIDIA User Experience Driver Component.) -- C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe [875296] [PID.1484]
[MD5.B33CF4DE909A5B30F526D82053A63C8E] - (.ABBYY - ABBYY network license server.) -- C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048] [PID.1864]
[MD5.ADDA5E1951B90D3D23C56D3CF0622ADC] - (.Adobe Systems Incorporated - Adobe Acrobat Update Service.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [65640] [PID.1960]
[MD5.A5299D04ED225D64CF07A568A3E1BF8C] - (.Apple Inc. - MobileDeviceService.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [55184] [PID.116]
[MD5.DB5BEA73EDAF19AC68B2C0FAD0F92B1A] - (.Apple Inc. - Bonjour Service.) -- C:\Program Files\Bonjour\mDNSResponder.exe [390504] [PID.976]
[MD5.308195495181C8F3D51E6ED5B58D54AC] - (...) -- C:\Program Files\Comodo\Dragon\dragon_updater.exe [2095808] [PID.1328]
[MD5.AE63D0DB96C07CAE5DC4CDB2B2A719A0] - (.Comodo Security Solutions, Inc. - GeekBuddy Remote Screen Protocol Server.) -- C:\Program Files\Common Files\COMODO\GeekBuddyRSP.exe [1851088] [PID.1508]
[MD5.77BA4CFC0B2BFF6606567B3148EE42CA] - (...) -- C:\Program Files\Comodo\IceDragon\icedragon_updater.exe [1821384] [PID.2068]
[MD5.A1C148801B4AF64847AEB9F3AD9594EF] - (.Intel Corporation - Local Manageability Service.) -- C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe [262144] [PID.2112]
[MD5.7CF1B716372B89568AE4C0FE769F5869] - (.Microsoft Corporation - Machine Debug Manager.) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872] [PID.2176]
[MD5.C5052FB77AA42ED440F9F6B4E37145A9] - (.Nero AG - Nero BackItUp.) -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [869672] [PID.2208]
[MD5.AE76AFFD55B0CD252D0885882346417D] - (.NVIDIA Corporation - NVIDIA Streamer Service.) -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14592288] [PID.2288]
[MD5.056EF5C4AF4BD002AEAE417412C8EB71] - (.NVIDIA Corporation - NVIDIA Settings Update Manager.) -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [1889568] [PID.2380]
[MD5.63694C307273062A2167AE4CE80730EF] - (.Sony Corporation - Device Information Provider.) -- D:\Sony\PMB\PMBDeviceInfoProvider.exe [398176] [PID.2656]
[MD5.3BEDEB993D284CFC0747796347614DDA] - (.ASUSTeK Computer Inc. - No Comment.) -- C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe [5756544] [PID.2748]
[MD5.51138BEEA3E2C21EC44D0932C71762A8] - (...) -- ystem32\rundll32.exe [0] [PID.2760]
[MD5.3A2E85F7D90D15460C337CE80C2E3B29] - (...) -- C:\Windows\system32\PnkBstrA.exe [76888] [PID.2868]
[MD5.A0FF419B61AE47E26ADF3BB15DB4F2FE] - (...) -- C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [38608] [PID.2920]
[MD5.8726802EA4FBFFA3FD54FD2449BF51D4] - (.Google Inc. - Google Crash Handler.) -- C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe [217992] [PID.2928]
[MD5.388AE59FE75F1B959DFA0900923C61BB] - (.Skype Technologies S.A. - Skype C2C Service.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000] [PID.3120]
[MD5.6B412FCE75E2B1462C71D17B6E5C1484] - (.NVIDIA Corporation - NVIDIA Update COM object.) -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\ComUpdatus.exe [1209120] [PID.3456]
[MD5.B359E8976725CC3F045984851EB90284] - (.NVIDIA Corporation - NVIDIA Settings.) -- C:\Program Files\NVIDIA Corporation\Display\nvtray.exe [1821984] [PID.2132]
[MD5.0A80BED61A1729DAB9499BC5A9B515A9] - (.Cyberlink Corp. - PowerDVD RC Service.) -- C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe [83240] [PID.1936]
[MD5.FD0041A41E4D484BCDA512FF563253B1] - (.Saitek - Saitek MFD File System Driver.) -- C:\Program Files\Saitek\SD6\Software\SaiMfd.exe [123392] [PID.2780]
[MD5.BF0EE37A14144C88A9F6FDA7B44981BB] - (.SEIKO EPSON CORPORATION - EEventManager Application.) -- C:\Program Files\Epson Software\Event Manager\EEventManager.exe [979328] [PID.828]
[MD5.48E6868781B4E8BF4B77DBEC7694BCE8] - (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe [295072] [PID.4196]
[MD5.DF15765A1421FE1E91E2823A690C2E55] - (.COMODO - COMODO Internet Security.) -- C:\Program Files\Comodo\COMODO Internet Security\cistray.exe [1464536] [PID.4260]
[MD5.04C40F2EFB9F333E16CE33A2D283829F] - (.cyberlink - brs.) -- C:\Program Files\CyberLink\Shared Files\brs.exe [91432] [PID.4292]
[MD5.15378E660B6ECFE704074748E050B056] - (.NVIDIA Corporation - NVIDIA NvTmru Application.) -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe [1028896] [PID.4428]
[MD5.0CE5B7372D0947889CB2FD394D869011] - (.Nero AG - Nero Home.) -- C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1688872] [PID.4448]
[MD5.F09FB6E14AEF64CD8FEBC0C2F723EDB2] - (.Comodo Security Solutions, Inc. - livePCsupport Component.) -- C:\Program Files\Comodo\GeekBuddy\unit_manager.exe [224464] [PID.4572]
[MD5.74149BCF0307BB76D68C0F8912DF731C] - (.Nero AG - Nero Home.) -- C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [447784] [PID.4584]
[MD5.239841ABB778F4D908B07A40A9E3A87C] - (.Comodo Security Solutions, Inc. - livePCsupport Component.) -- C:\Program Files\Comodo\GeekBuddy\unit.exe [213712] [PID.4788]
[MD5.C675BFC4516BD1BB90CD9B07D6096DA5] - (.COMODO - COMODO Internet Security.) -- C:\Program Files\Comodo\COMODO Internet Security\cis.exe [9044696] [PID.4864]
[MD5.7E10A72489716647C0B5ABE186AA746D] - (.COMODO Security Solutions - IceDragon.) -- C:\Program Files\Comodo\IceDragon\icedragon.exe [438984] [PID.5548]
[MD5.41118D920B2B268C0ADC36421248CDCF] - (.Intel Corporation - User Notification Service.) -- C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe [2314240] [PID.5124]
[MD5.E5B9A7A4AFFE085B2C559BB7BF90C976] - (.COMODO - COMODO Internet Security.) -- C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe [1839832] [PID.5860]
[MD5.31EC2C367F440422C93FBF31B7D1314F] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe [7824896] [PID.5448]
~ Processes Running: Scanned in 00mn 04s

---\\ Opera, Plugins,Arranque,Pesquisa (P1,B0,B1)
B0 - SPO: operaprefs.ini [user] Home URL=http://redir.opera.com/portal/home/
P1 - OPN:Opera Plugin Navigator . (.No owner - NPOrbit.) -- C:\Program Files\Opera\Program\Plugins\nporbit.dll
P1 - OPN:Opera Plugin Navigator . (.RealPlayer - RealPlayer Download Plugin.) -- C:\Program Files\Opera\Program\Plugins\nprpplugin.dll
P1 - OPN:Opera Plugin Navigator . (.No owner - NPOrbit.) -- C:\Program Files\Opera\Program\Plugins\nporbit.dll
P1 - OPN:Opera Plugin Navigator . (.RealPlayer - RealPlayer Download Plugin.) -- C:\Program Files\Opera\Program\Plugins\nprpplugin.dll
~ Opera Browser: 21 Legitimates Filtered in 00mn 00s

---\\ Google Chrome, Arranque,Pesquisa,Extensões (G0,G1,G2)
C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Preferences
~ Google Browser: 8 Legitimates Filtered in 00mn 06s

---\\ Mozilla Firefox, Plugins,Arranque,Pesquisa,Extensões (P2,M0,M1,M2,M3)
C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\c4817zyf.default\prefs.js
C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\c4817zyf.default\user.js
M3 - MFPP: Plugins - [user] -- C:\Program Files\Mozilla FireFox\searchplugins\buscape.xml
M3 - MFPP: Plugins - [user] -- C:\Program Files\Mozilla FireFox\searchplugins\mercadolivre.xml
M3 - MFPP: Plugins - [user] -- C:\Program Files\Mozilla FireFox\searchplugins\wikipedia-br.xml
M3 - MFPP: Plugins - [user] -- C:\Program Files\Mozilla FireFox\searchplugins\yahoo-br.xml =>Toolbar.Yahoo
M2 - MFEP: prefs.js [user - c4817zyf.default\{87F8774F-B485-47E2-A755-A40A8A5E886D}] [] Modulo Adicional de Seguranca CAIXA v2.12.0.15.40 (..)
P2 - FPN: [HKLM] [@nokia.com/EnablerPlugin] - (.No owner - Nokia Suite Enabler Plugin.) -- C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll
P2 - FPN: [HKLM] [@soe.sony.com/installer,version=1.0.3] - (...) -- C:\Users\User\AppData\LocalLow\Sony Online Entertainment\npsoe.dll
~ Firefox Browser: 44 Legitimates Filtered in 00mn 02s

---\\ Internet Explorer, Arranque, Pesquisa, URLSearchHook( gancho de URL), Phishing (R0,R1,R3,R4)
R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Pando Networks - Pando Web Plugin.) (No version) -- (.not file.)
~ IE Browser: 10 Legitimates Filtered in 00mn 00s

---\\ Internet Explorer, Gestão do Proxy (R5)
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll
~ Proxy management: Scanned in 00mn 00s

---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas
F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,
F2 - REG:system.ini: Shell=C:\Windows\explorer.exe
F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe
~ Keys: Scanned in 00mn 00s

---\\ Barras do Internet Explorer (03))
O3 - Toolbar: Grab Pro - [HKLM]{C55BBCD6-41AD-48AD-9953-3609C48EACC7} . (.No owner - Grab Pro.) -- D:\Orbitdownloader\GrabPro.dll
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{C55BBCD6-41AD-48AD-9953-3609C48EACC7} Chave orfã
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{E0301295-AB3E-4AF3-979F-3D453C5F9F48} Chave orfã
O3 - Toolbar\WebBrowser: (no name) - [HKCU]{00000000-0000-0000-0000-000000000000} Chave orfã
~ Toolbar: Scanned in 00mn 00s

---\\ Aplicações iniciadas por registo & pastas (04)
O4 - HKLM\..\Run: [RtHDVCpl] . (.Realtek Semiconductor - Gerenciador de áudio HD Realtek.) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] . (.Nero AG - NeroCheck.) -- C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] . (.Nero AG - Nero BackItUp.) -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
O4 - HKLM\..\Run: [RemoteControl8] . (.Cyberlink Corp. - PowerDVD RC Service.) -- C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] . (.No owner - Language Application.) -- C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe
O4 - HKLM\..\Run: [QuickTime Task] . (.Apple Inc. - QuickTime Task.) -- D:\QuickTime\QTTask.exe
O4 - HKLM\..\Run: [APSDaemon] . (.Apple Inc. - Apple Push.) -- C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe
O4 - HKLM\..\Run: [saiMfd] . (.Saitek - Saitek MFD File System Driver.) -- C:\Program Files\Saitek\SD6\Software\SaiMfd.exe
O4 - HKLM\..\Run: [EEventManager] . (.SEIKO EPSON CORPORATION - EEventManager Application.) -- C:\Program Files\Epson Software\Event Manager\EEventManager.exe
O4 - HKLM\..\Run: [Adobe ARM] . (.Adobe Systems Incorporated - Adobe Reader and Acrobat Manager.) -- C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
O4 - HKLM\..\Run: [TkBellExe] . (.RealNetworks, Inc. - RealNetworks Scheduler.) -- C:\Program Files\Real\RealPlayer\update\realsched.exe
O4 - HKLM\..\Run: [COMODO Internet Security] . (.COMODO - COMODO Internet Security.) -- C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
O4 - HKLM\..\Run: [bDRegion] . (.cyberlink - brs.) -- c:\program files\cyberlink\shared files\brs.exe
O4 - HKLM\..\Run: [gbrspcontrol] . (.Comodo Security Solutions, Inc. - GeekBuddy Remote Screen Protocol Server.) -- C:\Program Files\Common Files\COMODO\GeekBuddyRSP.exe
O4 - HKLM\..\Run: [Nvtmru] . (.NVIDIA Corporation - NVIDIA NvTmru Application.) -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe
O4 - HKCU\..\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] . (.Nero AG - Nero Home.) -- C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
O4 - HKCU\..\Run: [EPSON L200 Series] . (.SEIKO EPSON CORPORATION - EPSON Status Monitor 3.) -- C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIGUL.exe
O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Google Installer.) -- C:\Users\User\AppData\Local\Google\Update\GoogleUpdate.exe
O4 - HKUS\S-1-5-18\..\Run: [Advanced SystemCare 5] D:\Advanced SystemCare 5\ASCTray.exe (.not file.)
O4 - HKUS\S-1-5-19\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-20\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
O4 - HKUS\S-1-5-21-3525276882-2603632860-661933976-1004\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files\Windows Sidebar\Sidebar.exe
O4 - HKUS\S-1-5-21-3525276882-2603632860-661933976-1004\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe
~ Application: Scanned in 00mn 00s

---\\ Outras conexões do utilizador (04)
O4 - GS\TaskBar: Comodo IceDragon.lnk . (.COMODO Security Solutions - IceDragon.) -- C:\Program Files\Comodo\IceDragon\icedragon.exe
O4 - GS\TaskBar: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O4 - GS\Programs: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\QuickLaunch: Google Chrome.lnk . (.Google Inc. - Google Chrome.) -- C:\Program Files\Google\Chrome\Application\chrome.exe
O4 - GS\Accessories: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\Accessories: Private Character Editor.lnk . (.Microsoft Corporation - Editor de caracteres particulares.) -- C:\Windows\system32\eudcedit.exe
O4 - GS\SendTo: Fax Recipient.lnk . (.Microsoft Corporation - Microsoft Windows Fax and Scan.) -- C:\Windows\system32\WFS.exe
O4 - GS\SendTo: MediaInfo.lnk . (...) -- C:\Program Files\K-Lite Codec Pack\Tools\mediainfo.exe
O4 - GS\SendTo: Skype.lnk . (.Skype Technologies S.A. - Skype.) -- C:\Program Files\Skype\Phone\Skype.exe
O4 - GS\Desktop: DVD Shrink 3.2.lnk . (.DVD Shrink - DVD Shrink 3.2.) -- C:\Program Files\DVD Shrink\DVD Shrink 3.2.exe
O4 - GS\Desktop: Fraps.lnk . (.Beepa P/L - Fraps.) -- D:\Fraps\fraps.exe
O4 - GS\Desktop: Microsoft Office Excel 2007.lnk . (...) -- C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
O4 - GS\Desktop: Microsoft Office Word 2007.lnk . (...) -- C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
O4 - GS\Desktop: NDS_TRT_SP - Atalho.lnk . (...) -- C:\Users\User\Downloads\NDS_TRT_SP.pdf
O4 - GS\Desktop: PhotoScape.lnk . (...) -- C:\Program Files\PhotoScape\PhotoScape.exe
O4 - GS\Desktop: Revo Uninstaller.lnk . (.VS Revo Group - Revo Uninstaller.) -- C:\Program Files\VS Revo Group\Revo Uninstaller\Revouninstaller.exe
O4 - GS\Desktop: UnderCoverXP.lnk . (.Wicked & Wild Inc. - What Covers Do Ya Wanna Print Today?.) -- C:\Program Files\UnderCoverXP\UnderCoverXP.exe
O4 - GS\TaskBar: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe
O4 - GS\TaskBar: Windows Explorer.lnk . (.Microsoft Corporation - Windows Explorer.) -- C:\Windows\explorer.exe
O4 - GS\TaskBar: Windows Media Player.lnk . (.Microsoft Corporation - Windows Media Player.) -- C:\Program Files\Windows Media Player\wmplayer.exe
O4 - GS\QuickLaunch: PhotoScape.lnk . (...) -- C:\Program Files\PhotoScape\PhotoScape.exe
~ Global Startup: Scanned in 00mn 01s

---\\ Boutões da barra de ferramentas principal do Internet Explorer (09)
O9 - Extra button: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft Office OneNote Internet Explorer Add-in.) -- C:\Program Files\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} . (.Microsoft Corporation - Sincronização de Favoritos do ActiveSync.) -- C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} -- Chave orfã
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- C:\Program Files\Skype\Toolbars\Internet Explorer\icon.ico
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO
~ IE Extra Buttons: Scanned in 00mn 00s

---\\ Winsock hijacker (Layered Service Provider) (O10)
O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - Provedor de serviços do Microsoft Windows Sockets 2.0.) -- C:\Windows\system32\mswsock.dll
O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - Provedor de Correção de Nomeação de Emails.) -- C:\Windows\system32\napinsp.dll
~ Winsock: 9 Legitimates Filtered in 00mn 00s

---\\ Site na zona confiavél do Internet Explorer (05)
O15 - Trusted Zone: [HKCU\...\Domains\www] *.bancobrasil.com.br
O15 - Trusted Zone: [HKCU\...\Domains\www] *.bb.com.br
O15 - Trusted Zone: [HKCU\...\Domains] *.clonewarsadventures.com
O15 - Trusted Zone: [HKCU\...\Domains] *.freerealms.com
O15 - Trusted Zone: [HKCU\...\Domains] *.soe.com
O15 - Trusted Zone: [HKCU\...\Domains] *.sony.com
~ IE Zone Confiance: Scanned in 00mn 01s

---\\ Objets ActiveX (Downloaded Program Files)(O16)
O16 - DPF: Microsoft XML Parser for Java - (Microsoft XML Parser for Java) - (.not file.) - C:\Windows\Java\classes\xmldso.cab
~ Objets ActiveX: Scanned in 00mn 00s

---\\ Alteração Dominio/Clientes DNS (017)
O17 - HKLM\System\CCS\Services\Tcpip\..\{253164D3-63BB-4E54-8E81-1C52A13DB230}: NameServer = 156.154.70.22,156.154.71.22
O17 - HKLM\System\CCS\Services\Tcpip\..\{253164D3-63BB-4E54-8E81-1C52A13DB230}: DhcpNameServer = 201.6.2.82 201.6.2.172 201.6.4.116
O17 - HKLM\System\CCS\Services\Tcpip\..\{98CED40B-A2D0-47BE-86AD-BC1FE65C0AA8}: DhcpNameServer = 192.168.254.90
O17 - HKLM\System\CCS\Services\Tcpip\..\{98CED40B-A2D0-47BE-86AD-BC1FE65C0AA8}: DhcpDomain = computertec
O17 - HKLM\System\CS1\Services\Tcpip\..\{253164D3-63BB-4E54-8E81-1C52A13DB230}: DhcpNameServer = 201.6.2.172 201.6.2.82
O17 - HKLM\System\CS1\Services\Tcpip\..\{98CED40B-A2D0-47BE-86AD-BC1FE65C0AA8}: DhcpNameServer = 192.168.254.90
O17 - HKLM\System\CS1\Services\Tcpip\..\{253164D3-63BB-4E54-8E81-1C52A13DB230}: DhcpDomain = spo.virtua.com.br
O17 - HKLM\System\CS1\Services\Tcpip\..\{98CED40B-A2D0-47BE-86AD-BC1FE65C0AA8}: DhcpDomain = computertec
O17 - HKLM\System\CS2\Services\Tcpip\..\{253164D3-63BB-4E54-8E81-1C52A13DB230}: NameServer = 156.154.70.22,156.154.71.22
O17 - HKLM\System\CS2\Services\Tcpip\..\{253164D3-63BB-4E54-8E81-1C52A13DB230}: DhcpNameServer = 201.6.2.82 201.6.2.172 201.6.4.116
O17 - HKLM\System\CS2\Services\Tcpip\..\{98CED40B-A2D0-47BE-86AD-BC1FE65C0AA8}: DhcpNameServer = 192.168.254.90
O17 - HKLM\System\CS2\Services\Tcpip\..\{98CED40B-A2D0-47BE-86AD-BC1FE65C0AA8}: DhcpDomain = computertec
O17 - HKLM\System\CS3\Services\Tcpip\..\{253164D3-63BB-4E54-8E81-1C52A13DB230}: NameServer = 156.154.70.22,156.154.71.22
O17 - HKLM\System\CS3\Services\Tcpip\..\{253164D3-63BB-4E54-8E81-1C52A13DB230}: DhcpNameServer = 201.6.2.82 201.6.2.172 201.6.4.116
O17 - HKLM\System\CS3\Services\Tcpip\..\{98CED40B-A2D0-47BE-86AD-BC1FE65C0AA8}: DhcpNameServer = 192.168.254.90
O17 - HKLM\System\CS3\Services\Tcpip\..\{98CED40B-A2D0-47BE-86AD-BC1FE65C0AA8}: DhcpDomain = computertec
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 201.6.2.82 201.6.2.172 201.6.4.116
~ Domain: Scanned in 00mn 00s

---\\ Protocolo adicional (018)
O18 - Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (.Microsoft Corporation - Windows Live Album Download Protocol Handle.) -- C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.dll
~ Protocole Additionnel: Scanned in 00mn 00s

---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)
O20 - Winlogon Notify: GbPluginBb . (.Banco do Brasil - Gbieh Module.) -- C:\Program Files\GbPlugin\gbieh.dll
O20 - Winlogon Notify: GbPluginCef . (.Caixa Economica Federal - Gbieh Module.) -- C:\Program Files\GbPlugin\gbiehCef.dll
~ Winlogon: Scanned in 00mn 00s

---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)
O20 - AppInit_DLLs: . (.NVIDIA Corporation - NVIDIA Rxinput.) - C:\Program Files\NVIDIA Corporation\NvStreamSrv\rxinput.dll
~ AppInit DLL: Scanned in 00mn 00s

---\\ Lista dos serviços NT não Microsoft e não desativados (023)
O23 - Service: Gbp Service (GbpSv) . (.GAS Tecnologia - G-Buster Browser Defense - Service.) - C:\Program Files\GbPlugin\gbpsv.exe
O23 - Service: {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054} ({FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}) . (.Cyberlink Corp. - FCL Driver.) - C:\Program Files\CyberLink\PowerDVD8\000.fcl
~ Services: 25 Legitimates Filtered in 00mn 07s

---\\ Scâner Aditional (088)
Database Version : v2.12859 - (17/08/2013)
Clés trouvées (Keys found) : 13
Valeurs trouvées (Values found) : 0
Dossiers trouvés (Folders found) : 2
Fichiers trouvés (Files found) : 1

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype
[HKLM\Software\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype
[HKLM\Software\Microsoft\Internet Explorer\extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKLM\Software\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{c95a4e8e-816d-4655-8c79-d736da1adb6d}] =>Toolbar.Conduit
[HKCU\Software\SteamPopCap] =>Adware.PopCap
[HKLM\Software\Classes\Installer\Features\9EC6D81181F59F2459A84176A626F9ED] =>Adware.IMBooster
[HKLM\Software\Classes\Installer\Products\9EC6D81181F59F2459A84176A626F9ED] =>Adware.IMBooster
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9EC6D81181F59F2459A84176A626F9ED] =>Adware.IMBooster
[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F1057DD419AED0B468AD8888429E139A] =>Adware.IMBooster
C:\ProgramData\hssff =>Toolbar.Conduit
C:\Users\User\AppData\Local\eSupport.com =>Rogue.RegistryWizard
C:\Program Files\Mozilla FireFox\searchplugins\yahoo-br.xml =>Toolbar.Yahoo^

---\\ Sumário de detecções encontradas na sua estação

~ [http://nicolascoolman.webs.com/apps/blog/show/30268689-toolbar-yahoo](http://nicolascoolman.webs.com/apps/blog/show/30268689-toolbar-yahoo%C2%A0%C2%A0) =>Toolbar.Yahoo
~ [http://nicolascoolman.webs.com/apps/blog/show/30898245-toolbar-skype](http://nicolascoolman.webs.com/apps/blog/show/30898245-toolbar-skype%C2%A0%C2%A0) =>Toolbar.Skype
~ [http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit](http://nicolascoolman.webs.com/apps/blog/show/29507721-toolbar-conduit%C2%A0%C2%A0) =>Toolbar.Conduit
~ [http://nicolascoolman.webs.com/apps/blog/show/26666257-adware-popcap](http://nicolascoolman.webs.com/apps/blog/show/26666257-adware-popcap%C2%A0%C2%A0) =>Adware.PopCap
~ [http://nicolascoolman.webs.com/apps/blog/show/26684723-adware-imbooster](http://nicolascoolman.webs.com/apps/blog/show/26684723-adware-imbooster%C2%A0) =>Adware.IMBooster

~ 154 Legitimates filtered by white list
End of the scan (412 lines in 00mn 52s)(0)

Boa Noite! alvotarget

|- Baixe: < /applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/AdwCleaner_Logo2_zps580bcd78.jpg&key=71530441ef1621c6398a69f0f5fae6f7f5c87897579baf8487ec306c4e109626" alt="AdwCleaner_Logo2_zps580bcd78.jpg" /> > ( ... par Xplode )

|- Ao acessar,clique na imagem: < /applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/AdwCleaner_Tlcharger.jpg&key=2319bbcd35144166c25768473f26c7f193a7ab5036b9479bd1465d8257d6f6b2" alt="AdwCleaner_Tlcharger.jpg" /> >

|- Ps: Se utilizar o navegador IE9,desabilite o filtro "SmartScreen".

|- Salve-o no desktop!

|- Clique direito em adwcleaner.exe,e escolha sua execução como /applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/Executar_Administrador.jpg&key=29bbf2d3836c6859afe3923102565f782321b5a7a2787d5bb24cc9918d13e9bd" alt="Executar_Administrador.jpg" />

/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/AdwCleaner_Clean_zps70ed4f45.jpg&key=e76f6d356c2612d3ad27a7cf45f1fa72c57ce880b14feb05d18348a9e2043fe7" alt="AdwCleaner_Clean_zps70ed4f45.jpg" />

|- Ps: Dê início ao scan,clicando em "Clean".

|- Ao concluir,poste o relatório: C:\AdwCleaner[S1].txt

-/-

|- Feche programas/pastas que estejam abertas.

|- Feche,também,o navegador!

|- Para Windows Vista,desabilite a UAC.

/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/My%2520Tools%25203/My%2520Tools%25204/ZHPFix_silent_zps532d2db6.jpg&key=e3bca71d24a0067fad1910903f2d756650c2d526a3a3b4495f41f8a5e073328a" alt="ZHPFix_silent_zps532d2db6.jpg" />

|- Para Windows Vista ou 7,clique direito em ZHPFix.exe e execute-o como administrador.

|- Selecione e copie estas informações,que estão em vermelho,para o "Bloco de Notas".

R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Pando Networks - Pando Web Plugin.) (No version) -- (.not file.)

O3 - Toolbar\WebBrowser: (no name) - [HKCU]{C55BBCD6-41AD-48AD-9953-3609C48EACC7} Chave orfã

O3 - Toolbar\WebBrowser: (no name) - [HKCU]{E0301295-AB3E-4AF3-979F-3D453C5F9F48} Chave orfã

O3 - Toolbar\WebBrowser: (no name) - [HKCU]{00000000-0000-0000-0000-000000000000} Chave orfã

O4 - HKUS\S-1-5-18\..\Run: [Advanced SystemCare 5] D:\Advanced SystemCare 5\ASCTray.exe (.not file.)

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]

[HKCU\Software\SteamPopCap] => Infection BT (Adware.PopCap)

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype

[HKLM\Software\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype

[HKLM\Software\Microsoft\Internet Explorer\extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}] =>Toolbar.Skype

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype

[HKLM\Software\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}] =>Toolbar.Skype

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}]

[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{c95a4e8e-816d-4655-8c79-d736da1adb6d}] =>Toolbar.Conduit

[HKLM\Software\Classes\Installer\Features\9EC6D81181F59F2459A84176A626F9ED] =>Adware.IMBooster

[HKLM\Software\Classes\Installer\Products\9EC6D81181F59F2459A84176A626F9ED] =>Adware.IMBooster

[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9EC6D81181F59F2459A84176A626F9ED]

[HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F1057DD419AED0B468AD8888429E139A] =>Adware.IMBooster

C:\ProgramData\hssff =>Toolbar.Conduit

C:\Users\User\AppData\Local\eSupport.com =>Rogue.RegistryWizard

C:\Program Files\Mozilla FireFox\searchplugins\yahoo-br.xml =>Toolbar.Yahoo^

C:\ProgramData\hssff => Toolbar.Conduit

D:\Advanced SystemCare 5

proxyfix

emptytemp

emptyclsid

emptyflash

firewallraz

sysrestore

|- Estando com o Bloco de Notas aberto,acione os atalhos: "Ctrl+A" -> "Ctrl+C"

|- Minimize o Bloco de Notas.

/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/My%2520Tools%25203/ZHPDiag_PasteClipboard.jpg&key=e48613cfa6f79756d0d3087d1f9470f91a4d063f3d1285295d93d87cacbfb63d" alt="ZHPDiag_PasteClipboard.jpg" />

|- Clique no menu,"Paste ClipBoard".

|- Evite a opção "Colar" ( Ctrl+V ),no campo amarelo claro,que não habilita o botão "Go".

/applications/core/interface/imageproxy/imageproxy.php?img=http://t.imgbox.com/acerMAbC.jpg&key=8f6573385f94e5beff1160ce0a8e6778a7b84bd7dbdcfdd2ee7c4058d85bf88a" alt="acerMAbC.jpg" />

|- Clique "GO" >> Oui.

/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/My%2520Tools%25203/ZHPFix_GO.jpg&key=558fe81face1e694faa61f1e0c3985db203e8ad910d59aa68f5da5f2fd114f02" alt="ZHPFix_GO.jpg" />

|- Ps: Temos,àcima,sequência de imagens para maior exclarecimento.

|- Poste o relatório: C:\ZHP\ZHPFix[R1].txt

Abs!

Boa noite! aqui vai o relatório.

AdwCleaner v2.306 - Relatório criado em 18/08/2013 às 00:20:54

Atualizado em 19/07/2013 por Xplode

Sistema Operacional : Windows 7 Ultimate (32 bits)

Usuário : User - USER-PC

Modo de Boot : Normal

Executado de : C:\Users\User\Desktop\adwcleaner.exe

Opção [Verificar]

*** [serviços] ***

*** [Arquivos/Pastas] ***

Pasta Encontrado : C:\Program Files\Common Files\DVDVideoSoft\TB
Pasta Encontrado : C:\Windows\Installer\{118D6CE9-5F18-42F9-958A-14676A629FDE}

*** [Registro] ***

Chave Encontrada : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Chave Encontrada : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Chave Encontrada : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Chave Encontrada : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Chave Encontrada : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Chave Encontrada : HKCU\Software\YahooPartnerToolbar
Chave Encontrada : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Chave Encontrada : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Chave Encontrada : HKLM\Software\Classes\Installer\Features\9EC6D81181F59F2459A84176A626F9ED
Chave Encontrada : HKLM\Software\Classes\Installer\Products\9EC6D81181F59F2459A84176A626F9ED
Chave Encontrada : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Chave Encontrada : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F1057DD419AED0B468AD8888429E139A
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0B4750D705E2564409328D661F3A08E1
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\26E983F1377593143A37E3BA1C65CB74
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3C036A97566BFD147A3318BA9E8EA65E
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3CC84F27D09408149894EC0F9A7C017F
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\43C098337DB065A49B665D4EA7F16D1C
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4BDFB2601A205D344828E68FC902CAE9
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D010CDB0C7815A48A7F780C5F8AACA7
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AFEEBDA8013CAA74C8052DC06F9F22D8
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CC063FFF6402E614191D191F0DE5C5B4
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F18FD125C322BC84286AD21D8B685F2F
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F1C8F66181D6DDD488BB6F772F71324A
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F7652513C62FF63448CFF05163719DB7
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9EC6D81181F59F2459A84176A626F9ED

*** [Navegadores] ***

-\\ Internet Explorer v9.0.8112.16470

[OK] Registro está limpo.

-\\ Mozilla Firefox v20.0.1 (pt-BR)

-\\ Google Chrome v28.0.1500.95

-\\ Opera v11.52.1100.0

*************************

AdwCleaner[R1].txt - [3953 octets] - [18/08/2013 00:20:54]

########## EOF - C:\AdwCleaner[R1].txt - [4013 octets] ##########

Rapport de ZHPFix 2013.7.20.5 par Nicolas Coolman, Update du 20/07/2013
Fichier d'export Registre :
Run by User at 18/08/2013 00:25:32
High Elevated Privileges : OK
Windows 7 Ultimate Edition, 32-bit (Build 7600)

Recycle Files Deleted

========== Registry Key ==========
DELETED Key: CLSID: [HKLM\SOFTWARE\Classes\CLSID\{C55BBCD6-41AD-48AD-9953-3609C48EACC7}]
DELETED Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{c95a4e8e-816d-4655-8c79-d736da1adb6d}
DELETED Key: HKCU\Software\SteamPopCap
DELETED Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
DELETED Key: HKLM\Software\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
DELETED Key: HKLM\Software\Microsoft\Internet Explorer\extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
DELETED Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
DELETED Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
DELETED Key: HKLM\Software\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
DELETED Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
NOT FOUND Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{c95a4e8e-816d-4655-8c79-d736da1adb6d}
DELETED Key: HKLM\Software\Classes\Installer\Features\9EC6D81181F59F2459A84176A626F9ED
DELETED Key: HKLM\Software\Classes\Installer\Products\9EC6D81181F59F2459A84176A626F9ED
DELETED Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9EC6D81181F59F2459A84176A626F9ED
DELETED Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F1057DD419AED0B468AD8888429E139A

========== Registry Value ==========
DELETED URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497}
DELETED Toolbar: {C55BBCD6-41AD-48AD-9953-3609C48EACC7}
DELETED Toolbar: {E0301295-AB3E-4AF3-979F-3D453C5F9F48}
DELETED Toolbar: {00000000-0000-0000-0000-000000000000}
DELETED RunValue: Advanced SystemCare 5
ProxyFix : Proxy killed successfully
DELETED ProxyServer Value
DELETED ProxyEnable Value
DELETED EnableHttp1_1 Value
DELETED ProxyHttp1.1 Value
DELETED ProxyOverride Value
No Value in Domain Profile Register Key FirewallRaz :
DELETED FirewallRaz (None) : {28052C37-59D6-45F2-9E73-04474ADD8D2B}
DELETED FirewallRaz (Public) : TCP Query User{D12F5C56-1594-4BC0-80AA-2A2E455DBF67}C:\windows\system32\rundll32.exe
DELETED FirewallRaz (Public) : UDP Query User{A4618D61-8C0F-43A5-83EA-C0071CF02EE2}C:\windows\system32\rundll32.exe
DELETED FirewallRaz (None) : {E005786A-0317-4CA5-B6F5-B6B782BC3047}
DELETED FirewallRaz (None) : {840E7B61-1F24-4DC5-95FF-053E7E14C1CF}
DELETED FirewallRaz (Public) : TCP Query User{459FB5E0-C61B-4B9D-9340-D04295EE7553}D:\steam\steamapps\common\the war z\warz.exe
DELETED FirewallRaz (Public) : UDP Query User{813392B0-B382-40E5-B59E-58ADB1F29D70}D:\steam\steamapps\common\the war z\warz.exe
DELETED FirewallRaz (Public) : TCP Query User{EE268228-4F1E-4A98-9218-C033CBCF1C7D}D:\steam\steamapps\kenxay\counter-strike source\hl2.exe
DELETED FirewallRaz (Public) : UDP Query User{5DD95B65-C2A6-4F39-85C0-FFF20E5E873F}D:\steam\steamapps\kenxay\counter-strike source\hl2.exe
DELETED FirewallRaz (None) : {24557B89-0AC8-46C2-B5D9-DABE1EFC08D3}
DELETED FirewallRaz (None) : {8D0C04FA-42FF-4D9E-B3AC-F0EDE77E1FBA}
DELETED FirewallRaz (None) : {6DF0F235-57D6-4EE6-88E5-F84DC92A77F3}
DELETED FirewallRaz (None) : {C1915461-0BDB-458E-BD57-709F6A7ADBDF}
DELETED FirewallRaz (Private) : TCP Query User{12437F92-0571-470F-B1C7-9CAA90580808}D:\steam\steamapps\common\the war z\warz.exe
DELETED FirewallRaz (Private) : UDP Query User{9C1C282C-F5CC-4106-AD9C-CF4A2905B56A}D:\steam\steamapps\common\the war z\warz.exe
DELETED FirewallRaz (Private) : TCP Query User{6B7D6789-C391-4690-BD2F-CC48355C4318}D:\steam\steamapps\kenxay\team fortress 2\hl2.exe
DELETED FirewallRaz (Private) : UDP Query User{F940B2C1-DF70-4DB1-AD92-58CDA2047F70}D:\steam\steamapps\kenxay\team fortress 2\hl2.exe

========== Repertory ==========
DELETED Folder: C:\Users\User\AppData\Local\{09EAD30A-7748-4424-80A4-CCFF9D7FAC14}
DELETED Folder: C:\Users\User\AppData\Local\{0F4A7F1B-86BC-477E-9A1E-995D26046300}
DELETED Folder: C:\Users\User\AppData\Local\{231F9D3C-50CF-4FC0-962A-FE34B5452EEF}
DELETED Folder: C:\Users\User\AppData\Local\{75397110-6710-4339-A5D9-5A48FFFC4290}
DELETED Folder: C:\Users\User\AppData\Local\{7D268D9B-51B3-473A-A2A7-7ADE53F9BED1}
DELETED Folder: C:\Users\User\AppData\Local\{8DE89F8F-812A-40E2-ACD3-444FECB34A1F}
DELETED Folder: C:\Users\User\AppData\Local\{A77F0654-6960-4B7B-9B32-0909E44B0349}
DELETED Folder: C:\Users\User\AppData\Local\{AD4B7D21-0AA3-49D6-8BF4-144344F76F79}
DELETED Folder: C:\Users\User\AppData\Local\{D492F93A-9FEC-4D43-B4C6-8EA157F3FE92}
DELETED Folder: C:\Users\User\AppData\Local\{FF05A6D1-5ED3-4291-AC1E-201DD2D55CF9}
DELETED Flash Cookies

========== File ==========
NOT FOUND File: d:\advanced systemcare 5\asctray.exe
DELETED File: C:\Program Files\Mozilla FireFox\searchplugins\yahoo-br.xml
DELETED File***: c:\program files\mozilla firefox\searchplugins\yahoo-br.xml
NOT FOUND Folder/File: c:\programdata\hssff
NOT FOUND Folder/File: d:\advanced systemcare 5
DELETED Window Temporary
DELETED Flash Cookies

========== Restoration ==========
Restore System Point created succefully

========== Summary ==========
15 : Registry Key
29 : Registry Value
11 : Repertory
7 : File
1 : Restoration

End of clean in 00mn 51s

========== Report File ==========
C:\ZHP\ZHPFix[R1].txt - 18/08/2013 00:25:33 [5668]

Bom Dia! alvotarget

|- Execute,novamente,a ferramenta AdwCleaner e clique na opção "Clean".

|- Ps: Esta opção estará na nova versão da ferramenta.

|- Poste o relatório!

|- Baixe: < /applications/core/interface/imageproxy/imageproxy.php?img=http://i48.tinypic.com/1268r49.png&key=be85c7a026af0cb092d2f868777759c6b4bd667a01f00e36e91558a667424520" alt="1268r49.png" /> > ( ... by Oleg N. Scherbakov )
|- Salve-o no desktop!
|- Para Windows 7,clique direito em JRT.exe e execute-o ... /applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/Executar_Administrador.jpg&key=29bbf2d3836c6859afe3923102565f782321b5a7a2787d5bb24cc9918d13e9bd" alt="Executar_Administrador.jpg" />
|- Aguarde a conclusão e poste o relatório. ( JRT.txt )

-/-

|- Baixe: < zoek > ( ... by Smeenk )

|- Ou aqui! < /applications/core/interface/imageproxy/imageproxy.php?img=http://www.imgdumper.nl/uploads6/51a612a8b2bc1/51a612a8b27e2-Zoek.png&key=b080d87f02699d418b53b08471d428294848da3b0e2385f0657dbc188036baad" alt="51a612a8b27e2-Zoek.png" /> zoek.exe >

|- Salve-o no desktop!
|- Desabilite seu antivírus!
|- Para Windows 7,execute zoek.exe como administrador.

firefoxlook;
autoclean;
emptyalltemp;

|- Copie e cole estas informações,em vermelho,no campo da ferramenta.
|- Clique "Run Script".

Zoek.exe is running now.

|- Surgirão estas informações,pedindo-lhe que aguarde o relatório.

/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/Zoek_Reboot_zpscf60b3cf.jpg&key=cd3dbc8b6058332b5ca134f03724ff8c45ff51d7f31a8c732301729c7a9e6c94" alt="Zoek_Reboot_zpscf60b3cf.jpg" />

|- Aceite e/ou confirme o reboot!

zoek.hta failed by unknown error.

|- Ps: Ao obter algum erro,reinicie o PC e execute,novamente,a ferramenta.
|- Poste o relatório,que estará em C:\zoek-results.txt <<

A+

Olá bom dia!

Bom o JRT está dando um erro "7-Zip: Internal error, code 105"

Já reiniciei o PC e baixei novamente mas persiste o erro.

>
Olá bom dia!

Bom o JRT está dando um erro "7-Zip: Internal error, code 105"

Já reiniciei o PC e baixei novamente mas persiste o erro.

Olá novamente, resolvi o problema, tive que desativar o antivirus!

Aqui vai todos os relatórios!

AdwCleaner v2.306 - Relatório criado em 19/08/2013 às 11:31:49

Atualizado em 19/07/2013 por Xplode

Sistema Operacional : Windows 7 Ultimate (32 bits)

Usuário : User - USER-PC

Modo de Boot : Normal

Executado de : C:\Users\User\Desktop\adwcleaner.exe

Opção [Verificar]

*** [serviços] ***

*** [Arquivos/Pastas] ***

Pasta Encontrado : C:\Program Files\Common Files\DVDVideoSoft\TB
Pasta Encontrado : C:\Windows\Installer\{118D6CE9-5F18-42F9-958A-14676A629FDE}

*** [Registro] ***

Chave Encontrada : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Chave Encontrada : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Chave Encontrada : HKCU\Software\YahooPartnerToolbar
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0B4750D705E2564409328D661F3A08E1
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\26E983F1377593143A37E3BA1C65CB74
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3C036A97566BFD147A3318BA9E8EA65E
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3CC84F27D09408149894EC0F9A7C017F
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\43C098337DB065A49B665D4EA7F16D1C
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4BDFB2601A205D344828E68FC902CAE9
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D010CDB0C7815A48A7F780C5F8AACA7
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AFEEBDA8013CAA74C8052DC06F9F22D8
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CC063FFF6402E614191D191F0DE5C5B4
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F18FD125C322BC84286AD21D8B685F2F
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F1C8F66181D6DDD488BB6F772F71324A
Chave Encontrada : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F7652513C62FF63448CFF05163719DB7

*** [Navegadores] ***

-\\ Internet Explorer v9.0.8112.16470

[OK] Registro está limpo.

-\\ Mozilla Firefox v20.0.1 (pt-BR)

-\\ Google Chrome v28.0.1500.95

-\\ Opera v11.52.1100.0

*************************

AdwCleaner[R1].txt - [4082 octets] - [18/08/2013 00:20:54]
AdwCleaner[R2].txt - [2790 octets] - [19/08/2013 11:31:49]

########## EOF - C:\AdwCleaner[R2].txt - [2850 octets] ##########

----------------------------

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.0 (08.18.2013:1)
OS: Windows 7 Ultimate x86
Ran by User on 19/08/2013 at 11:49:21,27
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\yahoopartnertoolbar
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_para_morphvox-junior_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_para_morphvox-junior_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_para_street-chaves_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_para_street-chaves_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_para_zuma_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\SoftonicDownloader_para_zuma_RASMANCS

~~~ Files

Successfully deleted: [File] "C:\Windows\wininit.ini"

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\hotspot shield"
Successfully deleted: [Folder] "C:\Users\User\appdata\local\cre"

~~~ FireFox

Successfully deleted: [File] C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\c4817zyf.default\user.js
Successfully deleted the following from C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\c4817zyf.default\prefs.js

user_pref("CT1561552.1000082.state", "{\"state\":\"stopped\",\"text\":\"Danceradio\",\"description\":\"Danceradio\",\"url\":\"hxxp://101danceradio.com/wmx/classicrockjukebox64

user_pref("CT1561552.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
user_pref("CT1561552.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");

user_pref("CT1561552.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
user_pref("CT1561552.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
user_pref("CT1561552.last-search-provider", "\"google\"");
user_pref("CT1561552.last-social-provider", "\"facebook\"");

user_pref("CT1561552.search-providers", "{\"google\":[229,1345856663187],\"bing\":[2,1345607729084]}");
user_pref("CT1561552.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
user_pref("CT1561552.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
user_pref("CT1561552.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}");
user_pref("CT1561552.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT1561552\"}");
user_pref("CT1561552.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://HotspotShield.OurToolbar.com//xpi\"}");
user_pref("CT1561552.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"Hotspot Shield\"}");
user_pref("CT1561552.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
user_pref("CT1561552.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data\":\"2\"}");
user_pref("CT1561552.social-providers", "{\"facebook\":[95,1345855297652],\"gmail\":[13,1345854966330]}");
user_pref("CT1561552.toolbarAppHeartbeat", "{\"129810223371412420\":1345599035539}");

user_pref("CT2765711.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description\":\"California Rock\",\"url\":\"hxxp://feedlive.net/california.asx\"}");
user_pref("CT2765711.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
user_pref("CT2765711.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");

user_pref("CT2765711.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
user_pref("CT2765711.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");

user_pref("CT2765711.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
user_pref("CT2765711.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
user_pref("CT2765711.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}");
user_pref("CT2765711.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT2765711\"}");
user_pref("CT2765711.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://AFHSS.OurToolbar.com//xpi\"}");
user_pref("CT2765711.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"AF-HSS\"}");
user_pref("CT2765711.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
user_pref("CT2765711.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data\":\"2\"}");
user_pref("CT2765711.toolbarAppHeartbeat", "{\"129766354890612884\":1345859783198}");

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 19/08/2013 at 11:53:21,10
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-----------------------

Zoek.exe Version 4.0.0.4 Updated 19-08-2013
Tool run by User on 19/08/2013 at 11:57:21,41.
Microsoft Windows 7 Ultimate 6.1.7600 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\User\Desktop\zoek.exe [script inserted]

==== System Restore Info ======================

19/08/2013 11:58:42 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== FireFox Fix ======================

ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\c4817zyf.default

user.js not found
---- Lines CT1561552 removed from prefs.js ----

user_pref("CT1561552.1000082.state", "{\"state\":\"stopped\",\"text\":\"Danceradio\",\"description\":\"Danceradio\",\"url\":\"[http://101danceradio.com/wmx/classicrockjukebox64k.wmx\](http://101danceradio.com/wmx/classicrockjukebox64k.wmx%5C)"}");
user_pref("CT1561552.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
user_pref("CT1561552.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");
user_pref("CT1561552.embeddedsData", "[{\"appId\":\"128491907208256770\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true,\"instantAlert\":true,\"jsInjection\":true,\"sslGranted\":true},\"onBeforeLoadData\":\"{\\\"view\\\":{\\\"html\\\":\\\"<table id=\\\\\\\"main\\\\\\\" class=\\\\\\\"mainwrapper\\\\\\\" cellpadding=\\\\\\\"0\\\\\\\" cellspacing=\\\\\\\"0\\\\\\\">\\\\n <tbody><tr>\\\\n <!-- don't remove the width=\\\\\\\"100%\\\\\\\" bug in chrome the width become in px-->\\\\n <td id=\\\\\\\"textboxWrapper\\\\\\\" style=\\\\\\\"width: 100%; background: none repeat scroll 0% 0% rgb(255, 255, 255);\\\\\\\" width=\\\\\\\"100%\\\\\\\">\\\\n <!-- take focuse in IE -->\\\\n <!--[if ie]>\\\\n <form onsubmit =\\\\\\\"return false;\\\\\\\" action=\\\\\\\"#\\\\\\\">\\\\n <![endif]-->\\\\n <input style=\\\\\\\"color: rgb(0, 0, 0); background: none repeat scroll 0% 0% rgb(255, 255, 255); min-width: 137px; max-width: 284px; width: 100%;\\\\\\\" id=\\\\\\\"textbox\\\\\\\" type=\\\\\\\"text\\\\\\\">\\\\n <!--[if ie]>\\\\n </form>\\\\n <![endif]-->\\\\n </td>\\\\n <td style=\\\\\\\"background: none repeat scroll 0% 0% rgb(255, 255, 255);\\\\\\\" id=\\\\\\\"infoPopupButtonWrapper\\\\\\\">\\\\n <div id=\\\\\\\"infoPopupButton\\\\\\\" class=\\\\\\\"dropdownButton no-select\\\\\\\"></div>\\\\n </td>\\\\n <td id=\\\\\\\"engineWrapperContainer\\\\\\\">\\\\n <table cellpadding=\\\\\\\"0\\\\\\\" cellspacing=\\\\\\\"0\\\\\\\">\\\\n <tbody><tr>\\\\n <td id=\\\\\\\"imageTextWrapperContainer\\\\\\\">\\\\n <table cellpadding=\\\\\\\"0\\\\\\\" cellspacing=\\\\\\\"0\\\\\\\">\\\\n <tbody><tr>\\\\n <td style=\\\\\\\"display: table-cell;\\\\\\\" id=\\\\\\\"engineWrapper\\\\\\\"><img style=\\\\\\\"display: block;\\\\\\\" id=\\\\\\\"engineImage\\\\\\\" alt=\\\\\\\"\\\\\\\" src=\\\\\\\"[http://storage.conduit.com/52/156/CT1561552/images/634553228828881251_20PX.png\\\\\\\](http://storage.conduit.com/52/156/CT1561552/images/634553228828881251_20PX.png%5C%5C%5C%5C%5C%5C%5C)" onerror=\\\\\\\"javascript: this.src='[http://storage.conduit.com/images/searchengines/go_btn_new.gif](http://storage.conduit.com/images/searchengines/go_btn_new.gif)'\\\\\\\"></td>\\\\n <td style=\\\\\\\"display: table-cell;\\\\\\\" id=\\\\\\\"engineTextWrapper\\\\\\\">\\\\n <div title=\\\\\\\"Go\\\\\\\" style=\\\\\\\"color: rgb(0, 0, 0); font-family: Tahoma; font-weight: normal; font-style: normal; font-size: 11px;\\\\\\\" id=\\\\\\\"engineText\\\\\\\">Go</div>\\\\n </td>\\\\n </tr>\\\\n </tbody></table>\\\\n </td>\\\\n <td id=\\\\\\\"enginesPopupButtonWrapper\\\\\\\">\\\\n <div id=\\\\\\\"enginesPopupButton\\\\\\\" class=\\\\\\\"dropdownButton no-select\\\\\\\"> </div>\\\\n </td>\\\\n </tr>\\\\n </tbody></table>\\\\n </td>\\\\n </tr>\\\\n</tbody></table>\\\"},\\\"locale\\\":{\\\"alignMode\\\":\\\"LTR\\\",\\\"locale\\\":\\\"en-us\\\",\\\"languageAlignMode\\\":\\\"LTR\\\"}}\"},{\"appId\":\"129465890694457068\",\"apiPermissions\":{\"crossDomainAjax\":false,\"getMainFrameTitle\":false,\"getMainFrameUrl\":false,\"getSearchTerm\":false,\"instantAlert\":true,\"jsInjection\":false,\"sslGranted\":false},\"originalHeight\":0},{\"appId\":\"129623602370237963\",\"apiPermissions\":{\"crossDomainAjax\":false,\"instantAlert\":false,\"jsInjection\":false,\"sslGranted\":false,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true},\"originalHeight\":26},{\"appId\":\"1000082\",\"apiPermissions\":{\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true}},{\"appId\":\"129393336051369227\",\"apiPermissions\":{\"crossDomainAjax\":false,\"instantAlert\":true,\"jsInjection\":false,\"sslGranted\":false,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true},\"originalHeight\":28},{\"appId\":\"129599733775895750\",\"apiPermissions\":{\"crossDomainAjax\":false,\"getMainFrameTitle\":false,\"getMainFrameUrl\":false,\"getSearchTerm\":false,\"instantAlert\":true,\"jsInjection\":false,\"sslGranted\":false},\"originalHeight\":26},{\"appId\":\"129599733639330904\",\"apiPermissions\":{\"crossDomainAjax\":false,\"getMainFrameTitle\":false,\"getMainFrameUrl\":false,\"getSearchTerm\":false,\"instantAlert\":true,\"jsInjection\":false,\"sslGranted\":false},\"originalHeight\":26},{\"appId\":\"129755532604957823\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true,\"instantAlert\":true,\"jsInjection\":true,\"sslGranted\":false},\"originalHeight\":20},{\"appId\":\"129810223371412420\",\"apiPermissions\":{\"crossDomainAjax\":true,\"instantAlert\":true,\"jsInjection\":true,\"sslGranted\":false,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true},\"originalHeight\":26},{\"appId\":\"129834662830138324\",\"apiPermissions\":{\"crossDomainAjax\":true,\"instantAlert\":true,\"jsInjection\":true,\"sslGranted\":false,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true},\"originalHeight\":26}]");
user_pref("CT1561552.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
user_pref("CT1561552.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
user_pref("CT1561552.last-search-provider", "\"google\"");
user_pref("CT1561552.last-social-provider", "\"facebook\"");
user_pref("CT1561552.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"about%3Aaddons\",\"EB_MAIN_FRAME_TITLE\":\"\",\"EB_SEARCH_TERM\":\"\",\"EB_TOOLBAR_SUB_DOMAIN\":\"[http://HotspotShield.OurToolbar.com/\](http://HotspotShield.OurToolbar.com/%5C)",\"EB_TOOLBAR_ID\":\"CT1561552\",\"EB_TOOLBAR_VERSION\":\"10.10.22.13\",\"EB_ORIGINAL_CTID\":\"CT1561552\",\"EB_DOWNLOAD_PAGE\":\"[http://HotspotShield.OurToolbar.com/\](http://HotspotShield.OurToolbar.com/%5C)",\"EB_TOOLBAR_NAME\":\"Hotspot Shield\"}");
user_pref("CT1561552.search-providers", "{\"google\":[229,1345856663187],\"bing\":[2,1345607729084]}");
user_pref("CT1561552.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
user_pref("CT1561552.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
user_pref("CT1561552.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}");
user_pref("CT1561552.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT1561552\"}");
user_pref("CT1561552.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"[http://HotspotShield.OurToolbar.com//xpi\](http://HotspotShield.OurToolbar.com//xpi%5C)"}");
user_pref("CT1561552.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"Hotspot Shield\"}");
user_pref("CT1561552.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
user_pref("CT1561552.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data\":\"2\"}");
user_pref("CT1561552.social-providers", "{\"facebook\":[95,1345855297652],\"gmail\":[13,1345854966330]}");
user_pref("CT1561552.toolbarAppHeartbeat", "{\"129810223371412420\":1345599035539}");
user_pref("CT1561552.toolbarNotificationSettings", "{\"sendNotifications\":{\"all\":true,\"apps\":{\"0.2646799591156723\":{\"show\":true,\"appName\":\"Iolo \",\"firstTime\":true}}}}");

---- Lines CT1561552 modified from prefs.js ----

---- Lines CT2765711 removed from prefs.js ----

---- Lines CT2765711 modified from prefs.js ----

---- Lines conduit removed from prefs.js ----

---- Lines conduit modified from prefs.js ----

---- Lines yahoo removed from prefs.js ----

---- Lines yahoo modified from prefs.js ----

---- Lines babylon removed from prefs.js ----

---- Lines babylon modified from prefs.js ----

---- Lines ask.com removed from prefs.js ----

---- Lines ask.com modified from prefs.js ----

---- Lines OneClickDownload removed from prefs.js ----

---- Lines OneClickDownload modified from prefs.js ----

---- FireFox user.js and prefs.js backups ----

prefs_082013_1203_.backup

==== Deleting Files \ Folders ======================

"C:\Users\User\AppData\Local\{49F69778-4E84-4A46-8FF7-2331C797D3E0}" deleted
"C:\Users\User\AppData\Local\{D4BEDBAD-EE20-4EC9-819C-AB9B02988A8B}" deleted
"C:\Users\User\Downloads\FileConverter_1_1.exe" deleted
"C:\Windows\System32\Tasks\DealPlyUpdate" deleted
"C:\ProgramData\hash.dat" deleted
"C:\Users\User\AppData\Roaming\Mumble" deleted
"C:\Windows\system32\appdata" deleted
"C:\Program Files\Common Files\DVDVideoSoft\TB" deleted
"C:\Program Files\Common Files\DVDVideoSoft\bin" deleted
"C:\Windows\Installer\{118D6CE9-5F18-42F9-958A-14676A629FDE}" deleted
"C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\c4817zyf.default\CT1561552" deleted
"C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\c4817zyf.default\CT2765711" deleted
"C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\c4817zyf.default\CT1561552" deleted
"C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\c4817zyf.default\CT2765711" deleted

==== Firefox Extensions ======================

ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\c4817zyf.default

• OneClick YouTube Downloader - %ProfilePath%\extensions\{35379F86-8CCB-4724-AE33-4278DE266C70}


• Modulo Adicional de Seguranca CAIXA - %ProfilePath%\extensions\{87F8774F-B485-47E2-A755-A40A8A5E886D}

AppDir: C:\Program Files\Mozilla Firefox

• Default - %AppDir%\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\c4817zyf.default
595AC36B25E33791A54E4A72F2AEAB10 - C:\Users\User\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll - Google Talk Plugin Video Accelerator
5C075DC43D9BF0230DFB049C1ADC75F4 - C:\Users\User\AppData\Roaming\Mozilla\plugins\npo1d.dll - Google Talk Plugin Video Renderer
01815AF8A63F6DD5FF0AA94AA6E5FD23 - C:\Users\User\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll - Google Talk Plugin
101700E93EB905992B518256CB441829 - C:\Users\User\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll - Google Update
7550FC1ADE982582D5920BEA6430E3D4 - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll - Google Earth Plugin
0C8597DBC74AAF5179471BA013E3C6B4 - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll - Shockwave Flash
545E63EE9B530BDD10AAF477A8DD7C63 - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll - NVIDIA 3D Vision
7EE6B6E962FD9E02BBDBF15052E0576D - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll - NVIDIA 3D VISION
31B2952853BA5F53BDE06DB5AC8F98AA - C:\Program Files\Battlelog Web Plugins\2.1.7\npesnlaunch.dll - ESN Launch Mozilla Plugin
BFD3111B723CC07E56316198617932D7 - C:\Program Files\Battlelog Web Plugins\2.1.4\npesnlaunch.dll - ESN Launch Mozilla Plugin
3A523765D795DB006C010B915C3A840A - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll - Adobe Acrobat
05C4A7136F3012BB47107333B5D351D3 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll - Java Platform SE 7 U17
D4BD9F86123C87ECA570418B69326F99 - C:\Windows\system32\npdeployJava1.dll - Java Deployment Toolkit 7.0.170.2
0566EC21D0C4430EDF95CEA67387BFD2 - D:\QuickTime\Plugins\npqtplugin7.dll - QuickTime Plug-in 7.7.3
079E5264E28489BD258E888F9EAB479B - D:\QuickTime\Plugins\npqtplugin6.dll - QuickTime Plug-in 7.7.3
F737E69B4F6A7E5D5FD55A5877B7BE55 - D:\QuickTime\Plugins\npqtplugin5.dll - QuickTime Plug-in 7.7.3
385B90C3373BCC938B696E4E48943F78 - D:\QuickTime\Plugins\npqtplugin4.dll - QuickTime Plug-in 7.7.3
21AC25E78901A6D1BBEB5AC7FD4E3CCA - D:\QuickTime\Plugins\npqtplugin3.dll - QuickTime Plug-in 7.7.3
9F825A31AA32CAD7778F6EE10ADD4D46 - D:\QuickTime\Plugins\npqtplugin2.dll - QuickTime Plug-in 7.7.3
E2F522DD5517AB8DF6118EE7A4BD26FD - D:\QuickTime\Plugins\npqtplugin.dll - QuickTime Plug-in 7.7.3
A5C14075B571AF1C9592595BE724D9D2 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll - Silverlight Plug-In
E18B5B26F41D8C37CCAA7256F29F6A15 - c:\program files\real\realplayer\Netscape6\nppl3260.dll - RealPlayer G2 LiveConnect-Enabled Plug-In (32-bit)
EBEEC9B1FB8BC809C719713A36640966 - c:\program files\real\realplayer\Netscape6\nprpplugin.dll - RealPlayer Download Plugin
FEF9ECECFA177AEC0F7564A08394D2C8 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll - RealNetworks RealDownloader Chrome Background Extension Plug-In (32-bit)
0ABF093757E9C827E30EC652868E5FAC - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll - RealNetworks RealDownloader PepperFlashVideoShim Plug-In (32-bit)
06E140A567B8DC7900173197FD059EE5 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll - RealNetworks RealDownloader HTML5VideoShim Plug-In (32-bit)
558270B968CB82196CB8D045D13B0FF6 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll - RealDownloader Plugin
2760DEF92BB72980BBF3F154B651FAC8 - C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll - Nokia Suite Enabler Plugin
36FBE76F4F51396B0F70FC95CD7481D2 - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll - Pando Web Plugin
D02ED3C972BBF10890CA2A586F2C0762 - C:\Users\User\AppData\LocalLow\Sony Online Entertainment\npsoe.dll - SOE Web Installer
C517E5EA7CEE783F3681F62D2A362E5B - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll - Windows Live? Photo Gallery
B83062F5BFFAF797DCA67464B58970D5 - C:\Program Files\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll - ESN Sonar API
87A356753B2208461DA361B13E7E909C - C:\Users\User\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll - Unity Player
C50B22C8D91A76069A993A2B5197A296 - D:\Veetle\plugins\npVeetle.dll - Veetle TV Core
866B027053F3A40BC36126D265C78E96 - D:\Veetle\Player\npvlc.dll - Veetle TV Player
8E9A08E2092B3E1ADFF3C46BC1A5124B - C:\Windows\system32\TVUAx\npTVUAx.dll - TVU Web Player for FireFox
01F0264937036BD962563F1ADF35CE72 - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll - RealPlayer Version Plugin
79BB0C72FD89D855561838E895EDCFFE - C:\Users\User\AppData\LocalLow\Sony Online Entertainment\npsoeact.dll - SOE Web Installer
15E298B5EC5B89C5994A59863969D9FF - C:\Windows\system32\npmproxy.dll - Microsoft® Windows® Operating System
2AA3703D87E1327A2290C9D416D89A28 - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrlui.dll - Microsoft® Silverlight

==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
idhngdhcfkoamngbedgpaokgjbnpdiji - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx[29/11/2012 20:35]
lifbcibllhkdhoafpjfnlhfpfgnpldfl - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx[02/10/2012 12:14]
mdebcffgnijbblbinknkbefciofebcda - No path found[]

RealDownloader - User - Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji
Skype Click to Call - User - Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com.br/"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com.br/"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\mdebcffgnijbblbinknkbefciofebcda deleted successfully

==== Empty IE Cache ======================

C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\UpdatusUser\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

C:\users\User\AppData\Local\Mozilla\Firefox\Profiles\c4817zyf.default\Cache emptied successfully

==== Empty Chrome Cache ======================

C:\users\User\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\User\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== Deleting Files / Folders ======================

"C:\Users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted
"C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted

==== EOF on 19/08/2013 at 12:06:07,10 ======================

Boa Tarde! alvotarget

|- Baixou a nova versão de AdwCleaner?
|- Baixe: |DelFix| ( ... de Xplode )

/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/My%2520Tools%25203/DelFix_SetaVerde.jpg&key=a562af283f81224b0096f109e2c85fcde8abae0d109a59c91160b5f99a23e243" alt="DelFix_SetaVerde.jpg" />

|- Estando na página,clique na seta verde para o download.
|- Salve-a em um local conveniente! ( desktop! )
|- Feche aplicativos que estejam abertos.

/applications/core/interface/imageproxy/imageproxy.php?img=http://home.kpn.nl/stefsmeenk/delfix.gif&key=18033ed0d990b9dba10f3aa620c883e92b188e95ccac98a5e1a6286226c313b9" alt="delfix.gif" />

|- Execute-a!
|- Com as 3 checkbox marcadas!
|- Clique "Run".
|- Poste o log e informe as condições da máquina.
|- Seus logs estão limpos.

A+

Olá bom dia! Baixei agora o AdwCleaner mas a opção "Clean" ainda não está disponivel, acho que ficará após eu executar o Scan. Posso novamente?

Olá bom dia! Baixei agora o AdwCleaner mas a opção "Clean" ainda não está disponivel, acho que ficará após eu executar o Scan. Posso novamente?

Olá!

|- Verificou se a versão da ferramenta é a v.3000 ou superior?

... editando!

/applications/core/interface/imageproxy/imageproxy.php?img=http://t.imgbox.com/advz4z8Y.jpg&key=d014b7c10974863cb53eb98c621165d7bed35f01f9fe6800257605fc7dc58eba" alt="advz4z8Y.jpg" />

|- Modificaram recentemente o layout da ferramenta.

|- Clique "Scan" e se o botão "Clean" ficar ativo,pode clicar nele para cada guia que tenha acessado em Results.

http://imgbox.com/adegUsFH'>/applications/core/interface/imageproxy/imageproxy.php?img=http://t.imgbox.com/adegUsFH.jpg&key=ef53dc375b32e51edfe8be3fb665ac1d1d329ed87e36faabbee8595cb37320b8" alt="adegUsFH.jpg" />

|- Clique nas setinhas laterais,para ter acesso ao Firefox ou Chrome.

Abs!

Olá bom dia!

Sim é a versão 3.000!

E já estou fazendo isso!

>
Olá bom dia!

Sim é a versão 3.000!

E já estou fazendo isso!

Bom Dia! alvotarget

E a(s) contas! Continuam sendo violadas?

Troque a(s) senhas,após a limpeza que estamos efetuando.

A+

Não não rs! Já troquei as senhas e perguntas secretas!

Só uma coisa, está ultima verificação criou 3 relatórios, um para cada guia. Posto para você ver?

>
Não não rs! Já troquei as senhas e perguntas secretas!

Só uma coisa, está ultima verificação criou 3 relatórios, um para cada guia. Posto para você ver?

Olá!

Sim! Poste-os....

Abs!

AdwCleaner v3.000 - Report created 22/08/2013 at 09:48:23

Updated 20/08/2013 by Xplode

Operating System : Windows 7 Ultimate (32 bits)

Username : User - USER-PC

Running from : C:\Users\User\Desktop\adwcleaner.exe

Option : Clean

*** [ Services ] ***

*** [ Files / Folders ] ***

Folder Deleted : C:\Users\User\AppData\Local\Hotspot_Shield
File Deleted : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\c4817zyf.default\.autoreg

*** [ Shortcuts ] ***

*** [ Registry ] ***

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com

*** [ Browsers ] ***

-\\ Internet Explorer v9.0.8112.16470

-\\ Mozilla Firefox v20.0.1 (pt-BR)

[ File : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\c4817zyf.default\prefs.js ]

-\\ Google Chrome v29.0.1547.57

[ File : C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [1567 octets] - [22/08/2013 09:46:05]
AdwCleaner[s0].txt - [1193 octets] - [22/08/2013 09:48:23]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [1253 octets] ##########

-

-

-

-

AdwCleaner v3.000 - Report created 22/08/2013 at 09:53:25

Updated 20/08/2013 by Xplode

Operating System : Windows 7 Ultimate (32 bits)

Username : User - USER-PC

Running from : C:\Users\User\Desktop\adwcleaner.exe

Option : Clean

*** [ Services ] ***

*** [ Files / Folders ] ***

*** [ Shortcuts ] ***

*** [ Registry ] ***

*** [ Browsers ] ***

-\\ Internet Explorer v9.0.8112.16470

-\\ Mozilla Firefox v20.0.1 (pt-BR)

[ File : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\c4817zyf.default\prefs.js ]

*************************

AdwCleaner[R0].txt - [1567 octets] - [22/08/2013 09:46:05]
AdwCleaner[R1].txt - [1176 octets] - [22/08/2013 09:52:45]
AdwCleaner[s0].txt - [1333 octets] - [22/08/2013 09:48:23]
AdwCleaner[s1].txt - [793 octets] - [22/08/2013 09:53:25]

########## EOF - C:\AdwCleaner\AdwCleaner[s1].txt - [852 octets] ##########

-

-

-

-

AdwCleaner v3.000 - Report created 22/08/2013 at 09:58:15

Updated 20/08/2013 by Xplode

Operating System : Windows 7 Ultimate (32 bits)

Username : User - USER-PC

Running from : C:\Users\User\Desktop\adwcleaner.exe

Option : Clean

*** [ Services ] ***

*** [ Files / Folders ] ***

*** [ Shortcuts ] ***

*** [ Registry ] ***

*** [ Browsers ] ***

-\\ Internet Explorer v9.0.8112.16470

-\\ Mozilla Firefox v20.0.1 (pt-BR)

[ File : C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\c4817zyf.default\prefs.js ]

*************************

AdwCleaner[R0].txt - [1567 octets] - [22/08/2013 09:46:05]
AdwCleaner[R1].txt - [1176 octets] - [22/08/2013 09:52:45]
AdwCleaner[R2].txt - [1296 octets] - [22/08/2013 09:57:35]
AdwCleaner[s0].txt - [1333 octets] - [22/08/2013 09:48:23]
AdwCleaner[s1].txt - [931 octets] - [22/08/2013 09:53:25]
AdwCleaner[s2].txt - [912 octets] - [22/08/2013 09:58:15]

########## EOF - C:\AdwCleaner\AdwCleaner[s2].txt - [971 octets] ##########

Olá! alvotarget

Bom trabalho!

Pode executar a DelFix,conforme Post anterior.

Caso queira,poste o log da DelFix.

A+

Olá! DigRam

Aqui está o relatório!

DelFix v10.4 - Logfile created 22/08/2013 at 10:34:58

Updated 19/07/2013 by Xplode

Username : User - USER-PC

Operating System : Windows 7 Ultimate (32 bits)

~ Removing disinfection tools ...

Deleted : C:\ZHP
Deleted : C:\Program Files\ZHPDiag
Deleted : C:\AdwCleaner[R1].txt
Deleted : C:\AdwCleaner[R2].txt
Deleted : C:\PhysicalDisk0_MBR.bin
Deleted : C:\ZHPDiag2.exe
Deleted : C:\zoek-results.log
Deleted : C:\Users\User\Desktop\adwcleaner.exe
Deleted : C:\Users\User\Desktop\AdwCleaner[s3] relatorio ajuda nao sei oq.txt
Deleted : C:\Users\User\Desktop\JRT.exe
Deleted : C:\Users\User\Desktop\JRT.txt
Deleted : C:\Users\User\Desktop\ZHPDiag.txt
Deleted : C:\Users\User\Desktop\ZHPFixReport.txt
Deleted : C:\Users\Public\Desktop\MBRCheck.lnk
Deleted : C:\Users\Public\Desktop\ZHPDiag.lnk
Deleted : C:\Users\Public\Desktop\ZHPFix.lnk
Deleted : C:\Users\User\Downloads\AdwCleaner.exe
Deleted : C:\Users\User\Downloads\HiJackThis.exe
Deleted : HKLM\SOFTWARE\AdwCleaner
Deleted : HKLM\SOFTWARE\TrendMicro\Hijackthis
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1

~ Cleaning system restore ...

Deleted : RP #480 [Removido SPORE™ | 08/17/2013 02:53:30]
Deleted : RP #482 [Removed Grand Theft Auto IV | 08/17/2013 02:58:08]
Deleted : RP #484 [P | 08/18/2013 03:24:56]
Deleted : RP #485 [zoek.exe restore point | 08/19/2013 14:58:17]

New restore point created !

~ Resetting system settings ... OK

########## - EOF - ##########

Bom Dia! alvotarget

Seus logs estão limpos! :yes:

Tudo Ok?

Abs!

Sim, tudo certo! Obrigado!!!

Abraços!

PROBLEMA RESOLVIDO

Caso o autor necessite que o tópico seja reaberto basta enviar uma Mensagem Privada para um Moderador com um link para o tópico.