Olá Rafael.

Baixe o programa Adwcleaner clicando no link abaixo e depois clique no botão Download Now @BleepingComputer:

http://www.bleepingcomputer.com/download/adwcleaner/

Para executar corretamente o AdwCleaner é só seguir as dicas deste tutorial:

Remova adwares e toolbars maliciosas com o Adwcleaner

* Na sua próxima resposta poste o log (relatório) do Adwcleaner que estará em C:\AdwCleaner\AdwCleaner[s0].txt

Ficamos na espera.

Boa noite Power Max,

AdwCleaner v4.202 - Relatório criado 24/04/2015 às 20:48:14

Atualizado 23/04/2015 por Xplode

Base de dados : 2015-04-23.2 [servidor]

Sistema operacional : Windows 8.1 Single Language (x64)

Usuário : Rafael - RAFA-PC

Executando de : C:\Users\Rafael\Desktop\adwcleaner_4.202.exe

Opção : Limpar

*** [ Serviços ] ***

*** [ Arquivos / Pastas ] ***

*** [ Tarefas agendadas ] ***

*** [ Atalhos ] ***

*** [ Registro ] ***

Dados Apagado : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] -

*** [ Navegadores ] ***

-\\ Internet Explorer v11.0.9600.17416

-\\ Google Chrome v42.0.2311.90

*************************

AdwCleaner[R0].txt - [4243 bytes] - [14/04/2015 22:00:50]

AdwCleaner[R1].txt - [993 bytes] - [16/04/2015 22:17:24]

AdwCleaner[R2].txt - [1050 bytes] - [18/04/2015 09:40:12]

AdwCleaner[R3].txt - [1110 bytes] - [21/04/2015 21:43:17]

AdwCleaner[R4].txt - [1230 bytes] - [24/04/2015 20:43:42]

AdwCleaner[R5].txt - [1288 bytes] - [24/04/2015 20:47:31]

AdwCleaner[s0].txt - [4146 bytes] - [14/04/2015 22:02:34]

AdwCleaner[s1].txt - [1165 bytes] - [21/04/2015 21:44:21]

AdwCleaner[s2].txt - [1203 bytes] - [24/04/2015 20:48:14]

########## EOF - C:\AdwCleaner\AdwCleaner[s2].txt - [1262 bytes] ##########

Obrigado!

Oi Rafael, os seus relatórios estão saindo com as linhas todas juntas, o que torna difícil sua leitura. Quando você abrir o relatório no bloco de notas, digite Ctrl + a (para selecionar todo o relatório) e depois disto digite Ctrl + c (para copiar o relatório) e depois disto é só postar o resultado aqui que assim o relatório ficará da forma correta.

_________________________________________________________________________________

Desative temporariamente seu antivírus para evitar conflitos.

* Acesse este link abaixo e clique no primeiro botão da esquerda que é o botão Download Zoek.exe:

http://www.hijackthis.nl/smeenk/

Salve-o no Desktop (Área de Trabalho).

Para executá-lo corretamente siga as dicas deste tutorial:

Exclua adwares e outras ameaças de seu PC e browsers com o aplicativo Zoek

* Assim que ele concluir a limpeza dos problemas acesse o log (relatório) do Zoek que estará em C:\zoek-results.txt e copie todo seu conteúdo e poste em sua próxima resposta.

Boa noite Power Max,

Zoek.exe v5.0.0.0 Updated 23-04-2015

Tool run by Rafael on 26/04/2015 at 22:36:26,76.

Microsoft Windows 8.1 Single Language 6.3.9600 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\Rafael\Desktop\zoek.exe [scan all users] [script inserted]

==== Older Logs ======================

C:\zoek-results2015-04-26-191601.log 1990 bytes

==== System Restore Info ======================

26/04/2015 22:44:30 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

Copyright © 1993-2006 Microsoft Corp.

#

This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

#

This file contains the mappings of IP addresses to host names. Each

entry should be kept on an individual line. The IP address should

be placed in the first column followed by the corresponding host name.

The IP address and the host name should be separated by at least one

space.

#

Additionally, comments (such as these) may be inserted on individual

lines or following the machine name denoted by a '#' symbol.

#

For example:

#

102.54.94.97 rhino.acme.com # source server

38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== Chromium Look ======================

Google Wallet - Casa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

Google Drive - Rafael\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf

YouTube - Rafael\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo

Google Search - Rafael\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf

Bookmark Manager - Rafael\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik

GBBD Guardião - Itaú 30 horas - Rafael\AppData\Local\Google\Chrome\User Data\Default\Extensions\kgmpojlddncminmkddkpoegdjhojjipg

Chrome Hotword Shared Module - Rafael\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg

Google Wallet - Rafael\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

Gmail - Rafael\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== Chromium Startpages ======================

C:\Users\Rafael\AppData\Local\Google\Chrome\User Data\Default\Preferences

"startup_urls": "[https://www.google.com/" ]

==== Set IE to Default ======================

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"

{D7860755-F07F-4E0C-8E10-5FBF636B8CD7} Bing Url="http://www.bing.com/search?q={searchTerms}&form=IE11TR&src=IE11TR&pc=LCJB"

==== Reset Google Chrome ======================

C:\Users\Casa\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully

C:\Users\Casa\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully

C:\Users\Rafael\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully

C:\Users\Rafael\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully

C:\Users\Casa\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

C:\Users\Casa\AppData\Local\Google\Chrome\User Data\Default\Web Data.tmp was reset successfully

C:\Users\Rafael\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

C:\Users\Rafael\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully

==== shortcuts on Users Desktops ======================

C:\Users\Casa\Desktop\Scratch.lnk - C:\Program Files (x86)\Scratch\Scratch.exe "C:\Program Files (x86)\Scratch\Scratch.image"

C:\Users\Rafael\Desktop\HiJackThis.lnk - C:\Users\Rafael\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

C:\Users\Rafael\Desktop\MPC-HC x64.lnk - C:\Program Files\MPC-HC\mpc-hc64.exe

C:\Users\Rafael\Desktop\Perfect World.lnk - C:\Level up\Perfect World\launcher\Launcher.exe

C:\Users\Rafael\Desktop\Scratch.lnk - C:\Program Files (x86)\Scratch\Scratch.exe "C:\Program Files (x86)\Scratch\Scratch.image"

C:\Users\Rafael\Desktop\Spotify.lnk - C:\Users\Rafael\AppData\Roaming\Spotify\Spotify.exe

C:\Users\Rafael\Desktop\µTorrent.lnk -

C:\Users\Rafael\Desktop\Outros\Atalhos\Cyberlink Power2Go.lnk - C:\Program Files (x86)\Lenovo\Power2Go\Power2Go.exe

C:\Users\Rafael\Desktop\Outros\Atalhos\Lenovo Photo Master.lnk - C:\Program Files (x86)\Lenovo\Lenovo Photo Master\PhotoMaster.exe

C:\Users\Rafael\Desktop\Outros\Atalhos\Lenovo PowerDVD 10.lnk - C:\Program Files (x86)\Lenovo\PowerDVD10\PDVDLaunchPolicy.exe

C:\Users\Rafael\Desktop\Outros\Atalhos\Lenovo SHAREit.lnk - C:\Program Files (x86)\Lenovo\SHAREit\Shareit.exe

C:\Users\Rafael\Desktop\Outros\Atalhos\Lenovo Solution Center.lnk - C:\Program Files (x86)\lenovo\Lenovo Solution Center\LSC.exe

C:\Users\Rafael\Desktop\Outros\Atalhos\Lenovo VeriFace.lnk - C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConfig.exe

C:\Users\Rafael\Desktop\Outros\Atalhos\OneKey Recovery.lnk - C:\Program Files\lenovo\OneKey App\OneKey Recovery\OneKey Recovery.exe

==== shortcuts on All Users Desktop ======================

C:\Users\Public\Desktop\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

C:\Users\Public\Desktop\Skype.lnk - C:\WINDOWS\Installer\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}\SkypeIcon.exe

==== shortcuts in Users Start Menu ======================

C:\Users\Casa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk - C:\Users\Rafael\AppData\Local\Pokki\Engine\HostAppService.exe /OPEN"f22abfeae27a67446927d078890381efc546d3e1"

C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk -

C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk - C:\Users\Rafael\AppData\Roaming\Spotify\Spotify.exe

C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows 10 Technical Preview.lnk - C:\WINDOWS\System32\wuauclt.exe /ShowWindowsUpdate

C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GameMaker-Studio 1.4\GameMaker-Studio 1.4 Help.lnk - C:\Users\Rafael\AppData\Roaming\GameMaker-Studio\5pice.chm

C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GameMaker-Studio 1.4\GameMaker-Studio 1.4 License.lnk - C:\WINDOWS\system32\notepad.exe C:\Users\Rafael\AppData\Roaming\GameMaker-Studio\License.txt

C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GameMaker-Studio 1.4\GameMaker-Studio 1.4.lnk - C:\Users\Rafael\GameMaker-Studio 1.4\GameMaker-Studio.exe

C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GameMaker-Studio 1.4\Uninstall.lnk - C:\Users\Rafael\GameMaker-Studio 1.4\uninstall.exe

C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis\HiJackThis.lnk - C:\Users\Rafael\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Level up\Perfect World\Perfect World.lnk - C:\Level up\Perfect World\launcher\Launcher.exe

C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk - C:\Program Files (x86)\WinRAR\Rar.txt

C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk - C:\Program Files (x86)\WinRAR\WinRAR.chm

C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk - C:\Program Files (x86)\WinRAR\WinRAR.exe

==== shortcuts in All Users Start Menu ======================

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brackets.lnk - C:\Program Files (x86)\Brackets\Brackets.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Android Studio\Android Studio.lnk - C:\Program Files\Android\Android Studio\bin\studio64.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GameMaker Player\GameMaker Player License.lnk - C:\WINDOWS\system32\notepad.exe C:\Users\Rafael\GameMakerPlayer\License.txt

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GameMaker Player\GameMaker Player.lnk - C:\Users\Rafael\GameMakerPlayer\GameMakerPlayer.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GameMaker Player\Uninstall.lnk - C:\Users\Rafael\GameMakerPlayer\uninstall.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hightail\Hightail for Lenovo\Hightail for Lenovo.lnk - C:\WINDOWS\Installer\{2F10E937-F6D7-4174-8AB9-B299E8FC5CEC}\NewShortcut1_06677BC67D8B491296B092784A866C89.exe /launch

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\About Java.lnk - C:\Program Files (x86)\Java\jre7\bin\javacpl.exe -tab about

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Check For Updates.lnk - C:\Program Files (x86)\Java\jre7\bin\javacpl.exe -tab update

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Configure Java.lnk - C:\Program Files (x86)\Java\jre7\bin\javacpl.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.lnk -

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.lnk -

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Java Mission Control.lnk - C:\Program Files (x86)\Java\jdk1.7.0_75\bin\jmc.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.lnk -

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Desinstalar Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\unins000.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Malwarebytes Anti-Malware Notifications.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\Chameleon\Windows\chameleon.chm

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\Access 2013.lnk - C:\WINDOWS\Installer\{90150000-0011-0000-1000-0000000FF1CE}\accicons.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\Enviar para o OneNote 2013.lnk - C:\WINDOWS\Installer\{90150000-0011-0000-1000-0000000FF1CE}\joticon.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\Excel 2013.lnk - C:\WINDOWS\Installer\{90150000-0011-0000-1000-0000000FF1CE}\xlicons.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\InfoPath Designer 2013.lnk - C:\WINDOWS\Installer\{90150000-0011-0000-1000-0000000FF1CE}\inficon.exe /design

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\InfoPath Filler 2013.lnk - C:\WINDOWS\Installer\{90150000-0011-0000-1000-0000000FF1CE}\inficon.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\Lync 2013.lnk - C:\WINDOWS\Installer\{90150000-0011-0000-1000-0000000FF1CE}\lyncicon.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\OneNote 2013.lnk - C:\WINDOWS\Installer\{90150000-0011-0000-1000-0000000FF1CE}\joticon.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\Outlook 2013.lnk - C:\WINDOWS\Installer\{90150000-0011-0000-1000-0000000FF1CE}\outicon.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\PowerPoint 2013.lnk - C:\WINDOWS\Installer\{90150000-0011-0000-1000-0000000FF1CE}\pptico.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\Publisher 2013.lnk - C:\WINDOWS\Installer\{90150000-0011-0000-1000-0000000FF1CE}\pubs.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\SkyDrive Pro 2013.lnk - C:\WINDOWS\Installer\{90150000-0011-0000-1000-0000000FF1CE}\grv_icons.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\Word 2013.lnk - C:\WINDOWS\Installer\{90150000-0011-0000-1000-0000000FF1CE}\wordicon.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\Ferramentas do Office 2013\Centro de Carregamento do Office 2013.lnk - C:\WINDOWS\Installer\{90150000-0011-0000-1000-0000000FF1CE}\msouc.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\Ferramentas do Office 2013\Database Compare 2013.lnk - C:\WINDOWS\Installer\{90150000-0011-0000-1000-0000000FF1CE}\dbcicons.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\Ferramentas do Office 2013\Gerenciador de Gravação do Lync.lnk -

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\Ferramentas do Office 2013\Log de Telemetria do Office 2013.lnk - C:\WINDOWS\Installer\{90150000-0011-0000-1000-0000000FF1CE}\osmclienticon.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\Ferramentas do Office 2013\Painel de Telemetria do Office 2013.lnk - C:\WINDOWS\Installer\{90150000-0011-0000-1000-0000000FF1CE}\osmadminicon.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\Ferramentas do Office 2013\Preferências de Idioma do Office 2013.lnk -

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013\Ferramentas do Office 2013\Spreadsheet Compare 2013.lnk - C:\WINDOWS\Installer\{90150000-0011-0000-1000-0000000FF1CE}\sscicons.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC-HC x64\Changelog.lnk - C:\Program Files\MPC-HC\Changelog.txt

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC-HC x64\Desinstalar MPC-HC.lnk - C:\Program Files (x86)\MPC-HC\unins000.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC-HC x64\MPC-HC x64.lnk - C:\Program Files\MPC-HC\mpc-hc64.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Scratch\Scratch Website.lnk -

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Scratch\Scratch.lnk - C:\Program Files (x86)\Scratch\Scratch.exe "C:\Program Files (x86)\Scratch\Scratch.image"

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Scratch\Uninstall Scratch.lnk - C:\Program Files (x86)\Scratch\uninstall.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype\Skype para a área de trabalho.lnk -

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\Console RAR manual.lnk - C:\Program Files (x86)\WinRAR\Rar.txt

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR help.lnk - C:\Program Files (x86)\WinRAR\WinRAR.chm

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR\WinRAR.lnk - C:\Program Files (x86)\WinRAR\WinRAR.exe

==== shortcuts in Quick Launch ======================

C:\Users\Casa\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Users\Casa\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Casa\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -

C:\Users\Casa\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -

C:\Users\Casa\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk -

C:\Users\Casa\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Users\Casa\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Skype.lnk - C:\WINDOWS\Installer\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}\SkypeIcon.exe

C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -

C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -

C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -

C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -

C:\Users\Rafael\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Users\Rafael\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\Rafael\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Outlook.lnk - C:\Program Files (x86)\Microsoft Office\Office15\OUTLOOK.EXE /recycle

C:\Users\Rafael\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -

C:\Users\Rafael\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -

C:\Users\Rafael\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk -

C:\Users\Rafael\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Android Studio Windows Launcher.lnk - C:\Program Files (x86)\Android\Android Studio\bin\studio64.exe

C:\Users\Rafael\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk -

C:\Users\Rafael\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Users\Rafael\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Outlook 2013.lnk - C:\WINDOWS\Installer\{90150000-0011-0000-1000-0000000FF1CE}\outicon.exe

C:\Users\Rafael\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Word 2013.lnk - C:\WINDOWS\Installer\{90150000-0011-0000-1000-0000000FF1CE}\wordicon.exe

C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -

C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -

==== Reset IE Proxy ======================

Value(s) before fix:

"ProxyEnable"=dword:00000000

Value(s) after fix:

"ProxyEnable"=dword:00000000

==== Empty IE Cache ======================

C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

C:\Users\Casa\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\Users\Casa\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully

C:\Users\Rafael\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\Users\Rafael\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully

C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully

C:\Users\Casa\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

C:\Users\Casa\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully

C:\Users\Rafael\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

C:\Users\Rafael\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully

C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\Casa\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

C:\Users\Rafael\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=81 folders=227 808872984 bytes)

==== Empty Temp Folders ======================

C:\Users\Casa\AppData\Local\Temp emptied successfully

C:\Users\Default\AppData\Local\Temp emptied successfully

C:\Users\Default User\AppData\Local\Temp emptied successfully

C:\Users\Rafael\AppData\Local\Temp will be emptied at reboot

C:\Users\USURIO~1\AppData\Local\Temp emptied successfully

C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully

C:\WINDOWS\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully

C:\WINDOWS\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied

C:\Users\Rafael\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 26/04/2015 at 23:01:39,35 ======================

Faça o download do < ZHPDiag > < /applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/NicolasCoolman.jpg&key=31eaca9d787a5cb7b785eaca882cfe95bdd41bfffaf35086b6e7ecf044ef83cf" alt="NicolasCoolman.jpg" />> ( ... de Nicolas Coolman )

Obs: Ao acessar o link acima clique no botão Télécharger referente ao ZHPDiag para baixá-lo, tal como mostra a imagem abaixo:

/applications/core/interface/imageproxy/imageproxy.php?img=http://1.bp.blogspot.com/-XrvMIHU4fq8/U-aZGnLHUMI/AAAAAAAAhog/DrsOUsZ4FKI/s1600/tutorial_do_zhpcleaner_2.jpg&key=62c7d7c7c3f51241c1fb6d310912f8f1f311cf57fe86fb92293eae54f2e92db8" alt="tutorial_do_zhpcleaner_2.jpg" />

Para instalá-lo e executá-lo corretamente siga as dicas deste artigo:

Tutorial de instalação e execução do aplicativo ZHPDiag

* Assim que ele concluir a sua verificação, copie todo o conteúdo do seu relatório ZHPDiag.txt e poste em sua próxima resposta.

_____________________________________________________________________________

Obs: Caso o relatório do ZHPDiag fique muito grande e não couber na sua resposta, acesse o site Cjoint:

http://cjoint.com

Clique no botão Escolher arquivo > Selecione o arquivo do log (relatório) e clique no botão Abrir.

Clique no botão Créer le lien Cjoint

Copie o link que aparecerá ao lado da frase Le lien a été créé e poste este link em sua próxima resposta.

Boa noite Power Max!

~ Relatório do ZHPDiag v2015.4.25.42 - Nicolas Coolman  (25/04/2015)

~ Iniciado por Rafael (27/04/2015 20:56:52)

~ Facebook : https://www.facebook.com/nicolascoolman1

~ Endereço do Webforum : http://forum.nicolascoolman.fr

~ Tradução pelo utilizador

~ Estatuto da versão : Versão atualizada.

~  Lista Branca : Desativado pelo Utilizador

~ Elevação dos Privilégios : OK

~ Controle de Conta de Utilizador : Activate by user

---\\ Navegadores Internet

MSIE: Internet Explorer v11.0.9600.17728

GCIE: Google Chrome v42.0.2311.90 (Defaut)

---\\ Informações sobre os produtos Windows

~ Langage: Portugais

Windows Server License Manager Script : OK

Software Protection Service (Protection logicielle) : OK

Windows Automatic Updates : OK

Windows Activation Technologies : OK

Windows 8.1 Single Language, 64-bit  (Build 9600)

---\\ Softwares de proteçao do sistema

Malwarebytes Anti-Malware versão 2.1.4.1018

Windows Defender W8 (Activate)

---\\ Softwares d'optimização do sistema

---\\ Softwares de partilha do PeerToPeer (P2P)

---\\ Monitoramento dos softwares

Java 7 Update 75 (64-bit)

---\\ Informações sobre o sistema

~ Processor: Intel64 Family 6 Model 69 Stepping 1, GenuineIntel

~ Operating System: 64 Bits

Boot mode: Normal (Normal boot)

Total RAM: 3988 MB (42% free)

System Restore: Activé (Enable)

System drive C: has 800 GB (89%) free of 890 GB

---\\ Modo de conexão ao sistema

~ Computer Name: RAFA-PC

~ User Name: Rafael

~ All Users Names: Rafael, HomeGroupUser$, Convidado, Casa, Administrador,

~ Unselected Option: None

Logged in as Administrator

---\\ As variáveis de ambiente

~ System Unit : C:\

~ %AppZHP% : C:\Users\Rafael\AppData\Roaming\ZHP\

~ %AppData% : C:\Users\Rafael\AppData\Roaming\

~ %Desktop% : C:\Users\Rafael\Desktop\

~ %Favorites% : C:\Users\Rafael\Favorites\

~ %LocalAppData% : C:\Users\Rafael\AppData\Local\

~ %StartMenu% : C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\

~ %Windir% : C:\WINDOWS\

~ %System% : C:\WINDOWS\System32\

---\\ Enumeração das unidades dos discos

C: Hard drive, Flash drive, Thumb drive (Free 800 Go of 890 Go)

D: Hard drive, Flash drive, Thumb drive (Free 23 Go of 25 Go)

E: CD-ROM drive (Not Inserted)

---\\ Estado do Centro de Segurança do Windows

[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK

[HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK

[HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK

[HKLM\SYSTEM\CurrentControlSet\Services\COMSysApp] Type: OK

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install] LastSuccessTime :  OK

~ Security Center: 41 Scanned in 00mn 00s

---\\ Pesquisa particular de ficheiros genéricos

[MD5.C10A66189DC8C090E7C84873EDCEBC88] - (.Microsoft Corporation - Windows Explorer.) (.27/01/2015 - 20:47:12.) -- C:\WINDOWS\Explorer.exe [2501368]

[MD5.A570A64292214C43E0BA50E6A72A6380] - (.Microsoft Corporation - Aplicativo de Inicialização do Windows.) (.28/10/2014 - 22:25:54.) -- C:\WINDOWS\System32\Wininit.exe [145920]

[MD5.77B35D0FC22A2D2EAC8D07C3F9784DBF] - (.Microsoft Corporation - Internet Extensions para Win32.) (.12/03/2015 - 23:45:57.) -- C:\WINDOWS\System32\wininet.dll [2358784]

[MD5.EC498BAE1F0D3E0E401C963F8D76C437] - (.Microsoft Corporation - Aplicativo de Logon do Windows.) (.28/10/2014 - 22:22:52.) -- C:\WINDOWS\System32\Winlogon.exe [572416]

[MD5.AFCAB4DC692CCE37E283B00E2D7B438F] - (.Microsoft Corporation - Biblioteca de Licenciamento de Software.) (.18/03/2014 - 06:54:56.) -- C:\WINDOWS\System32\sppcomapi.dll [447488]

[MD5.374E27295F0A9DCAA8FC96370F9BEEA5] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.30/05/2014 - 00:03:03.) -- C:\WINDOWS\system32\Drivers\AFD.sys [563200]

[MD5.74B14192CF79A72F7536B27CB8814FBD] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.22/08/2013 - 09:43:41.) -- C:\WINDOWS\system32\Drivers\atapi.sys [26464]

[MD5.2FA6510E33F7DEFEC03658B74101A9B9] - (.Microsoft Corporation - CD-ROM File System Driver.) (.22/08/2013 - 08:40:15.) -- C:\WINDOWS\system32\Drivers\Cdfs.sys [88576]

[MD5.C6796EA22B513E3457514D92DCDB1A3D] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.22/08/2013 - 05:46:35.) -- C:\WINDOWS\system32\Drivers\Cdrom.sys [164352]

[MD5.A03F362C5557E238CBFA914689C77248] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.06/03/2014 - 06:22:50.) -- C:\WINDOWS\system32\Drivers\DfsC.sys [134144]

[MD5.D4B7ED39C7900384D9E5C1283F1E7926] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.24/07/2014 - 08:45:39.) -- C:\WINDOWS\system32\Drivers\HDAudBus.sys [76800]

[MD5.D887446F3F6051C60C26F4FD1FC8D43F] - (.Microsoft Corporation - Driver de porta i8042.) (.07/10/2014 - 00:29:50.) -- C:\WINDOWS\system32\Drivers\i8042prt.sys [107520]

[MD5.B7342B3C58E91107F6E946A93D9D4EFD] - (.Microsoft Corporation - IP Network Address Translator.) (.18/03/2014 - 06:54:57.) -- C:\WINDOWS\system32\Drivers\IpNat.sys [142848]

[MD5.31233271EDE50D1BBB220F78AFA60486] - (.Microsoft Corporation - Minirdr SMB do Windows NT.) (.08/10/2014 - 04:32:10.) -- C:\WINDOWS\system32\Drivers\MRxSmb.sys [405504]

[MD5.0217532E19A748F0E5D569307363D5FD] - (.Microsoft Corporation - MBT Transport driver.) (.22/08/2013 - 08:37:02.) -- C:\WINDOWS\system32\Drivers\netBT.sys [282624]

[MD5.7F68063A5A0461E02BC860CE0E6BFDDC] - (.Microsoft Corporation - Driver do Sistema de Arquivos NT.) (.15/10/2014 - 05:32:37.) -- C:\WINDOWS\system32\Drivers\ntfs.sys [2025792]

[MD5.764B1121867B2D9B31C491668AC72B2B] - (.Microsoft Corporation - Driver de porta paralela.) (.22/08/2013 - 08:40:02.) -- C:\WINDOWS\system32\Drivers\Parport.sys [94208]

[MD5.BBB6272B7F46C4640A8CDB8A70C3450F] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.22/08/2013 - 08:35:51.) -- C:\WINDOWS\system32\Drivers\Rasl2tp.sys [120832]

[MD5.680C1DAE268B6FB67FA21B389A8B79EF] - (.Microsoft Corporation - Redirecionador do Dispositivo RDP da Microsoft.) (.18/03/2014 - 06:38:05.) -- C:\WINDOWS\system32\Drivers\rdpdr.sys [195584]

[MD5.FFF28F9F6823EB1756C60F1649560BBF] - (.Microsoft Corporation - TDI Translation Driver.) (.22/08/2013 - 10:25:35.) -- C:\WINDOWS\system32\Drivers\tdx.sys [107520]

[MD5.64CA2B4A49A8EAF495E435623ECCE7DB] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.18/06/2014 - 23:13:36.) -- C:\WINDOWS\system32\Drivers\volsnap.sys [310080]

~ Generic Processes:  Scanned in 00mn 00s

---\\ Estatuto dos ficheiros ocultos (Oculto/Total)

~ Mes images (My Pictures) : 2/6939

~ Mes Favoris (My Favorites) : 1/7

~ Mon Bureau (My Desktop) : 2/16539

~ Menu demarrer (Programs) : 1/34

~ Hidden Files:  Scanned in 00mn 12s

---\\ Processos lançados

[MD5.E74BF46DE94E62FA01C61EF084F7A7DD] - (.Spotify Ltd - SpotifyWebHelper.) -- C:\Users\Rafael\AppData\Roaming\Spotify\SpotifyWebHelper.exe   [2018360] [PID.6356]

[MD5.C049C40CAEE8900130BD5F80B594CC7B] - (.CyberLink Corp. - PowerDVD RC Service.) -- C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe   [95192] [PID.4172]

[MD5.CE9806603D3C635EA6E0BB79FE916D2E] - (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe   [812872] [PID.3448]

[MD5.A5D1786BF5504E396EF5641116382831] - (.Intel Corporation - IAStorIcon.) -- C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe   [287592] [PID.1188]

[MD5.E1EAA6D07F53BC7EBE4E43F8288FA34C] - (.Lenovo - Lenovo Solution Center Notifications.) -- C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe   [1360672] [PID.2776]

[MD5.A7B70CC424CDA9813E0FAA1E6E165D80] - (.Microsoft Corporation - Host WWA Microsoft.) -- C:\WINDOWS\syswow64\wwahost.exe   [626176] [PID.7124]

[MD5.40E3C49CCB0103001590A4966238C758] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe   [8200704] [PID.2020]

~ Processes Running:  Scanned in 00mn 01s

---\\ Google Chrome, Arranque,Pesquisa,Extensões (G0,G1,G2)

C:\Users\Rafael\AppData\Local\Google\Chrome\User Data\Default\Preferences

---\\ Pasta de extensão do Google Chrome

G2 - EXT: C:\Users\Rafael\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [bookmark Manager]

G2 - EXT: C:\Users\Rafael\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [Chrome Hotword Shared Module]

G2 - EXT: C:\Users\Rafael\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [__MSG_APP_NAME__]

~ Google Lines Browser: 6 Scanned in 00mn 00s

---\\ Mozilla Firefox, Plugins,Arranque,Pesquisa,Extensões (P2,M0,M1,M2,M3)

P2 - FPN:Firefox Plugin Navigator . (.Microsoft Corporation - The plugin allows you to have a better experience with Microsoft Lync.) -- C:\Program Files (x86)\Mozilla Firefox\Plugins\npMeetingJoinPluginOC.dll

P2 - FPN: [HKLM] [@java.com/DTPlugin,version=10.75.2] - (.Oracle Corporation - NPRuntime Script Plug-in Library for Java Deploy.) -- C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll

P2 - FPN: [HKLM] [@java.com/JavaPlugin,version=10.75.2] - (.Oracle Corporation - Next Generation Java Plug-in 10.75.2 for Mozilla browsers.) -- C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll

P2 - FPN: [HKLM] [@microsoft.com/SharePoint,version=14.0] - (.Microsoft Corporation - The plugin allows you to have a better experience with Microsoft Share.) -- C:\Program Files\Microsoft Office\Office15\NPSPWRAP.dll

P2 - FPN: [HKCU] [gastecnologia.com.br/sf/uni] - (.GAS Tecnologia - Internet Banking Helper.) -- C:\Users\Rafael\AppData\Local\GAS Tecnologia\GBBD\npsf_uni.dll

~ Firefox Browser: 6 Scanned in 00mn 00s

---\\ Internet Explorer, Arranque, Pesquisa, URLSearchHook( gancho de URL), Phishing (R0,R1,R3,R4)

R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com

R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

R0 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com

R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lenovo13.msn.com

R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com

R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com

R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons

R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk

R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com

R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com

R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com

R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com

R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons

R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk

R3 - URLSearchHook: Microsoft Url Search Hook [64Bits] - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Navegador da Internet.) (11.00.9600.17728 (winblue_r9.150312-1720)) -- C:\Windows\SysWOW64\ieframe.dll

~ IE Browser: 16 Scanned in 00mn 00s

---\\ Internet Explorer, Gestão do Proxy (R5)

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll

~ Proxy management:  Scanned in 00mn 00s

---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas

F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,

F2 - REG:system.ini: Shell=C:\WINDOWS\explorer.exe

F2 - REG:system.ini: VMApplet=C:\WINDOWS\System32\SystemPropertiesPerformance.exe

~ Keys:  Scanned in 00mn 00s

---\\ Redireção do ficheiro Hosts (01)

~ Le fichier hôte est sain (The hosts file is clean) (19)

~ Hosts File:  Scanned in 00mn 00s

---\\ Browser Helper Objects do navegador (02)

O2 - BHO: Lync Click to Call BHO [64Bits] - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} . (.Microsoft Corporation - Microsoft Lync.) -- C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll

O2 - BHO: URLRedirectionBHO [64Bits] - {B4F3A835-0E21-4959-BA22-42B3008E02FF} . (.Microsoft Corporation - Microsoft Office Document Cache Handler.) -- C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.dll

O2 - BHO: G-Buster Browser Defense Itaú Unibanco [64Bits] - {C41A1C0E-EA6C-11D4-B1B8-444553540008} . (.Banco Itaú Unibanco - Gbieh Module.) -- C:\Program Files (x86)\GbPlugin\gbiehuni.dll

O2 - BHO: Microsoft SkyDrive Pro Browser Helper [64Bits] - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} . (.Microsoft Corporation - Microsoft SkyDrive Pro Extensions.) -- C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.dll  =>.Microsoft Corporation

O2 - BHO: (no name) [64Bits] - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} Chave orfã

O2 - BHO: (no name) [64Bits] - {DBC80044-A445-435b-BC74-9C25C1C588A9} Chave orfã

~ BHO: 9 Scanned in 00mn 00s

---\\ Outras conexões do utilizador (04)

O4 - GS\QuickLaunch [Rafael]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.)  -- C:\Users\Rafael\AppData\Roaming\uTorrent\uTorrent.exe   =>P2P.BitTorrent

O4 - GS\Desktop [Rafael]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.)  -- C:\Users\Rafael\AppData\Roaming\uTorrent\uTorrent.exe   =>P2P.BitTorrent

~ Global Startup: 2 Scanned in 00mn 12s

---\\ Aplicações iniciadas por registo & pastas (04)

O4 - HKLM\..\Run: [igfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [iAStorIcon] . (.Intel Corporation - Delayed launcher.) -- C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIconLaunch.exe

O4 - HKLM\..\Run: [cAudioFilterAgent] . (.Conexant Systems, Inc. - Conexant High Definition Audio Filter Agent.) -- C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe

O4 - HKLM\..\Run: [ForteConfig] . (.No owner - FMAPP Application.) -- C:\Program Files\Conexant\ForteConfig\fmapp.exe

O4 - HKLM\..\Run: [smartAudio] . (.Conexant Systems, Inc. - SmartAudio CPL (32bit).) -- C:\Program Files\CONEXANT\SAII\SACpl.exe

O4 - HKLM\..\Run: [ETDCtrl] C:\Program Files (x86)\Elantech\ETDCtrl.exe (.not file.)

O4 - HKLM\..\Run: [RtsFT] . (.Realtek semiconductor - RTFTrack.) -- C:\WINDOWS\RTFTrack.exe

O4 - HKLM\..\Run: [Energy Manager] . (.Lenovo(beijing) Limited - Lenovo Energy Manager.) -- C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe

O4 - HKLM\..\Run: [Lenovo Utility] . (.Lenovo(beijing) Limited - Lenovo Utility.) -- C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe

O4 - HKLM\..\Run: [Diebold - Warsaw] . (.GAS Tecnologia LTDA - GAS Tecnologia - Core.) -- C:\Program Files\Diebold\Warsaw\core.exe

O4 - HKCU\..\Run: [Akamai NetSession Interface] C:\Users\Rafael\AppData\Local\Akamai\netsession_win.exe (.not file.)

O4 - HKCU\..\Run: [GoogleChromeAutoLaunch_624A76E5D876DF68D809BD3DD31AB481] . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

O4 - HKCU\..\Run: [uTorrent] . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Rafael\AppData\Roaming\uTorrent\uTorrent.exe   =>P2P.BitTorrent

O4 - HKCU\..\Run: [spotify Web Helper] . (.Spotify Ltd - SpotifyWebHelper.) -- C:\Users\Rafael\AppData\Roaming\Spotify\SpotifyWebHelper.exe

O4 - HKCU\..\Run: [spotify] . (.Spotify Ltd - Spotify.) -- C:\Users\Rafael\AppData\Roaming\Spotify\Spotify.exe

O4 - HKLM\..\Wow6432Node\Run: [updateP2GShortCut] . (.CyberLink Corp. - MUI StartMenu Application.) -- C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe

O4 - HKLM\..\policies\Explorer\Run: [btvStack] . (.Atheros Communications - Bluetooth Stack Server.) -- C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe

O4 - HKUS\.DEFAULT\..\RunOnce: [WuAppAutoScan] . (.Microsoft Corporation - Processador de comandos do Windows.) -- C:\WINDOWS\system32\cmd.exe

O4 - HKUS\S-1-5-18\..\RunOnce: [WuAppAutoScan] . (.Microsoft Corporation - Processador de comandos do Windows.) -- C:\WINDOWS\system32\cmd.exe

O4 - HKUS\S-1-5-21-2734537285-1118194405-70246814-1001\..\Run: [Akamai NetSession Interface] C:\Users\Rafael\AppData\Local\Akamai\netsession_win.exe (.not file.)

O4 - HKUS\S-1-5-21-2734537285-1118194405-70246814-1001\..\Run: [GoogleChromeAutoLaunch_624A76E5D876DF68D809BD3DD31AB481] . (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

O4 - HKUS\S-1-5-21-2734537285-1118194405-70246814-1001\..\Run: [uTorrent] . (.BitTorrent Inc. - µTorrent.) -- C:\Users\Rafael\AppData\Roaming\uTorrent\uTorrent.exe   =>P2P.BitTorrent

O4 - HKUS\S-1-5-21-2734537285-1118194405-70246814-1001\..\Run: [spotify Web Helper] . (.Spotify Ltd - SpotifyWebHelper.) -- C:\Users\Rafael\AppData\Roaming\Spotify\SpotifyWebHelper.exe

O4 - HKUS\S-1-5-21-2734537285-1118194405-70246814-1001\..\Run: [spotify] . (.Spotify Ltd - Spotify.) -- C:\Users\Rafael\AppData\Roaming\Spotify\Spotify.exe

~ Application:  Scanned in 00mn 01s

---\\ Icones das opções IE invisiveis no painel das configurações (05)

O5 - control.ini: [HKLM\..\Control Panel] inetcpl.cpl=no

~ IE Control Panel: 1 Scanned in 00mn 00s

---\\ Boutões da barra de ferramentas principal do Internet Explorer (09)

O9 - Extra button: &Enviar para o OneNote [64Bits] - {2670000A-7350-4f3c-8081-5663EE0C6C49} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\MICROS~1\Office15\ONBttnIE.dll  =>.Microsoft Corporation

O9 - Extra button: Clique para Telefonar do Lync [64Bits] - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} . (.Microsoft Corporation - Microsoft Lync.) -- C:\Program Files\Microsoft Office\Office15\lync.exe

O9 - Extra button: &Anotações Vinculadas do OneNote [64Bits] - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} . (.Microsoft Corporation - Microsoft OneNote Internet Explorer Add-in.) -- C:\Program Files (x86)\MICROS~1\Office15\ONBTTN~1.dll  =>.Microsoft Corporation

~ IE Extra Buttons:  Scanned in 00mn 00s

---\\ Winsock hijacker (Layered Service Provider) (O10)

O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Provedor de Correção de Nomeação de Emails.) -- C:\WINDOWS\system32\napinsp.dll

O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - PNRP Name Space Provider.) -- C:\WINDOWS\system32\pnrpnsp.dll

O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - PNRP Name Space Provider.) -- C:\WINDOWS\system32\pnrpnsp.dll

O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - Network Location Awareness 2.) -- C:\WINDOWS\system32\NLAapi.dll

O10 - WLSP:\000000000005\Winsock LSP File . (.Microsoft Corporation - Provedor de serviços do Microsoft Windows Sockets 2.0.) -- C:\WINDOWS\system32\mswsock.dll

O10 - WLSP:\000000000006\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\WINDOWS\system32\winrnr.dll

O10 - WLSP:\000000000007\Winsock LSP File . (.Microsoft Corporation - Windows Sockets Helper DLL.) -- C:\WINDOWS\system32\wshbth.dll

~ Winsock: 7 Scanned in 00mn 00s

---\\ Site na zona confiavél do Internet Explorer (05)

O15 - Trusted Zone: [HKCU\...\Domains] http.aeriagames.com

O15 - Trusted Zone: [HKCU\...\Domains\www] http.itau.com.br

O15 - Trusted Zone: [HKCU\...\Domains\www] http.itaupersonnalite.com.br

~ IE Zone Confiance:  Scanned in 00mn 00s

---\\ Alteração Dominio/Clientes DNS (017)

O17 - HKLM\System\CCS\Services\Tcpip\..\{7B0F18AE-0EAD-4BBD-8BDF-69B524E65D37}: DhcpNameServer = 201.6.2.178 201.6.2.88

O17 - HKLM\System\CCS\Services\Tcpip\..\{C353D7EC-7A78-40B6-945F-19EAAE511E3B}: DhcpNameServer = 185.61.149.230 8.8.8.8

O17 - HKLM\System\CS1\Services\Tcpip\..\{7B0F18AE-0EAD-4BBD-8BDF-69B524E65D37}: DhcpNameServer = 201.6.2.178 201.6.2.88

O17 - HKLM\System\CS1\Services\Tcpip\..\{C353D7EC-7A78-40B6-945F-19EAAE511E3B}: DhcpNameServer = 185.61.149.230 8.8.8.8

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 185.61.149.230 8.8.8.8

~ Domain:  Scanned in 00mn 00s

---\\ Protocolo adicional (018)

O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visualizador de HTML da Microsoft ®.) -- C:\Windows\System32\mshtml.dll

O18 - Filter: text/xml [64Bits] - {807583E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.dll  =>.Microsoft Corporation

~ Protocole Additionnel:  Scanned in 00mn 00s

---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20)

O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\WINDOWS\System32\igfxdev.dll

~ Winlogon:  Scanned in 00mn 00s

---\\ Chave do Registo autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

~ SSODL: 1 Scanned in 00mn 00s

---\\ Lista dos serviços NT não Microsoft e não desativados (023)

O23 - Service: AtherosSvc (AtherosSvc) . (.Windows ® Win 7 DDK provider - Windows Setup API.) - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe

O23 - Service: C:\WINDOWS\system32\CxAudMsg64.exe (CxAudMsg) . (.Conexant Systems Inc. - Conexant Audio Message Service.) - C:\WINDOWS\system32\CxAudMsg64.exe

O23 - Service: Elan Service (ETDService) . (.ELAN Microelectronics Corp. - Elan Service.) - C:\Program Files\Elantech\ETDService.exe

O23 - Service: Gbp Service (GbpSv) . (.GAS Tecnologia - G-Buster Browser Defense - Service.) - C:\Program Files (x86)\GbPlugin\gbpsv.exe

O23 - Service: Serviço do Google Update (gupdate) (gupdate) . (.Google Inc. - Google Installer.) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) . (.Intel Corporation - IAStorDataSvc.) - C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

O23 - Service: Intel® Capability Licensing Service Interface (Intel® Capability Licensing Service Interface) . (.Intel® Corporation - Intel® Capability Licensing Service Inter.) - C:\Program Files\Intel\iCLS Client\HeciServer.exe

O23 - Service: Intel® Dynamic Application Loader Host Interface Service (jhi_service) . (.Intel Corporation - Intel® Dynamic Application Loader Host In.) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

O23 - Service: Lenovo System Agent Service (Lenovo System Agent Service) . (.LENOVO INCORPORATED. - Lenovo System Agent Service.) - C:\Program Files\Lenovo\iMController\SystemAgentService.exe

O23 - Service: Lenovo WiFiHotspot Service (LenovoWiFiHotspotSvr) . (.Lenovo(beijing) Limited - Lenovo WiFiHotspot.) - C:\Windows\System32\LenovoWiFiHotspotSvr.exe

O23 - Service: Intel® Management and Security Application Local Manageme (LMS) . (.Intel Corporation - Intel® Local Management Service.) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

O23 - Service:  (MBAMScheduler) . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

O23 - Service:  (MBAMService) . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

O23 - Service: Cyberlink RichVideo64 Service(CRVS) (RichVideo64) . (.No owner - RichVideo Module.) - C:\Program Files\CyberLink\Shared files\RichVideo64.exe

O23 - Service: Conexant SmartAudio service (SAService) . (.Conexant Systems, Inc. - SmartAudio Service Application.) - C:\WINDOWS\SysWOW64\SAsrv.exe

O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files (x86)\Skype\Updater\Updater.exe

O23 - Service: VeriFaceSrv (VeriFaceSrv) . (...) - C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe

O23 - Service: Warsaw Technology (Warsaw Technology) . (.GAS Tecnologia LTDA - GAS Tecnologia - Core.) - C:\Program Files\Diebold\Warsaw\core.exe

O23 - Service: ZAtheros Bt and Wlan Coex Agent (ZAtheros Bt and Wlan Coex Agent) . (.Atheros - Atheros Coex Service Application.) - C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe

~ Services: 19 Scanned in 00mn 05s

---\\ Enumeração Ativa do Ambiente de trabalho & Editor MHTML (024)

O24 - Default MHTML Editor: Last - .(...) -  (.not file.)

~ Desktop Component: 4 Scanned in 00mn 00s

---\\ Listagem dos dados do BootExecute (Bex) (034)

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

~ BEX: 1 Scanned in 00mn 00s

---\\ Tarefas planificadas automaticamente (039)

[MD5.F172AD4E906D97ED8F071896FC6789DC] [APT] [GoogleUpdateTaskMachineCore] (.Google Inc..) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe   [107912]

[MD5.F172AD4E906D97ED8F071896FC6789DC] [APT] [GoogleUpdateTaskMachineUA] (.Google Inc..) -- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe   [107912]

[MD5.C049C40CAEE8900130BD5F80B594CC7B] [APT] [PDVDServ Task] (.CyberLink Corp..) -- C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe   [95192]

[MD5.0F6730A4B5D4D97DF89C40321D31B204] [APT] [Dependency Package Auto Update] (...) -- C:\Program Files\Lenovo\iMController\AutoUpdate.exe   [33536]

[MD5.46837220233C6C852C95D7471381C0E0] [APT] [LSCHardwareScan] (...) -- C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe   [148768]

O39 - APT: GoogleUpdateTaskMachineCore - (.Google Inc..) -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job   [1088]

O39 - APT: GoogleUpdateTaskMachineCore - (.Google Inc..) -- C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore   [1088]

O39 - APT: GoogleUpdateTaskMachineUA - (.Google Inc..) -- C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job   [1092]

O39 - APT: GoogleUpdateTaskMachineUA - (.Google Inc..) -- C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA   [1092]

~ Scheduled Task: 8 Scanned in 00mn 04s

---\\ Componentes instalados (ActiveSetup Installed Components) (040)

O40 - ASIC: Microsoft Windows Media Player [64Bits] - >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} . (.Microsoft Corporation - Recursos do Windows Media Player.) -- C:\WINDOWS\System32\wmploc.dll  =>.Microsoft Corporation

O40 - ASIC: Microsoft Windows Media Player 12.0 [64Bits] - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} . (.Microsoft Corporation - Windows Media Player Extension.) -- C:\Windows\SysWOW64\wmpdxm.dll  =>.Microsoft Corporation

O40 - ASIC: Themes Setup [64Bits] - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} . (.Microsoft Corporation - API de tema do Windows.) -- C:\WINDOWS\System32\themeui.dll

O40 - ASIC: Microsoft Windows [64Bits] - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} . (.Microsoft Corporation - Windows Mail.) -- C:\Program Files (x86)\Windows Mail\WinMail.exe  =>.Microsoft Corporation

O40 - ASIC: Browsing Enhancements [64Bits] - {630b1da0-b465-11d1-9948-00c04f98bbc9} . (.Microsoft Corporation - Extensão shell da pasta FTP do Microsoft Internet Explorer.) -- C:\WINDOWS\System32\msieftp.dll

O40 - ASIC: Microsoft Windows Media Player [64Bits] - {6BF52A52-394A-11d3-B153-00C04F79FAA6} . (.Microsoft Corporation - Recursos do Windows Media Player.) -- C:\WINDOWS\System32\wmploc.dll  =>.Microsoft Corporation

O40 - ASIC: Disable SSL3 [64Bits] - {7D715857-A67C-4C2F-A929-038448584D63} . (.Microsoft Corporation - Utilitário de Inicialização por Usuário do Internet Explorer.) -- C:\WINDOWS\System32\ie4uinit.exe

O40 - ASIC: Windows Desktop Update [64Bits] - {89820200-ECBD-11cf-8B85-00AA005B4340} . (.Microsoft Corporation - DLL comum do Shell do Windows.) -- C:\WINDOWS\System32\shell32.dll

O40 - ASIC: Web Platform Customizations [64Bits] - {89820200-ECBD-11cf-8B85-00AA005B4383} . (.Microsoft Corporation - Utilitário de Inicialização por Usuário do Internet Explorer.) -- C:\Windows\System32\ie4uinit.exe

O40 - ASIC: (no name) [64Bits] - {89B4C1CD-B018-4511-B0A1-5476DBF70820} . (.Microsoft Corporation - Microsoft .NET IE SECURITY REGISTRATION.) -- C:\Windows\System32\mscories.dll

~ Active Setup: 10 Scanned in 00mn 00s

---\\ Drivers lançados ao arranque do sistema (041)

O41 - Driver: C:\WINDOWS\System32\drivers\afd.sys (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\WINDOWS\system32\drivers\afd.sys

O41 - Driver: C:\WINDOWS\System32\drivers\ahcache.sys (ahcache) . (.Microsoft Corporation - Application Compatibility Cache.) - C:\WINDOWS\System32\DRIVERS\ahcache.sys

O41 - Driver: (BasicDisplay) . (.Microsoft Corporation - Microsoft Basic Display Driver.) - C:\WINDOWS\system32\drivers\BasicDisplay.sys

O41 - Driver: (BasicRender) . (.Microsoft Corporation - Microsoft Basic Render Driver.) - C:\WINDOWS\system32\drivers\BasicRender.sys

O41 - Driver: cdrom.inf (cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\WINDOWS\system32\drivers\cdrom.sys

O41 - Driver: C:\WINDOWS\System32\drivers\dam.sys (dam) . (.Microsoft Corporation - DAM Kernel Driver.) - C:\WINDOWS\System32\drivers\dam.sys

O41 - Driver: C:\WINDOWS\System32\wkssvc.dll (Dfsc) . (.Microsoft Corporation - DFS Namespace Client Driver.) - C:\WINDOWS\System32\Drivers\dfsc.sys

O41 - Driver: mssmbios.inf (mssmbios) . (.Microsoft Corporation - System Management BIOS Driver.) - C:\WINDOWS\system32\drivers\mssmbios.sys

O41 - Driver: netnb.inf (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\WINDOWS\System32\DRIVERS\netbios.sys

O41 - Driver: C:\WINDOWS\System32\drivers\netbt.sys (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\WINDOWS\System32\DRIVERS\netbt.sys

O41 - Driver: npsvctrig.inf (npsvctrig) . (.Microsoft Corporation - Named pipe service triggers.) - C:\WINDOWS\system32\drivers\npsvctrig.sys

O41 - Driver: C:\WINDOWS\System32\drivers\nsiproxy.sys (nsiproxy) . (.Microsoft Corporation - NSI Proxy.) - C:\WINDOWS\System32\drivers\nsiproxy.sys

O41 - Driver: C:\WINDOWS\System32\drivers\pacer.sys (Psched) . (.Microsoft Corporation - Agendador de pacotes de serviço.) - C:\WINDOWS\system32\DRIVERS\pacer.sys

O41 - Driver: C:\WINDOWS\System32\wkssvc.dll (rdbss) . (.Microsoft Corporation - Driver do Subsistema de Buffer da Unidade R.) - C:\WINDOWS\System32\DRIVERS\rdbss.sys

O41 - Driver: C:\WINDOWS\System32\tcpipcfg.dll (tdx) . (.Microsoft Corporation - TDI Translation Driver.) - C:\WINDOWS\system32\DRIVERS\tdx.sys

O41 - Driver: C:\WINDOWS\System32\drivers\vwififlt.sys (vwififlt) . (.Microsoft Corporation - Virtual WiFi Filter Driver.) - C:\WINDOWS\system32\DRIVERS\vwififlt.sys

~ Drivers: 32 Scanned in 00mn 00s

---\\ Software instalados (042)

O42 - Logiciel: Adobe AIR - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- Adobe AIR

O42 - Logiciel: Adobe AIR - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- {7B77622E-DE90-48EA-B2C7-227B1DE58A01}

O42 - Logiciel: Android Studio - (.Google Inc..) [HKLM][64Bits] -- Android Studio

O42 - Logiciel: Brackets - (.brackets.io.) [HKLM][64Bits] -- {63483A49-735F-4F9E-8E4C-30C29858CE60}

O42 - Logiciel: Conexant HD Audio - (.Conexant.) [HKLM][64Bits] -- CNXT_AUDIO_HDA

O42 - Logiciel: CyberLink MediaStory - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{55762F9A-FCE3-45d5-817B-051218658423}

O42 - Logiciel: CyberLink MediaStory - (.CyberLink Corp..) [HKLM][64Bits] -- {55762F9A-FCE3-45d5-817B-051218658423}

O42 - Logiciel: CyberLink PowerDirector 10 - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}

O42 - Logiciel: CyberLink PowerDirector 10 - (.Nome de sua empresa:.) [HKLM][64Bits] -- {B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}

O42 - Logiciel: Dependency Package Update - (.Lenovo Inc..) [HKLM][64Bits] -- {0788641D-D31A-478D-BB34-C41564AE9F93}

O42 - Logiciel: Dependency Package Update - (.Lenovo Inc..) [HKLM][64Bits] -- {5252431C-288E-409D-ADCF-24407E0E6F70}

O42 - Logiciel: Dependency Package Update - (.Lenovo Inc..) [HKLM][64Bits] -- {FFED38DF-94DC-4FF9-96C1-A6990EDA6B03}

O42 - Logiciel: Dolby Digital Plus Advanced Audio - (.Dolby Laboratories Inc.) [HKLM][64Bits] -- {B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}

O42 - Logiciel: Energy Manager - (.Lenovo.) [HKLM][64Bits] -- InstallShield_{AC768037-7079-4658-AC24-2897650E0ABE}

O42 - Logiciel: Energy Manager - (.Lenovo.) [HKLM][64Bits] -- {AC768037-7079-4658-AC24-2897650E0ABE}

O42 - Logiciel: GameMaker-Studio 1.4 - (.YoYo Games Ltd..) [HKCU][64Bits] -- GameMaker-Studio14

O42 - Logiciel: GameMaker: Player - (.YoYo Games Ltd..) [HKLM][64Bits] -- GameMakerPlayer

O42 - Logiciel: Google Chrome - (.Google Inc..) [HKLM][64Bits] -- Google Chrome

O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM][64Bits] -- {60EC980A-BDA2-4CB6-A427-B07A5498B4CA}

O42 - Logiciel: Google Update Helper - (.Google Inc..) [HKLM][64Bits] -- {A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}

O42 - Logiciel: Guardião - Itaú 30 horas - (...) [HKLM][64Bits] -- {70e5f739-1d2a-40ae-bbc9-4b3e6af4c831}_is1

O42 - Logiciel: Hightail for Lenovo - (.Hightail, Inc..) [HKLM][64Bits] -- {2F10E937-F6D7-4174-8AB9-B299E8FC5CEC}

O42 - Logiciel: Intel® Management Engine Components - (.Intel Corporation.) [HKLM][64Bits] -- {65153EA5-8B6E-43B6-857B-C6E4FC25798A}

O42 - Logiciel: Intel® Processor Graphics - (.Intel Corporation.) [HKLM][64Bits] -- {F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}

O42 - Logiciel: Intel® Rapid Storage Technology - (.Intel Corporation.) [HKLM][64Bits] -- {409CB30E-E457-4008-9B1A-ED1B9EA21140}

O42 - Logiciel: Intel® Rapid Storage Technology - (.Intel Corporation.) [HKLM][64Bits] -- {DB4DA836-82EC-4A96-A6A1-52B39AD19C14}

O42 - Logiciel: Intel® Trusted Connect Service Client - (.Intel Corporation.) [HKLM][64Bits] -- {B5E06417-A4AC-4225-B36E-7E34C91616E7}

O42 - Logiciel: Java 7 Update 75 (64-bit) - (.Oracle.) [HKLM][64Bits] -- {26A24AE4-039D-4CA4-87B4-2F06417075FF}

O42 - Logiciel: Java SE Development Kit 7 Update 75 (64-bit) - (.Oracle.) [HKLM][64Bits] -- {64A3A4F4-B792-11D6-A78A-00B0D0170750}

O42 - Logiciel: Lenovo Dependency Package - (.Lenovo Group Limited.) [HKLM][64Bits] -- Lenovo Dependency Package_is1

O42 - Logiciel: Lenovo EasyCamera - (.Realtek Semiconductor Corp..) [HKLM][64Bits] -- {E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}

O42 - Logiciel: Lenovo FusionEngine  - (.Lenovo, Inc..) [HKLM][64Bits] -- Lenovo FusionEngine

O42 - Logiciel: Lenovo Mobile Phone Wireless Import - (.Lenovo.) [HKLM][64Bits] -- InstallShield_{DFB2E0D6-8DDE-49A4-B8F7-03C14DACCBA6}

O42 - Logiciel: Lenovo Mobile Phone Wireless Import - (.Lenovo.) [HKLM][64Bits] -- {DFB2E0D6-8DDE-49A4-B8F7-03C14DACCBA6}

O42 - Logiciel: Lenovo OneKey Recovery - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}

O42 - Logiciel: Lenovo OneKey Recovery - (.CyberLink Corp..) [HKLM][64Bits] -- {46F4D124-20E5-4D12-BE52-EC177A7A4B42}

O42 - Logiciel: Lenovo Photo Master - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{BC94C56A-3649-420C-8756-2ADEBE399D33}

O42 - Logiciel: Lenovo Photo Master - (.CyberLink Corp..) [HKLM][64Bits] -- {BC94C56A-3649-420C-8756-2ADEBE399D33}

O42 - Logiciel: Lenovo PowerDVD10 - (.CyberLink Corp..) [HKLM][64Bits] -- InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}

O42 - Logiciel: Lenovo PowerDVD10 - (.CyberLink Corp..) [HKLM][64Bits] -- {DEC235ED-58A4-4517-A278-C41E8DAEAB3B}

O42 - Logiciel: Lenovo SHAREit - (.Lenovo Group Limited.) [HKLM][64Bits] -- Lenovo SHAREit_is1

O42 - Logiciel: Lenovo Solution Center - (.Lenovo Group Limited.) [HKLM][64Bits] -- {4C2B6F96-3AED-4E3F-8DCE-917863D1E6B1}

O42 - Logiciel: Lenovo VeriFace - (.Lenovo.) [HKLM][64Bits] -- Lenovo VeriFace

O42 - Logiciel: Lenovo pointing device - (.ELAN Microelectronic Corp..) [HKLM][64Bits] -- Elantech

O42 - Logiciel: MPC-HC 1.7.8 (64-bit) - (.MPC-HC Team.) [HKLM][64Bits] -- {2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1

O42 - Logiciel: Malwarebytes Anti-Malware versão 2.1.4.1018 - (.Malwarebytes Corporation.) [HKLM][64Bits] -- Malwarebytes Anti-Malware_is1

O42 - Logiciel: Manuais do usuário - (.Lenovo.) [HKLM][64Bits] -- {F07C2CF8-4C53-4EC3-8162-A6221E36EB88}

O42 - Logiciel: Metric Collection SDK 35 - (.Lenovo Group Limited.) [HKLM][64Bits] -- {C2B5B5B0-2545-4E94-B4BA-548D4BF0B196}

O42 - Logiciel: Microsoft Access MUI (Portuguese (Brazil)) 2013 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90150000-0015-0416-1000-0000000FF1CE}

O42 - Logiciel: Microsoft DCF MUI (Portuguese (Brazil)) 2013 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90150000-0090-0416-1000-0000000FF1CE}

O42 - Logiciel: Microsoft Excel MUI (Portuguese (Brazil)) 2013 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90150000-0016-0416-1000-0000000FF1CE}

O42 - Logiciel: Microsoft Groove MUI (Portuguese (Brazil)) 2013 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90150000-00BA-0416-1000-0000000FF1CE}

O42 - Logiciel: Microsoft InfoPath MUI (Portuguese (Brazil)) 2013 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90150000-0044-0416-1000-0000000FF1CE}

O42 - Logiciel: Microsoft Lync MUI (Portuguese (Brazil)) 2013 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90150000-012B-0416-1000-0000000FF1CE}

O42 - Logiciel: Microsoft OneDrive - (.Microsoft Corporation.) [HKCU][64Bits] -- OneDriveSetup.exe

O42 - Logiciel: Microsoft OneNote MUI (Portuguese (Brazil)) 2013 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90150000-00A1-0416-1000-0000000FF1CE}  =>.Microsoft Corporation

O42 - Logiciel: Microsoft Outlook MUI (Portuguese (Brazil)) 2013 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90150000-001A-0416-1000-0000000FF1CE}

O42 - Logiciel: Microsoft PowerPoint MUI (Portuguese (Brazil)) 2013 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90150000-0018-0416-1000-0000000FF1CE}

O42 - Logiciel: Microsoft Publisher MUI (Portuguese (Brazil)) 2013 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90150000-0019-0416-1000-0000000FF1CE}

O42 - Logiciel: Microsoft Word MUI (Portuguese (Brazil)) 2013 - (.Microsoft Corporation.) [HKLM][64Bits] -- {90150000-001B-0416-1000-0000000FF1CE}

O42 - Logiciel: Pacote de Driver do Windows - Lenovo (ACPIVPC) System  (02/17/2013 9.52.0.7 - (.Lenovo.) [HKLM][64Bits] -- 35DD26BE48DAF4A9F35F969F3CB1E3E1435E661E

O42 - Logiciel: Pacote de Driver do Windows - Lenovo (WUDFRd) LenovoVhid  (07/25/2013 10.30 - (.Lenovo.) [HKLM][64Bits] -- 6BCA401E9CBEED970D75F55FA5320F60D11984E9

O42 - Logiciel: Power2Go - (.CyberLink Corp..) [HKLM][64Bits] -- {40BF1E83-20EB-11D8-97C5-0009C5020658}

O42 - Logiciel: Qualcomm Atheros Bluetooth Suite (64) - (.Qualcomm Atheros Communications.) [HKLM][64Bits] -- {A84A4FB1-D703-48DB-89E0-68B6499D2801}

O42 - Logiciel: Qualcomm Atheros Client Installation Program - (.Qualcomm Atheros.) [HKLM][64Bits] -- {28006915-2739-4EBE-B5E8-49B25D32EB33}

O42 - Logiciel: Realtek Card Reader - (.Realtek Semiconductor Corp..) [HKLM][64Bits] -- {5BC2B5AB-80DE-4E83-B8CF-426902051D0A}

O42 - Logiciel: Realtek Ethernet Controller Driver - (.Realtek.) [HKLM][64Bits] -- {8833FFB6-5B0C-4764-81AA-06DFEED9A476}

O42 - Logiciel: Scratch - (.MIT Media Lab Lifelong Kindergarten Group.) [HKLM][64Bits] -- Scratch

O42 - Logiciel: Skype™ 7.1 - (.Skype Technologies S.A..) [HKLM][64Bits] -- {24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}

O42 - Logiciel: Spotify - (.Spotify AB.) [HKCU][64Bits] -- Spotify

O42 - Logiciel: User Manuals - (.Lenovo.) [HKLM][64Bits] -- InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}

O42 - Logiciel: Warsaw 1.5.2.9896 64 bits - (.GAS Tecnologia.) [HKLM][64Bits] -- {20E60725-16C8-4FB9-8BC2-AF92C5F8D06D}_is1

O42 - Logiciel: WinRAR 4.10 beta 2 (64-bit) - (.win.rar GmbH.) [HKLM][64Bits] -- WinRAR archiver

O42 - Logiciel: µTorrent - (.BitTorrent Inc..) [HKCU][64Bits] -- uTorrent  =>P2P.BitTorrent

~ Logic: 53 Scanned in 00mn 00s

---\\ HKCU & HKLM Software Keys

[HKCU\Software\5tudio]

[HKCU\Software\Aeria Games]

[HKCU\Software\AppDataLow\Software\JavaSoft]

[HKCU\Software\AppDataLow]

[HKCU\Software\Atheros]

[HKCU\Software\AutoHelpDesk]

[HKCU\Software\Baidu Security]

[HKCU\Software\BitTorrent]  =>P2P.BitTorrent

[HKCU\Software\Boneloaf]

[HKCU\Software\Classes]

[HKCU\Software\Clients]

[HKCU\Software\Conexant]

[HKCU\Software\CyberLink]

[HKCU\Software\Elantech]

[HKCU\Software\GMStudio]

[HKCU\Software\GMStudio_Steam]

[HKCU\Software\Game Maker]

[HKCU\Software\GbAs]

[HKCU\Software\GbPlugin]

[HKCU\Software\Google]

[HKCU\Software\Hightail for Lenovo]

[HKCU\Software\IM Providers]

[HKCU\Software\Intel]

[HKCU\Software\JavaSoft]

[HKCU\Software\Lenovo]

[HKCU\Software\MPC-HC]

[HKCU\Software\Macromedia]

[HKCU\Software\Mine]

[HKCU\Software\MozillaPlugins]

[HKCU\Software\Netscape]

[HKCU\Software\ODBC]

[HKCU\Software\Policies]

[HKCU\Software\RegisteredApplications]

[HKCU\Software\SYNCJM]

[HKCU\Software\Skype]

[HKCU\Software\Trend Micro]

[HKCU\Software\Trolltech]

[HKCU\Software\Unity]

[HKCU\Software\WinRAR SFX]

[HKCU\Software\WinRAR]

[HKCU\Software\Wow6432Node]

[HKCU\Software\ZebHelpProcess Helper]

[HKLM\Software\Atheros]

[HKLM\Software\CNXT_UIU_MUTEX]

[HKLM\Software\Classes]

[HKLM\Software\Clients]

[HKLM\Software\Cnxt_Uiu_Parms]

[HKLM\Software\Conexant]

[HKLM\Software\CyberLink]

[HKLM\Software\Dolby]

[HKLM\Software\Hightail for Lenovo]

[HKLM\Software\IM Providers]

[HKLM\Software\InstalledOptions]

[HKLM\Software\Intel]

[HKLM\Software\JavaSoft]

[HKLM\Software\Khronos]

[HKLM\Software\Lenovo]

[HKLM\Software\Macromedia]

[HKLM\Software\MozillaPlugins]

[HKLM\Software\ODBC]

[HKLM\Software\PDR_Upgrade]

[HKLM\Software\PartnerShared]

[HKLM\Software\Policies]

[HKLM\Software\RTLSetup]

[HKLM\Software\Realtek Semiconductor Corp.]

[HKLM\Software\Realtek]

[HKLM\Software\RegisteredApplications]

[HKLM\Software\UIU]

[HKLM\Software\WinRAR]

[HKLM\Software\Wow6432Node\Adobe]

[HKLM\Software\Wow6432Node\AdwCleaner]

[HKLM\Software\Wow6432Node\Atheros]

[HKLM\Software\Wow6432Node\Brackets]

[HKLM\Software\Wow6432Node\Classes]

[HKLM\Software\Wow6432Node\Clients]

[HKLM\Software\Wow6432Node\Conexant]

[HKLM\Software\Wow6432Node\CyberLink]

[HKLM\Software\Wow6432Node\FusionEngine]

[HKLM\Software\Wow6432Node\Google]

[HKLM\Software\Wow6432Node\Hightail for Lenovo]

[HKLM\Software\Wow6432Node\IM Providers]

[HKLM\Software\Wow6432Node\Intel]

[HKLM\Software\Wow6432Node\Khronos]

[HKLM\Software\Wow6432Node\Lake]

[HKLM\Software\Wow6432Node\Lenovo]

[HKLM\Software\Wow6432Node\Macromedia]

[HKLM\Software\Wow6432Node\Malwarebytes' Anti-Malware]

[HKLM\Software\Wow6432Node\MozillaPlugins]

[HKLM\Software\Wow6432Node\Mozilla]

[HKLM\Software\Wow6432Node\Nuance]

[HKLM\Software\Wow6432Node\ODBC]

[HKLM\Software\Wow6432Node\Policies]

[HKLM\Software\Wow6432Node\PowerPivot]

[HKLM\Software\Wow6432Node\Qualcomm Atheros]

[HKLM\Software\Wow6432Node\Realtek Semiconductor Corp.]

[HKLM\Software\Wow6432Node\Realtek]

[HKLM\Software\Wow6432Node\RegisteredApplications]

[HKLM\Software\Wow6432Node\Skype]

[HKLM\Software\Wow6432Node\SuppHelpDir]

[HKLM\Software\Wow6432Node\TrendMicro]

[HKLM\Software\Wow6432Node\Volatile]

[HKLM\Software\Wow6432Node]

~ Key Software: 234 Scanned in 00mn 00s

---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43)

O43 - CFD: 28/11/2014 - 09:50:53 - [] ----D C:\Program Files (x86)\Adobe

O43 - CFD: 28/11/2014 - 09:49:53 - [] ----D C:\Program Files (x86)\Baidu Security

O43 - CFD: 23/03/2015 - 19:42:56 - [] ----D C:\Program Files (x86)\Bluetooth Suite

O43 - CFD: 07/03/2015 - 16:00:15 - [] ----D C:\Program Files (x86)\Brackets

O43 - CFD: 23/03/2015 - 19:42:57 - [] ----D C:\Program Files (x86)\Common Files

O43 - CFD: 28/11/2014 - 09:44:21 - [] ----D C:\Program Files (x86)\CyberLink

O43 - CFD: 05/02/2015 - 20:12:59 - [] ----D C:\Program Files (x86)\Diebold

O43 - CFD: 23/04/2015 - 21:07:14 - [] ----D C:\Program Files (x86)\GAS Tecnologia

O43 - CFD: 26/02/2015 - 11:13:44 - [] ----D C:\Program Files (x86)\GbPlugin

O43 - CFD: 27/01/2015 - 19:25:48 - [] ----D C:\Program Files (x86)\Google

O43 - CFD: 28/11/2014 - 09:44:46 - [] ----D C:\Program Files (x86)\Hightail

O43 - CFD: 28/11/2014 - 09:57:58 - [] --H-D C:\Program Files (x86)\InstallShield Installation Information

O43 - CFD: 28/11/2014 - 09:07:30 - [] ----D C:\Program Files (x86)\Intel

O43 - CFD: 12/03/2015 - 22:58:34 - [] ----D C:\Program Files (x86)\Internet Explorer

O43 - CFD: 22/02/2015 - 09:06:27 - [] ----D C:\Program Files (x86)\Lenovo

O43 - CFD: 18/04/2015 - 09:47:36 - [] ----D C:\Program Files (x86)\Malwarebytes Anti-Malware

O43 - CFD: 22/02/2015 - 12:32:53 - [] ----D C:\Program Files (x86)\Microsoft Analysis Services

O43 - CFD: 28/11/2014 - 09:44:34 - [] ----D C:\Program Files (x86)\Microsoft Office

O43 - CFD: 22/02/2015 - 12:36:36 - [] ----D C:\Program Files (x86)\Microsoft SQL Server

O43 - CFD: 23/03/2015 - 19:42:57 - [] ----D C:\Program Files (x86)\Microsoft.NET

O43 - CFD: 22/02/2015 - 12:35:41 - [] ----D C:\Program Files (x86)\Mozilla Firefox

O43 - CFD: 03/04/2014 - 15:24:50 - [] ----D C:\Program Files (x86)\MSBuild

O43 - CFD: 28/11/2014 - 09:18:17 - [] ----D C:\Program Files (x86)\Qualcomm Atheros

O43 - CFD: 28/11/2014 - 09:18:42 - [] ----D C:\Program Files (x86)\Realtek

O43 - CFD: 03/04/2014 - 15:24:50 - [] ----D C:\Program Files (x86)\Reference Assemblies

O43 - CFD: 07/03/2015 - 15:49:35 - [] ----D C:\Program Files (x86)\Scratch

O43 - CFD: 31/01/2015 - 16:32:51 - [] R---D C:\Program Files (x86)\Skype

O43 - CFD: 23/04/2015 - 21:39:54 - [] ----D C:\Program Files (x86)\Trend Micro

O43 - CFD: 10/03/2015 - 23:32:07 - [] ----D C:\Program Files (x86)\Windows Defender

O43 - CFD: 12/03/2015 - 22:57:50 - [] ----D C:\Program Files (x86)\Windows Mail  =>.Microsoft Corporation

O43 - CFD: 23/03/2015 - 19:42:57 - [] ----D C:\Program Files (x86)\Windows Media Player  =>.Microsoft Corporation

O43 - CFD: 12/03/2015 - 22:57:50 - [] ----D C:\Program Files (x86)\Windows Multimedia Platform

O43 - CFD: 22/08/2013 - 12:36:30 - [] ----D C:\Program Files (x86)\Windows NT

O43 - CFD: 12/03/2015 - 22:57:50 - [] ----D C:\Program Files (x86)\Windows Photo Viewer

O43 - CFD: 12/03/2015 - 22:57:50 - [] ----D C:\Program Files (x86)\Windows Portable Devices

O43 - CFD: 23/03/2015 - 19:42:57 - [] -SH-D C:\Program Files (x86)\Windows Sidebar

O43 - CFD: 23/03/2015 - 19:42:57 - [] ----D C:\Program Files (x86)\WindowsPowerShell

O43 - CFD: 27/04/2015 - 20:56:31 - [] ----D C:\Program Files (x86)\ZHPDiag  =>.Nicolas Coolman

O43 - CFD: 27/01/2015 - 19:22:51 - [] ----D C:\Program Files (x86)\Common Files\Adobe AIR

O43 - CFD: 28/11/2014 - 09:11:10 - [] ----D C:\Program Files (x86)\Common Files\Atheros

O43 - CFD: 28/11/2014 - 09:50:04 - [] ----D C:\Program Files (x86)\Common Files\InstallShield

O43 - CFD: 28/11/2014 - 09:01:35 - [] ----D C:\Program Files (x86)\Common Files\Intel

O43 - CFD: 28/11/2014 - 09:08:58 - [] ----D C:\Program Files (x86)\Common Files\Intel Corporation

O43 - CFD: 28/11/2014 - 09:45:32 - [] ----D C:\Program Files (x86)\Common Files\LENOVO

O43 - CFD: 23/03/2015 - 19:42:57 - [] ----D C:\Program Files (x86)\Common Files\Microsoft Shared

O43 - CFD: 28/11/2014 - 09:56:27 - [] ----D C:\Program Files (x86)\Common Files\Nikon

O43 - CFD: 28/11/2014 - 09:06:58 - [] ----D C:\Program Files (x86)\Common Files\postureAgent

O43 - CFD: 22/08/2013 - 12:36:33 - [] ----D C:\Program Files (x86)\Common Files\Services

O43 - CFD: 31/01/2015 - 16:32:51 - [] ----D C:\Program Files (x86)\Common Files\Skype

O43 - CFD: 12/03/2015 - 22:57:50 - [] ----D C:\Program Files (x86)\Common Files\System

O43 - CFD: 28/11/2014 - 09:50:54 - [] ----D C:\ProgramData\Adobe

O43 - CFD: 10/03/2015 - 20:21:28 - [] ----D C:\ProgramData\Aeria Games

O43 - CFD: 22/08/2013 - 11:45:52 - [] -SH-D C:\ProgramData\Application Data

O43 - CFD: 26/01/2015 - 22:03:42 - [] ----D C:\ProgramData\Atheros

O43 - CFD: 28/11/2014 - 09:50:02 - [] ----D C:\ProgramData\Baidu Security

O43 - CFD: 21/04/2015 - 21:45:22 - [] ----D C:\ProgramData\boost_interprocess

O43 - CFD: 23/03/2015 - 19:42:57 - [] ----D C:\ProgramData\Conexant

O43 - CFD: 26/01/2015 - 22:07:04 - [] ----D C:\ProgramData\CyberLink

O43 - CFD: 14/04/2015 - 23:12:11 - [] ----D C:\ProgramData\D0E43261231BCC5F8018B49E24D831B2

O43 - CFD: 26/01/2015 - 20:29:42 - [] -SH-D C:\ProgramData\Dados de Aplicativos

O43 - CFD: 22/08/2013 - 11:45:52 - [] -SH-D C:\ProgramData\Desktop

O43 - CFD: 26/01/2015 - 20:29:42 - [] -SH-D C:\ProgramData\Documentos

O43 - CFD: 22/08/2013 - 11:45:52 - [] -SH-D C:\ProgramData\Documents

O43 - CFD: 28/11/2014 - 09:57:41 - [] ----D C:\ProgramData\Downloaded Installations

O43 - CFD: 28/11/2014 - 09:58:10 - [] ----D C:\ProgramData\Energy Manager

O43 - CFD: 14/04/2015 - 23:12:07 - [] ----D C:\ProgramData\gamemaker_studio

O43 - CFD: 16/04/2015 - 22:04:05 - [] ----D C:\ProgramData\GAS Tecnologia

O43 - CFD: 05/02/2015 - 20:16:13 - [] ----D C:\ProgramData\GbPlugin

O43 - CFD: 28/11/2014 - 09:55:17 - [] ----D C:\ProgramData\install_clap

O43 - CFD: 28/11/2014 - 09:07:31 - [] ----D C:\ProgramData\Intel

O43 - CFD: 26/01/2015 - 22:05:46 - [] ----D C:\ProgramData\Lenovo

O43 - CFD: 18/04/2015 - 09:47:30 - [] ----D C:\ProgramData\Malwarebytes

O43 - CFD: 01/03/2015 - 22:06:16 - [] ----D C:\ProgramData\McAfee

O43 - CFD: 26/01/2015 - 20:29:42 - [] -SH-D C:\ProgramData\Menu Iniciar

O43 - CFD: 23/03/2015 - 19:42:58 - [] -S--D C:\ProgramData\Microsoft

O43 - CFD: 22/02/2015 - 12:39:15 - [] ----D C:\ProgramData\Microsoft Help

O43 - CFD: 29/01/2015 - 20:44:07 - [] ----D C:\ProgramData\Microsoft OneDrive

O43 - CFD: 29/01/2015 - 21:23:40 - [] ----D C:\ProgramData\Microsoft Toolkit  =>Trojan.AutoKMS

O43 - CFD: 26/01/2015 - 20:29:42 - [] -SH-D C:\ProgramData\Modelos

O43 - CFD: 28/11/2014 - 09:57:29 - [] ----D C:\ProgramData\OneKey Recovery

O43 - CFD: 28/11/2014 - 09:18:07 - [] ----D C:\ProgramData\Qualcomm Atheros

O43 - CFD: 23/03/2015 - 19:42:58 - [] ----D C:\ProgramData\regid.1991-06.com.microsoft

O43 - CFD: 12/04/2015 - 16:13:31 - [] ----D C:\ProgramData\Skype

O43 - CFD: 22/08/2013 - 11:45:52 - [] -SH-D C:\ProgramData\Start Menu

O43 - CFD: 05/02/2015 - 20:16:37 - [] ----D C:\ProgramData\Temp

O43 - CFD: 22/08/2013 - 11:45:52 - [] -SH-D C:\ProgramData\Templates

O43 - CFD: 12/03/2015 - 22:58:34 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility

O43 - CFD: 12/03/2015 - 22:58:34 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

O43 - CFD: 12/03/2015 - 22:58:34 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools

O43 - CFD: 23/03/2015 - 19:42:57 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Android Studio

O43 - CFD: 23/03/2015 - 19:42:57 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink MediaStory

O43 - CFD: 23/03/2015 - 19:42:57 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDirector 10

O43 - CFD: 23/03/2015 - 19:42:57 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dolby

O43 - CFD: 14/04/2015 - 22:39:25 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GameMaker Player

O43 - CFD: 23/03/2015 - 19:42:57 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome

O43 - CFD: 28/11/2014 - 09:44:46 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hightail

O43 - CFD: 23/03/2015 - 19:42:57 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel

O43 - CFD: 23/03/2015 - 19:42:57 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

O43 - CFD: 23/03/2015 - 19:42:57 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit

O43 - CFD: 23/03/2015 - 19:42:57 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo

O43 - CFD: 23/03/2015 - 19:42:57 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo Photo Master

O43 - CFD: 22/08/2013 - 12:36:33 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance

O43 - CFD: 18/04/2015 - 09:47:39 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

O43 - CFD: 23/03/2015 - 19:42:58 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013

O43 - CFD: 23/03/2015 - 19:42:58 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC-HC x64

O43 - CFD: 23/03/2015 - 19:42:58 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Scratch

O43 - CFD: 12/04/2015 - 16:13:29 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

O43 - CFD: 22/08/2013 - 12:36:33 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp

O43 - CFD: 12/03/2015 - 22:58:34 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools

O43 - CFD: 18/03/2014 - 06:38:10 - [0] R-H-D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC

O43 - CFD: 23/03/2015 - 19:42:58 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR

O43 - CFD: 27/04/2015 - 20:56:32 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP  =>.Nicolas Coolman

O43 - CFD: 26/01/2015 - 21:37:58 - [] ----D C:\Users\Rafael\AppData\Roaming\Adobe

O43 - CFD: 09/03/2015 - 21:10:45 - [] ----D C:\Users\Rafael\AppData\Roaming\Aeria Games & Entertainment

O43 - CFD: 26/04/2015 - 22:19:37 - [] ----D C:\Users\Rafael\AppData\Roaming\Atheros

O43 - CFD: 26/01/2015 - 21:36:59 - [] ----D C:\Users\Rafael\AppData\Roaming\Baidu Security

O43 - CFD: 14/04/2015 - 22:47:41 - [] ----D C:\Users\Rafael\AppData\Roaming\GameMaker-Studio

O43 - CFD: 26/01/2015 - 22:08:33 - [] ----D C:\Users\Rafael\AppData\Roaming\Hightail for Lenovo

O43 - CFD: 13/03/2015 - 19:38:27 - [] ----D C:\Users\Rafael\AppData\Roaming\Identities

O43 - CFD: 26/01/2015 - 21:37:41 - [] ----D C:\Users\Rafael\AppData\Roaming\Intel Corporation

O43 - CFD: 31/01/2015 - 19:19:59 - [] ----D C:\Users\Rafael\AppData\Roaming\JetBrains

O43 - CFD: 22/02/2015 - 12:21:24 - [] ----D C:\Users\Rafael\AppData\Roaming\LSC

O43 - CFD: 28/11/2014 - 09:50:54 - [] ----D C:\Users\Rafael\AppData\Roaming\Macromedia

O43 - CFD: 23/04/2015 - 21:39:54 - [] -S--D C:\Users\Rafael\AppData\Roaming\Microsoft

O43 - CFD: 19/02/2015 - 21:30:09 - [] ----D C:\Users\Rafael\AppData\Roaming\MPC-HC

O43 - CFD: 27/04/2015 - 20:21:01 - [] ----D C:\Users\Rafael\AppData\Roaming\Spotify

O43 - CFD: 27/04/2015 - 20:20:41 - [] ----D C:\Users\Rafael\AppData\Roaming\uTorrent  =>P2P.µTorrent

O43 - CFD: 09/02/2015 - 20:31:50 - [] ----D C:\Users\Rafael\AppData\Roaming\WinRAR

O43 - CFD: 27/04/2015 - 20:57:35 - [] ----D C:\Users\Rafael\AppData\Roaming\ZHP  =>.Nicolas Coolman

O43 - CFD: 26/01/2015 - 21:38:28 - [] ----D C:\Users\Rafael\AppData\Local\Adobe

O43 - CFD: 10/03/2015 - 20:22:16 - [] ----D C:\Users\Rafael\AppData\Local\Aeria Games

O43 - CFD: 31/01/2015 - 19:08:49 - [] ----D C:\Users\Rafael\AppData\Local\Android

O43 - CFD: 27/01/2015 - 19:23:50 - [] ----D C:\Users\Rafael\AppData\Local\Apps

O43 - CFD: 26/01/2015 - 21:37:06 - [] ----D C:\Users\Rafael\AppData\Local\BMExplorer

O43 - CFD: 18/04/2015 - 16:13:05 - [] ----D C:\Users\Rafael\AppData\Local\CrashDumps

O43 - CFD: 11/04/2015 - 16:40:27 - [] ----D C:\Users\Rafael\AppData\Local\CyberLink

O43 - CFD: 26/01/2015 - 21:33:55 - [] -SH-D C:\Users\Rafael\AppData\Local\Dados de Aplicativos

O43 - CFD: 22/02/2015 - 13:17:01 - [0] ----D C:\Users\Rafael\AppData\Local\Deployment

O43 - CFD: 22/02/2015 - 21:33:24 - [] -SH-D C:\Users\Rafael\AppData\Local\EmieBrowserModeList

O43 - CFD: 26/01/2015 - 21:45:48 - [] -SH-D C:\Users\Rafael\AppData\Local\EmieSiteList

O43 - CFD: 26/01/2015 - 21:45:48 - [] -SH-D C:\Users\Rafael\AppData\Local\EmieUserList

O43 - CFD: 14/04/2015 - 22:59:16 - [] ----D C:\Users\Rafael\AppData\Local\GameMaker-Studio

O43 - CFD: 14/04/2015 - 22:40:30 - [] ----D C:\Users\Rafael\AppData\Local\GameMakerPlayer

O43 - CFD: 05/02/2015 - 20:14:35 - [] ----D C:\Users\Rafael\AppData\Local\GAS Tecnologia

O43 - CFD: 27/01/2015 - 19:25:59 - [] ----D C:\Users\Rafael\AppData\Local\Google

O43 - CFD: 26/01/2015 - 21:33:55 - [] -SH-D C:\Users\Rafael\AppData\Local\Histórico

O43 - CFD: 27/01/2015 - 20:09:12 - [] ----D C:\Users\Rafael\AppData\Local\Lenovo

O43 - CFD: 23/03/2015 - 19:43:10 - [] ----D C:\Users\Rafael\AppData\Local\Microsoft

O43 - CFD: 22/02/2015 - 12:32:47 - [0] ----D C:\Users\Rafael\AppData\Local\Microsoft Help

O43 - CFD: 26/04/2015 - 22:42:25 - [] ----D C:\Users\Rafael\AppData\Local\Packages

O43 - CFD: 05/02/2015 - 20:12:38 - [] ----D C:\Users\Rafael\AppData\Local\Programs

O43 - CFD: 31/01/2015 - 10:17:13 - [] ----D C:\Users\Rafael\AppData\Local\Qualcomm Atheros

O43 - CFD: 27/04/2015 - 20:20:27 - [] ----D C:\Users\Rafael\AppData\Local\Spotify

O43 - CFD: 27/04/2015 - 20:56:33 - [] ----D C:\Users\Rafael\AppData\Local\Temp

O43 - CFD: 26/01/2015 - 21:33:55 - [] -SH-D C:\Users\Rafael\AppData\Local\Temporary Internet Files

O43 - CFD: 23/04/2015 - 21:32:59 - [] ----D C:\Users\Rafael\AppData\Local\VirtualStore

O43 - CFD: 14/04/2015 - 22:41:13 - [] ----D C:\Users\Rafael\AppData\Local\YoYo_Games_Ltd

O43 - CFD: 23/03/2015 - 19:42:54 - [] R---D C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility

O43 - CFD: 22/08/2013 - 12:36:32 - [] R---D C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

O43 - CFD: 23/03/2015 - 19:42:54 - [] R---D C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

O43 - CFD: 23/04/2015 - 21:38:08 - [0] ----D C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AeriaGames

O43 - CFD: 14/04/2015 - 22:39:10 - [] ----D C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GameMaker-Studio 1.4

O43 - CFD: 23/04/2015 - 21:39:55 - [] ----D C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis

O43 - CFD: 23/02/2015 - 21:04:09 - [] ----D C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Level up

O43 - CFD: 22/08/2013 - 12:36:32 - [] ----D C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

O43 - CFD: 07/03/2015 - 15:49:35 - [0] ----D C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Scratch

O43 - CFD: 23/03/2015 - 19:42:54 - [] R---D C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

O43 - CFD: 23/03/2015 - 19:42:54 - [] R---D C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

O43 - CFD: 23/03/2015 - 19:42:54 - [] ----D C:\Users\Rafael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR

~ Program Folder: 169 Scanned in 00mn 00s

---\\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044)

O44 - LFC:[MD5.9B8BE8DDC0D9CD6A4D2182196ABE99E2] - 14/04/2015 - 20:05:54 ---A- . (.Microsoft Corporation - Device Inventory Library.) -- C:\WINDOWS\System32\devinv.dll   [419328]

O44 - LFC:[MD5.150416EB645442AB9AF3ECC0AA183A92] - 14/04/2015 - 20:05:55 ---A- . (.Microsoft Corporation - Application Experience Program Inventory Co.) -- C:\WINDOWS\System32\aeinv.dll   [1111552]

O44 - LFC:[MD5.813906D7D0A35CB7158C45E6568FA3DD] - 14/04/2015 - 20:05:55 ---A- . (.Microsoft Corporation - Atualizador de Dados de Compatibilidade ent.) -- C:\WINDOWS\System32\aepdu.dll   [227328]

O44 - LFC:[MD5.1C6716A453FEB8DB6EE7A05E02CF5C6A] - 14/04/2015 - 20:05:55 ---A- . (.Microsoft Corporation - Atualizador de Dados de Compatibilidade ent.) -- C:\WINDOWS\System32\invagent.dll   [769024]

O44 - LFC:[MD5.7F6FF3CFCE8A174BA6635FC1617E0F02] - 14/04/2015 - 20:05:55 ---A- . (.Microsoft Corporation - Compatibility Appraiser.) -- C:\WINDOWS\System32\appraiser.dll   [957440]

O44 - LFC:[MD5.BA93F0E6B27510746864DA8D26DD3852] - 14/04/2015 - 20:05:55 ---A- . (.Microsoft Corporation - Compatibility Upgrade Migration Host.) -- C:\WINDOWS\System32\acmigration.dll   [30720]

O44 - LFC:[MD5.1588D38241818380E156613D29C1C303] - 14/04/2015 - 20:05:55 ---A- . (.Microsoft Corporation - General Telemetry.) -- C:\WINDOWS\System32\generaltel.dll   [726528]

O44 - LFC:[MD5.8EB7E70C2D348FE2476A2E3F2D585E3D] - 14/04/2015 - 20:05:56 ---A- . (.Microsoft Corporation - Common Log File System Driver.) -- C:\WINDOWS\System32\Drivers\clfs.sys   [377152]

O44 - LFC:[MD5.EFC011253AE4F21DE600907AD9F0263D] - 14/04/2015 - 20:05:56 ---A- . (.Microsoft Corporation - Common Log Marshalling Win32 DLL.) -- C:\WINDOWS\System32\clfsw32.dll   [75264]

O44 - LFC:[MD5.E87A6D3B8FECD5B93BC0CFBB48C27970] - 14/04/2015 - 20:05:57 ---A- . (.Microsoft Corporation - Pilha do protocolo HTTP.) -- C:\WINDOWS\System32\Drivers\http.sys   [991552]

O44 - LFC:[MD5.2CBD6D22499EB13A2666F62EF33D00E2] - 14/04/2015 - 20:06:32 ---A- . (...) -- C:\WINDOWS\System32\ieuinit.inf   [16303]

O44 - LFC:[MD5.9171D1A18B1185A78BA33FEE884B8912] - 14/04/2015 - 20:06:32 ---A- . (.Microsoft Corporation - Microsoft Feeds Manager.) -- C:\WINDOWS\System32\msfeeds.dll   [801280]

O44 - LFC:[MD5.3408F27ABC8B2426481306336F747949] - 14/04/2015 - 20:06:32 ---A- . (.Microsoft Corporation - Microsoft SmartScreen Filter.) -- C:\WINDOWS\System32\ieapfltr.dll   [800768]

O44 - LFC:[MD5.2FB7437C878ED672C00C5EC8109411F4] - 14/04/2015 - 20:06:32 ---A- . (.Microsoft Corporation - Microsoft ® JScript.) -- C:\WINDOWS\System32\jscript.dll   [816128]

O44 - LFC:[MD5.E593E891B374088572AD021431EBC38B] - 14/04/2015 - 20:06:32 ---A- . (.Microsoft Corporation - Microsoft ® VBScript.) -- C:\WINDOWS\System32\vbscript.dll   [584192]

O44 - LFC:[MD5.50B2A19B2FBFEFE0FFC537C1BA6C5DD9] - 14/04/2015 - 20:06:33 ---A- . (.Microsoft Corporation - Executar utilitário de tempo do Internet Ex.) -- C:\WINDOWS\System32\iertutil.dll   [2886144]

O44 - LFC:[MD5.3C9D34F1F5A2C6867ECC60026F1F6CB7] - 14/04/2015 - 20:06:33 ---A- . (.Microsoft Corporation - Extensões OLE32 para Win32.) -- C:\WINDOWS\System32\urlmon.dll   [1548288]

O44 - LFC:[MD5.77B35D0FC22A2D2EAC8D07C3F9784DBF] - 14/04/2015 - 20:06:33 ---A- . (.Microsoft Corporation - Internet Extensions para Win32.) -- C:\WINDOWS\System32\wininet.dll   [2358784]

O44 - LFC:[MD5.EF1A03145BC0F28BC7604207A4CE29AB] - 14/04/2015 - 20:06:33 ---A- . (.Microsoft Corporation - Microsoft Internet Messaging API Resources.) -- C:\WINDOWS\System32\inetcomm.dll   [1032704]

O44 - LFC:[MD5.3457A873B2246B36F1FF58876841D7FE] - 14/04/2015 - 20:06:33 ---A- . (.Microsoft Corporation - Microsoft® HTML Editing Component.) -- C:\WINDOWS\System32\mshtmled.dll   [92160]

O44 - LFC:[MD5.7571102ACD8A82A55D1657CDF96A1A0E] - 14/04/2015 - 20:06:33 ---A- . (.Microsoft Corporation - Utilitário de Inicialização por Usuário do.) -- C:\WINDOWS\System32\ie4uinit.exe   [720384]

O44 - LFC:[MD5.FA10EC0F44A75511D13F9D93184CFC90] - 14/04/2015 - 20:06:36 ---A- . (.Microsoft Corporation - Navegador da Internet.) -- C:\WINDOWS\System32\ieframe.dll   [14397440]

O44 - LFC:[MD5.AA0640B3252BB6E9F90715F79EE77399] - 14/04/2015 - 20:06:37 ---A- . (.Microsoft Corporation - Microsoft ® JScript.) -- C:\WINDOWS\System32\jscript9.dll   [6025216]

O44 - LFC:[MD5.DBC0C4554A8B2A81F68690D30F12C99E] - 14/04/2015 - 20:06:40 ---A- . (.Microsoft Corporation - Visualizador de HTML da Microsoft ®.) -- C:\WINDOWS\System32\mshtml.dll   [24980480]

O44 - LFC:[MD5.DB2A64D1A82226DCEFF4076725BD5577] - 14/04/2015 - 20:06:43 ---A- . (.Microsoft Corporation - AMD64 Wow64 CPU.) -- C:\WINDOWS\System32\wow64cpu.dll   [13312]

O44 - LFC:[MD5.31E9837295401C2470027AF7DD75C4D2] - 14/04/2015 - 20:06:43 ---A- . (.Microsoft Corporation - Pku2u Security Package.) -- C:\WINDOWS\System32\pku2u.dll   [259072]

O44 - LFC:[MD5.9A7A7E45DAED2E8C2816716D8D28236A] - 14/04/2015 - 20:06:43 ---A- . (.Microsoft Corporation - Serviço do Gerenciador de Sessão Local.) -- C:\WINDOWS\System32\lsm.dll   [780800]

O44 - LFC:[MD5.168ECAC2C72695D6F827050BE5386206] - 14/04/2015 - 20:06:44 ---A- . (.Microsoft Corporation - Ferramenta de relatórios de rastreamento de.) -- C:\WINDOWS\System32\tracerpt.exe   [411648]

O44 - LFC:[MD5.50C5F7952F821EED8253BDC4203DECDB] - 14/04/2015 - 20:06:44 ---A- . (.Microsoft Corporation - Host for SCM/SDDL/LSA Lookup APIs.) -- C:\WINDOWS\System32\sechost.dll   [360480]

O44 - LFC:[MD5.D2451F8CF7EAA14531E3731C06D6D27E] - 14/04/2015 - 20:06:44 ---A- . (.Microsoft Corporation - Recursos Microsoft-Windows-System-Events.) -- C:\WINDOWS\System32\microsoft-windows-system-events.dll   [246272]

O44 - LFC:[MD5.AF4309E729C1943908E1E10DAEE42413] - 14/04/2015 - 20:06:44 ---A- . (.Microsoft Corporation - Win32 Emulation on NT64.) -- C:\WINDOWS\System32\wow64.dll   [285184]

O44 - LFC:[MD5.9E23ACF90477AA76857130FD01EAE09B] - 14/04/2015 - 20:06:45 ---A- . (.Microsoft Corporation - Biblioteca de Auxiliar de Rastreamento de E.) -- C:\WINDOWS\System32\tdh.dll   [950784]

O44 - LFC:[MD5.18F7A5A02CB66AC3E08B3B5DCD5BDBF4] - 14/04/2015 - 20:06:45 ---A- . (.Microsoft Corporation - DLL de nível do NT.) -- C:\WINDOWS\System32\ntdll.dll   [1733952]

O44 - LFC:[MD5.7DB50C244AE8F15D62AD044B84824B69] - 14/04/2015 - 20:06:47 ---A- . (.Microsoft Corporation - NT Kernel & System.) -- C:\WINDOWS\System32\ntoskrnl.exe   [7476032]

O44 - LFC:[MD5.3E9BB985DF2FF26CCE840DE1D24E9381] - 14/04/2015 - 20:06:48 ---A- . (.Microsoft Corporation - DLL de servidor MSCTF.) -- C:\WINDOWS\System32\msctf.dll   [1385256]

O44 - LFC:[MD5.5D42E000E08A75359564CA7507CD2269] - 17/04/2015 - 22:51:51 ---A- . (.Microsoft Corporation - Ferramentas de Remoção de Software Mal-Inte.) -- C:\WINDOWS\System32\MRT.exe   [128913832]

O44 - LFC:[MD5.CF12E148C6FC151335B7D7FE03F1C7A2] - 18/04/2015 - 09:47:30 ---A- . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\WINDOWS\System32\Drivers\mbam.sys   [25816]

O44 - LFC:[MD5.68C3B11D1ED8C97648BEEFEC37E93E74] - 18/04/2015 - 09:47:30 ---A- . (.Malwarebytes Corporation - Malwarebytes Chameleon Protection Driver.) -- C:\WINDOWS\System32\Drivers\mbamchameleon.sys   [107736]

O44 - LFC:[MD5.7FD0FDFB97D80B21195273C4C3810FE1] - 18/04/2015 - 09:47:30 ---A- . (.Malwarebytes Corporation - Malwarebytes Web Access Control.) -- C:\WINDOWS\System32\Drivers\mwac.sys   [64216]

O44 - LFC:[MD5.9B6B6E4A62518E4782AE18C7ED3D18A9] - 23/04/2015 - 21:17:31 ---A- . (.Basil - WinDivert network packet capture and (re)in.) -- C:\WINDOWS\System32\WinDivert.dll   [34104]

O44 - LFC:[MD5.E583E1EA40CADB778820BCB1281CB1E9] - 23/04/2015 - 21:17:32 ---A- . (.Basil - WinDivert (web: http://reqrypt.org/windiver.) -- C:\WINDOWS\System32\WinDivert64.sys   [38104]

O44 - LFC:[MD5.CFC86E58E8E02E967F289198F2BE49C6] - 23/04/2015 - 21:41:44 ---A- . (...) -- C:\WINDOWS\System32\FNTCACHE.DAT   [489312]

O44 - LFC:[MD5.A392623DE84037C80BE7CB5883F6E5DA] - 26/04/2015 - 16:16:01 ---A- . (...) -- C:\zoek-results2015-04-26-191601.log   [1990]

O44 - LFC:[MD5.CC7AA7B42CF418FC3D926913490048F8] - 26/04/2015 - 22:35:58 ---A- . (...) -- C:\WINDOWS\zoek-delete.exe   [24064]

O44 - LFC:[MD5.D5BD0DFCBC80C197232A616323B0F981] - 26/04/2015 - 23:00:11 ---A- . (...) -- C:\WINDOWS\System32\VfService.trf   [4608]

O44 - LFC:[MD5.F51F31C9A6DB68D90E504DE88C06C788] - 26/04/2015 - 23:00:37 ---A- . (...) -- C:\WINDOWS\PFRO.log   [24866]

O44 - LFC:[MD5.2588BC54DE9529775313092814A8B987] - 26/04/2015 - 23:01:39 ---A- . (...) -- C:\zoek-results.log   [22356]

O44 - LFC:[MD5.2C63689B4DDC0BAAFDF55BD2BC12B47D] - 26/04/2015 - 23:05:27 ---A- . (...) -- C:\WINDOWS\System32\PerfStringBackup.INI   [1800588]

O44 - LFC:[MD5.1C7EEBECDA5F6F872EA2C6B6499FECAF] - 26/04/2015 - 23:05:27 ---A- . (...) -- C:\WINDOWS\System32\perfc009.dat   [136128]

O44 - LFC:[MD5.4D985332ECF641ACCA416308DCC51A15] - 26/04/2015 - 23:05:27 ---A- . (...) -- C:\WINDOWS\System32\perfh009.dat   [723514]

O44 - LFC:[MD5.4F413ED377DD68FED3AD7B53EEEFAFFE] - 26/04/2015 - 23:05:27 ---A- . (...) -- C:\WINDOWS\System32\prfc0416.dat   [159030]

O44 - LFC:[MD5.178E18754778C2A7891EFB66B8D2AA4A] - 26/04/2015 - 23:05:27 ---A- . (...) -- C:\WINDOWS\System32\prfh0416.dat   [775938]

O44 - LFC:[MD5.35C09B17A01CA2A2FA2D361A284E2574] - 27/04/2015 - 20:19:20 -S-A- . (...) -- C:\WINDOWS\bootstat.dat   [67584]

O44 - LFC:[MD5.E9CD058C79EA15B4AA93E259FA713B07] - 27/04/2015 - 20:20:03 ---A- . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\WINDOWS\System32\Drivers\MBAMSwissArmy.sys   [136408]

O44 - LFC:[MD5.5158A02FE5786A5875F6FFC1978DF3DF] - 27/04/2015 - 20:30:10 ---A- . (...) -- C:\WINDOWS\setupact.log   [580232]

O44 - LFC:[MD5.B5118918E021A51F5143824972E32AE3] - 27/04/2015 - 20:48:47 ---A- . (...) -- C:\WINDOWS\WindowsUpdate.log   [1833458]

~ Files: 56 Scanned in 00mn 11s

---\\ Últimos arquivos criados no Windows Prefetcher (045)

O45 - LFCP:[MD5.A6DCE8D4DE5533C6299111036144E418] - 22/02/2015 - 12:58:00 ---A- - C:\WINDOWS\Prefetch\MICROSOFT TOOLKIT.EXE-D9661741.pf  =>Trojan.AutoKMS

O45 - LFCP:[MD5.D35C1D04C88689517E870FAAC411A1B2] - 19/02/2015 - 20:22:57 ---A- - C:\WINDOWS\Prefetch\UTORRENT.EXE-17072D7C.pf  =>P2P.µTorrent

O45 - LFCP:[MD5.8CCFE257FA953938962CFE25FB65DBB6] - 26/04/2015 - 23:02:19 ---A- - C:\WINDOWS\Prefetch\UTORRENT.EXE-EDB64AA1.pf  =>P2P.µTorrent

~ Prefetcher: 3 Scanned in 00mn 00s

---\\ Negação do serviço (Local Security Authority) (048)

O48 - LSA:Local Security Authority Authentication Packages . (.Microsoft Corporation - Microsoft Authentication Package v1.0.) -- C:\WINDOWS\System32\msv1_0.dll

O48 - LSA:Local Security Authority Notification Packages . (.Microsoft Corporation - Mecanismo cliente do 'Editor de configuração de segurança Windows'.) -- C:\WINDOWS\System32\scecli.dll

~ LSA: 3 Scanned in 00mn 00s

---\\ Controlo do Modo de Segurança (CSB) (49)

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\BasicDisplay.sys . (.Microsoft Corporation - Microsoft Basic Display Driver.) -- C:\WINDOWS\System32\Drivers\BasicDisplay.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\BasicRender.sys . (.Microsoft Corporation - Microsoft Basic Render Driver.) -- C:\WINDOWS\System32\Drivers\BasicRender.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\dxgkrnl.sys . (.Microsoft Corporation - DirectX Graphics Kernel.) -- C:\WINDOWS\System32\Drivers\dxgkrnl.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\FsDepends.sys . (.Microsoft Corporation - File System Dependency Manager Mini Filter Driver.) -- C:\WINDOWS\System32\Drivers\FsDepends.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sermouse.sys . (.Microsoft Corporation - Driver de porta de mouse serial.) -- C:\WINDOWS\System32\Drivers\sermouse.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\volmgr.sys . (.Microsoft Corporation - Volume Manager Driver.) -- C:\WINDOWS\System32\Drivers\volmgr.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\volmgrx.sys . (.Microsoft Corporation - Driver de Extensão do Gerenciador de Volumes.) -- C:\WINDOWS\System32\Drivers\volmgrx.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\BasicDisplay.sys . (.Microsoft Corporation - Microsoft Basic Display Driver.) -- C:\WINDOWS\System32\Drivers\BasicDisplay.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\BasicRender.sys . (.Microsoft Corporation - Microsoft Basic Render Driver.) -- C:\WINDOWS\System32\Drivers\BasicRender.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\dxgkrnl.sys . (.Microsoft Corporation - DirectX Graphics Kernel.) -- C:\WINDOWS\System32\Drivers\dxgkrnl.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\FsDepends.sys . (.Microsoft Corporation - File System Dependency Manager Mini Filter Driver.) -- C:\WINDOWS\System32\Drivers\FsDepends.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ipnat.sys . (.Microsoft Corporation - IP Network Address Translator.) -- C:\WINDOWS\System32\Drivers\ipnat.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\nsiproxy.sys . (.Microsoft Corporation - NSI Proxy.) -- C:\WINDOWS\System32\Drivers\nsiproxy.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpencdd.sys . (...) -- C:\WINDOWS\System32\Drivers\rdpencdd.sys (.not file.)

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sermouse.sys . (.Microsoft Corporation - Driver de porta de mouse serial.) -- C:\WINDOWS\System32\Drivers\sermouse.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\volmgr.sys . (.Microsoft Corporation - Volume Manager Driver.) -- C:\WINDOWS\System32\Drivers\volmgr.sys

O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\volmgrx.sys . (.Microsoft Corporation - Driver de Extensão do Gerenciador de Volumes.) -- C:\WINDOWS\System32\Drivers\volmgrx.sys

~ CSB: 17 Scanned in 00mn 00s

---\\ Pesquisa de infeções nos drivers (HKLM)(TDSD) (O52)

O52 - TDSD: \Drivers32\"msacm.l3acm"="C:\Windows\System32\l3codeca.acm" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm

O52 - TDSD: \drivers.desc\"C:\Windows\System32\l3codeca.acm"="Fraunhofer IIS MPEG Layer-3 Codec" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm

~ TDSD: 2 Scanned in 00mn 00s

---\\ Enumeração das chaves do registo SecurityProviders (MCSP) (O54)

O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Credential Delegation Security Package.) -- C:\WINDOWS\System32\credssp.dll

O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Credential Delegation Security Package.) -- C:\WINDOWS\System32\credssp.dll

~ MSCP: 2 Scanned in 00mn 00s

---\\ Enumeração das chaves do registo PoliciesSystem (MWPS) (O55)

O55 - MWPS:[HKLM\...\Policies\System] - "EnableVirtualization"=1

O55 - MWPS:[HKLM\...\Policies\System] - "EnableInstallerDetection"=1

O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=1

O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=1

O55 - MWPS:[HKLM\...\Policies\System] - "EnableSecureUIAPaths"=1

O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorAdmin"=5

O55 - MWPS:[HKLM\...\Policies\System] - "ValidateAdminCodeSignatures"=0

O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0

O55 - MWPS:[HKLM\...\Policies\System] - "EnableCursorSuppression"=1

O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorUser"=3

O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0

O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticecaption"=0

O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticetext"=0

O55 - MWPS:[HKLM\...\Policies\System] - "scforceoption"=0

O55 - MWPS:[HKLM\...\Policies\System] - "shutdownwithoutlogon"=1

O55 - MWPS:[HKLM\...\Policies\System] - "undockwithoutlogon"=1

O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0

O55 - MWPS:[HKLM\...\Policies\System] - "DisableCAD"=1

O55 - MWPS:[HKLM\...\Policies\System] - "DisableTaskMgr"=0

O55 - MWPS:[HKLM\...\Policies\System] - "DisableRegistryTools"=0

~ MWPS: 20 Scanned in 00mn 00s

---\\ Enumeração das chaves do registo Policie---plorer (MWPE) (O56)

O56 - MWPE:[HKLM\...\policies\Explorer] - "ForceActiveDesktopOn"=0

O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1

O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktop"=1

O56 - MWPE:[HKLM\...\policies\Explorer] - "NoRun"=0

O56 - MWPE:[HKLM\...\policies\Explorer] - "NoFolderOptions"=0

O56 - MWPE:[HKLM\...\policies\Explorer] - "NoControlPanel"=0

~ MWPE Keys: 6 Scanned in 00mn 00s

---\\ Lista dos drivers do sistema (SDL) (O58)

O58 - SDL:22/08/2013 - 09:43:41 ---A- . (.LSI - LSI 3ware SCSI Storport Driver.) -- C:\WINDOWS\System32\Drivers\3ware.sys   [108896]

O58 - SDL:28/11/2014 - 09:57:47 ---A- . (.Lenovo Corporation - ACPI Virtual Power Controller Driver.) -- C:\WINDOWS\System32\Drivers\AcpiVpc.sys   [35600]

O58 - SDL:22/08/2013 - 09:43:41 ---A- . (.PMC-Sierra - PMC-Sierra Storport  Driver For SPC8x6G SAS/SATA controller.) -- C:\WINDOWS\System32\Drivers\adp80xx.sys   [782176]

O58 - SDL:22/08/2013 - 09:43:41 ---A- . (.Advanced Micro Devices - AHCI 1.3 Device Driver.) -- C:\WINDOWS\System32\Drivers\amdsata.sys   [79200]

O58 - SDL:22/08/2013 - 09:43:41 ---A- . (.AMD Technologies Inc. - AMD Technology AHCI Compatible Controller Driver for Windows -.) -- C:\WINDOWS\System32\Drivers\amdsbs.sys   [259424]

O58 - SDL:22/08/2013 - 09:43:40 ---A- . (.Advanced Micro Devices - Storage Filter Driver.) -- C:\WINDOWS\System32\Drivers\amdxata.sys   [25952]

O58 - SDL:22/08/2013 - 09:43:41 ---A- . (.PMC-Sierra, Inc. - Adaptec SAS RAID WS03 Driver.) -- C:\WINDOWS\System32\Drivers\arcsas.sys   [114016]

O58 - SDL:12/11/2013 - 23:05:22 ---A- . (.Qualcomm Atheros Communications, Inc. - Qualcomm Atheros Extensible Wireless LAN device driver.) -- C:\WINDOWS\System32\Drivers\athwbx.sys   [3880448]

O58 - SDL:12/08/2013 - 20:25:46 ---A- . (.Windows ® Win 7 DDK provider - BCM Function 2  Device Driver.) -- C:\WINDOWS\System32\Drivers\bcmfn2.sys   [17624]

O58 - SDL:29/10/2013 - 21:01:34 ---A- . (.Qualcomm Atheros - Qualcomm Atheros A2DP driver.) -- C:\WINDOWS\System32\Drivers\btath_a2dp.sys   [338120]

O58 - SDL:29/10/2013 - 21:01:34 ---A- . (.Qualcomm Atheros - Qualcomm Atheros Bluetooth AVDT driver.) -- C:\WINDOWS\System32\Drivers\btath_avdt.sys   [116424]

O58 - SDL:29/10/2013 - 21:01:34 ---A- . (.Qualcomm Atheros - Qualcomm Atheros BUS driver.) -- C:\WINDOWS\System32\Drivers\btath_bus.sys   [34384]

O58 - SDL:29/10/2013 - 21:01:34 ---A- . (.Qualcomm Atheros - Qualcomm Atheros FILTER driver.) -- C:\WINDOWS\System32\Drivers\btath_flt.sys   [89800]

O58 - SDL:29/10/2013 - 21:01:34 ---A- . (.Qualcomm Atheros - Qualcomm Atheros HCRP driver.) -- C:\WINDOWS\System32\Drivers\btath_hcrp.sys   [179432]

O58 - SDL:29/10/2013 - 21:01:34 ---A- . (.Qualcomm Atheros - Qualcomm Atheros FILTER driver.) -- C:\WINDOWS\System32\Drivers\btath_lwflt.sys   [77464]

O58 - SDL:29/10/2013 - 21:01:34 ---A- . (.Qualcomm Atheros - Qualcomm Atheros AVRCP driver.) -- C:\WINDOWS\System32\Drivers\btath_rcp.sys   [137928]

O58 - SDL:29/10/2013 - 21:01:34 ---A- . (.Qualcomm Atheros - Qualcomm Atheros BtFilter Driver.) -- C:\WINDOWS\System32\Drivers\btfilter.sys   [596168]

O58 - SDL:22/08/2013 - 09:43:41 ---A- . (.Broadcom Corporation - Broadcom NetXtreme II GigE VBD.) -- C:\WINDOWS\System32\Drivers\bxvbda.sys   [531296]

O58 - SDL:27/01/2014 - 05:23:56 ---A- . (.Conexant Systems Inc. - 64-bit High Definition Audio Function Driver.) -- C:\WINDOWS\System32\Drivers\CHDRT64.sys   [1474240]

O58 - SDL:18/06/2013 - 11:45:26 ---A- . (.Intel Corporation - Intel® Gigabit Adapter NDIS 6.x driver.) -- C:\WINDOWS\System32\Drivers\e1i63x64.sys   [460288]

O58 - SDL:17/10/2013 - 01:06:38 ---A- . (.ELAN Microelectronics Corp. - ETD Kernel Center.) -- C:\WINDOWS\System32\Drivers\ETD.sys   [377608]

O58 - SDL:22/08/2013 - 09:43:45 ---A- . (.Broadcom Corporation - Broadcom NetXtreme II 10 GigE VBD.) -- C:\WINDOWS\System32\Drivers\evbda.sys   [3357024]

O58 - SDL:22/08/2013 - 09:43:45 ---A- . (.Hewlett-Packard Company - Smart Array SAS/SATA Controller Media Driver.) -- C:\WINDOWS\System32\Drivers\HpSAMD.sys   [64352]

O58 - SDL:30/07/2013 - 15:47:35 ---A- . (.Intel Corporation - Intel® Serial IO GPIO Controller Driver.) -- C:\WINDOWS\System32\Drivers\iaLPSSi_GPIO.sys   [24568]

O58 - SDL:25/07/2013 - 16:05:39 ---A- . (.Intel Corporation - Intel® Serial IO I2C Controller Driver.) -- C:\WINDOWS\System32\Drivers\iaLPSSi_I2C.sys   [99320]

O58 - SDL:26/02/2014 - 08:11:04 ---A- . (.Intel Corporation - Intel® Rapid Storage Technology driver - x64.) -- C:\WINDOWS\System32\Drivers\iaStorA.sys   [645992]

O58 - SDL:09/08/2013 - 21:39:30 ---A- . (.Intel Corporation - Intel Rapid Storage Technology driver (inbox) - x64.) -- C:\WINDOWS\System32\Drivers\iaStorAV.sys   [651248]

O58 - SDL:22/08/2013 - 09:43:45 ---A- . (.Intel Corporation - Intel Matrix Storage Manager driver - x64.) -- C:\WINDOWS\System32\Drivers\iaStorV.sys   [412000]

O58 - SDL:18/12/2013 - 17:56:10 ---A- . (.Intel Corporation - Intel Graphics Kernel Mode Driver.) -- C:\WINDOWS\System32\Drivers\igdkmd64.sys   [4216320]

O58 - SDL:18/12/2013 - 18:02:19 ---A- . (.Intel® Corporation - Intel® Display Audio Driver.) -- C:\WINDOWS\System32\Drivers\IntcDAud.sys   [450520]

O58 - SDL:14/12/2013 - 20:34:54 ---A- . (.Intel Corporation - Intel® WiDi Solution.) -- C:\WINDOWS\System32\Drivers\intelaud.sys   [39320]

O58 - SDL:14/12/2013 - 20:34:54 ---A- . (.Intel Corporation - Intel® WiDi Solution.) -- C:\WINDOWS\System32\Drivers\iwdbus.sys   [27032]

O58 - SDL:22/08/2013 - 09:43:44 ---A- . (.LSI Corporation - LSI Fusion-MPT SAS Driver (StorPort).) -- C:\WINDOWS\System32\Drivers\lsi_sas.sys   [109408]

O58 - SDL:22/08/2013 - 09:43:45 ---A- . (.LSI Corporation - LSI SAS Gen2 Driver (StorPort).) -- C:\WINDOWS\System32\Drivers\lsi_sas2.sys   [93536]

O58 - SDL:22/08/2013 - 09:43:44 ---A- . (.LSI Corporation - LSI SAS Gen3 Driver (StorPort).) -- C:\WINDOWS\System32\Drivers\lsi_sas3.sys   [81760]

O58 - SDL:22/08/2013 - 09:43:45 ---A- . (.LSI Corporation - LSI SSS PCIe/Flash Driver (StorPort).) -- C:\WINDOWS\System32\Drivers\lsi_sss.sys   [82784]

O58 - SDL:17/03/2015 - 06:15:24 ---A- . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\WINDOWS\System32\Drivers\mbam.sys   [25816]

O58 - SDL:17/03/2015 - 06:15:28 ---A- . (.Malwarebytes Corporation - Malwarebytes Chameleon Protection Driver.) -- C:\WINDOWS\System32\Drivers\mbamchameleon.sys   [107736]

O58 - SDL:27/04/2015 - 20:20:03 ---A- . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\WINDOWS\System32\Drivers\MBAMSwissArmy.sys   [136408]

O58 - SDL:22/08/2013 - 09:43:45 ---A- . (.LSI Corporation - MEGASAS RAID Controller Driver for Windows.) -- C:\WINDOWS\System32\Drivers\megasas.sys   [56672]

O58 - SDL:22/08/2013 - 09:43:45 ---A- . (.LSI Corporation, Inc. - LSI MegaRAID Software RAID Driver.) -- C:\WINDOWS\System32\Drivers\megasr.sys   [575840]

O58 - SDL:22/08/2013 - 09:43:49 ---A- . (.Marvell Semiconductor, Inc. - Marvell Flash Controller Driver.) -- C:\WINDOWS\System32\Drivers\mvumis.sys   [63840]

O58 - SDL:17/03/2015 - 06:15:40 ---A- . (.Malwarebytes Corporation - Malwarebytes Web Access Control.) -- C:\WINDOWS\System32\Drivers\mwac.sys   [64216]

O58 - SDL:18/06/2013 - 15:30:32 ---A- . (.Ralink Technology Corp. - Ralink 802.11n Wireless Adapter Driver.) -- C:\WINDOWS\System32\Drivers\netr28ux.sys   [2408208]

O58 - SDL:18/06/2013 - 11:45:43 ---A- . (.Intel Corporation - Intel® Wireless WiFi Link Driver.) -- C:\WINDOWS\System32\Drivers\NETwew02.sys   [4649440]

O58 - SDL:22/08/2013 - 09:43:31 ---A- . (.NVIDIA Corporation - NVIDIA® nForce RAID Driver.) -- C:\WINDOWS\System32\Drivers\nvraid.sys   [150368]

O58 - SDL:22/08/2013 - 09:43:32 ---A- . (.NVIDIA Corporation - NVIDIA® nForce Sata Performance Driver.) -- C:\WINDOWS\System32\Drivers\nvstor.sys   [168288]

O58 - SDL:15/08/2013 - 03:28:42 ---A- . (.Realtek - Realtek 8101E/8168/8169 NDIS 6.30 64-bit Driver.) -- C:\WINDOWS\System32\Drivers\Rt630x64.sys   [830680]

O58 - SDL:17/10/2013 - 16:36:54 ---A- . (.Realtek Semiconductor Corp. - Realtek UVC Driver for XP/Vista/Win7/Win8.) -- C:\WINDOWS\System32\Drivers\rtsuvc.sys   [8876248]

O58 - SDL:08/08/2013 - 05:27:54 ---A- . (.Realtek Semiconductor Corp. - Realtek USB Mass Storage Driver for 2K/XP/Vista/Win7/Win8.) -- C:\WINDOWS\System32\Drivers\RtsUVStor.sys   [329944]

O58 - SDL:22/08/2013 - 12:35:09 ---A- . (.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) -- C:\WINDOWS\System32\Drivers\secdrv.sys   [23040]

O58 - SDL:22/08/2013 - 09:43:31 ---A- . (.Silicon Integrated Systems Corp. - SiS RAID Stor Miniport Driver.) -- C:\WINDOWS\System32\Drivers\sisraid2.sys   [44896]

O58 - SDL:22/08/2013 - 09:43:32 ---A- . (.Silicon Integrated Systems - SiS AHCI Stor-Miniport Driver.) -- C:\WINDOWS\System32\Drivers\sisraid4.sys   [81760]

O58 - SDL:22/08/2013 - 09:43:32 ---A- . (.Promise Technology, Inc. - Promise SuperTrak EX Series Driver for Windows x64.) -- C:\WINDOWS\System32\Drivers\stexstor.sys   [31072]

O58 - SDL:16/09/2013 - 16:20:12 ---A- . (.Intel Corporation - Intel® Management Engine Interface.) -- C:\WINDOWS\System32\Drivers\TeeDriverx64.sys   [99288]

O58 - SDL:22/08/2013 - 09:43:34 ---A- . (.VIA Technologies, Inc. - VIA Generic PCI IDE Bus Driver.) -- C:\WINDOWS\System32\Drivers\viaide.sys   [19808]

O58 - SDL:22/08/2013 - 09:43:34 ---A- . (.VIA Technologies Inc.,Ltd - VIA RAID DRIVER FOR AMD-X86-64.) -- C:\WINDOWS\System32\Drivers\vsmraid.sys   [168800]

O58 - SDL:22/08/2013 - 09:43:34 ---A- . (.VIA Corporation - VIA StorX RAID Controller Driver.) -- C:\WINDOWS\System32\Drivers\VSTXRAID.SYS   [305504]

O58 - SDL:13/06/2012 - 16:10:32 ---A- . (."CyberLink - Cyberlink Virtual Disk Driver.) -- C:\WINDOWS\System32\Drivers\wsvd.sys   [102376]

O58 - SDL:12/11/2013 - 23:05:22 ---A- . (.Qualcomm Atheros Communications, Inc. - Qualcomm Atheros Extensible Wireless LAN device driver.) -- C:\WINDOWS\System32\athwbx.sys   [3880448]

O58 - SDL:23/04/2015 - 21:17:32 ---A- . (.Basil - WinDivert (web: http://reqrypt.org/windivert.html) (donate: 1C5.) -- C:\WINDOWS\System32\WinDivert64.sys   [38104]

~ Drivers: 61 Scanned in 00mn 04s

---\\ Últimos ficheiros alterados ou criados (Utilizador) (061)

O61 - LFC: 21/04/2015 - 20:57:56 ----- . (.Java Native Access (JNA).) -- C:\Users\Rafael\.AndroidStudio\system\tmp\jna\jna1481104626608926535.dll   [200192]

O61 - LFC: 23/04/2015 - 20:59:41 R--A- . (.Trend Micro Inc..) -- C:\Users\Rafael\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe   [388096]

O61 - LFC: 23/04/2015 - 20:59:54 ---A- . (.Trend Micro Inc..) -- C:\Users\Rafael\Downloads\HijackThis.exe   [388608]

O61 - LFC: 24/04/2015 - 20:59:42 ---A- . (...) -- C:\Users\Rafael\Desktop\adwcleaner_4.202.exe   [2224640]

O61 - LFC: 26/04/2015 - 20:59:54 ---A- . (...) -- C:\Users\Rafael\Desktop\Programas\zoek.exe   [1305600]

O61 - LFC: 26/04/2015 - 20:59:54 ---A- . (...) -- C:\Users\Rafael\Desktop\zoek.exe   [1305600]

O61 - LFC: 27/04/2015 - 20:59:25 ---A- . (...) -- C:\Users\Rafael\AppData\Local\Google\Chrome\User Data\ev_hashes_whitelist.bin   [1113849]

O61 - LFC: 27/04/2015 - 20:59:31 ---A- . (...) -- C:\Users\Rafael\AppData\Local\Microsoft\Outlook\EasCache\D09ABDDA61B646AA94E93A76662B38F4.bin   [1628614]

O61 - LFC: 27/04/2015 - 20:59:54 ---A- . (.Nicolas Coolman.) -- C:\Users\Rafael\Downloads\ZHPDiag2.exe   [6876712]  =>.Nicolas Coolman

~ 12 Fichiers temporaires (Temporary files)

~ 2 Fichiers cookies (Cookies files)

~ Files: 9 Scanned in 02mn 01s

---\\ Lista das ferramentas de remoção de vírus (LAT) (063)

O63 - Logiciel: ZHPDiag 2015 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1  =>.Nicolas Coolman

O63 - Logiciel: HiJackThis - (.Trend Micro.) [HKLM] -- {45A66726-69BC-466B-A7A4-12FCBA4883D7}

~ ADS:  Scanned in 00mn 00s

---\\ Associações Shell Spawning (O67)

O67 - Shell Spawning: <.bat> <batfile>[HKLM\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.cpl> <cplfile>[HKLM\..\cplopen\Command] (.Microsoft Corporation - Windows Control Panel.) -- C:\WINDOWS\System32\control.exe  =>.Microsoft Corporation

O67 - Shell Spawning: <.cmd> <cmdfile>[HKLM\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.com> <comfile>[HKLM\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.evt> <evtfile>[HKLM\..\open\Command] (.Microsoft Corporation - Iniciador do snap-in de 'Visualizar eventos'.) -- C:\WINDOWS\System32\eventvwr.exe

O67 - Shell Spawning: <.exe> <exefile>[HKLM\..\open\Command] (...) -- "%1" %*

O67 - Shell Spawning: <.html> <htmlfile>[HKLM\..\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe

O67 - Shell Spawning: <.js> <JSFile>[HKLM\..\open\Command] (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\Windows\System32\WScript.exe

O67 - Shell Spawning: <.reg> <regfile>[HKLM\..\open\Command] (.Microsoft Corporation - Editor do Registro.) -- C:\WINDOWS\regedit.exe

O67 - Shell Spawning: <.scr> <scrfile>[HKLM\..\open\Command] (...) -- "%1" /S

O67 - Shell Spawning: <.html> <ChromeHTML>[HKCU\..\open\Command] (.Not Key.)

~ FASS Keys: 11 Scanned in 00mn 00s

---\\ Menu de inicialização Internet (068)

O68 - StartMenuInternet: <Google Chrome> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files\Internet Explorer\iexplore.exe

~ Keys:  Scanned in 00mn 00s

---\\ Pesquisa de infeção nos navegadores da Internet (SBI) (069)

O69 - SBI: SearchScopes [HKCU] {012E1000-F331-11DB-8314-0800200C9A66} - (Google) - http://www.google.com

O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com

O69 - SBI: SearchScopes [HKCU] {D7860755-F07F-4E0C-8E10-5FBF636B8CD7} [DefaultScope] - (Bing) - http://www.bing.com

~ Keys:  Scanned in 00mn 00s

---\\ Listagem dos ficheiros Crack & Keygen (CKF) (O82)

C:\Users\Rafael\Desktop\Programas\spyhunter.4.1.11.0.cracked-snd.zip  =>.Crack,Keygen

C:\Users\Rafael\Desktop\Programas\spyhunter.4.1.11.0.cracked-snd.zip  =>.Crack,Keygen

~ Files:  Scanned in 01mn 48s

---\\ Listagem dos serviços iniciados pelo Svchost (SSS) (O83)

O83 - Search Svchost Services: AeLookupSvc (AeLookupSvc) . (.Microsoft Corporation - Serviço de Experiência com Aplicativo.) -- C:\WINDOWS\System32\aelupsvc.dll   [214528]

O83 - Search Svchost Services: CertPropSvc (CertPropSvc) . (.Microsoft Corporation - Serviço de Propagação de Certificado de Cartão Inteligente da Microsof.) -- C:\WINDOWS\System32\certprop.dll   [156160]

O83 - Search Svchost Services: SCPolicySvc (SCPolicySvc) . (.Microsoft Corporation - Serviço de Propagação de Certificado de Cartão Inteligente da Microsof.) -- C:\WINDOWS\System32\certprop.dll   [156160]

O83 - Search Svchost Services: lanmanserver (lanmanserver) . (.Microsoft Corporation - DLL de Serviço do Servidor.) -- C:\WINDOWS\System32\srvsvc.dll   [329216]

O83 - Search Svchost Services: gpsvc (gpsvc) . (.Microsoft Corporation - Cliente da Política de Grupo.) -- C:\WINDOWS\System32\gpsvc.dll   [1360896]

O83 - Search Svchost Services: IKEEXT (IKEEXT) . (.Microsoft Corporation - Extensão IKE.) -- C:\WINDOWS\System32\ikeext.dll   [1084416]

O83 - Search Svchost Services: iphlpsvc (iphlpsvc) . (.Microsoft Corporation - Serviço que oferece conectividade IPv6 em uma rede IPv4..) -- C:\WINDOWS\System32\iphlpsvc.dll   [926208]

O83 - Search Svchost Services: seclogon (seclogon) . (.Microsoft Corporation - DLL de serviço de logon secundário.) -- C:\WINDOWS\system32\seclogon.dll   [31744]

O83 - Search Svchost Services: AppInfo (AppInfo) . (.Microsoft Corporation - Serviço de Informações de Aplicativos.) -- C:\WINDOWS\System32\appinfo.dll   [110080]

O83 - Search Svchost Services: msiscsi (msiscsi) . (.Microsoft Corporation - Serviço de Descoberta iSCSI.) -- C:\WINDOWS\System32\iscsiexe.dll   [151040]

O83 - Search Svchost Services: EapHost (EapHost) . (.Microsoft Corporation - Serviço Microsoft EAPHost.) -- C:\WINDOWS\System32\eapsvc.dll   [110592]

O83 - Search Svchost Services: schedule (schedule) . (.Microsoft Corporation - Serviço Agendador de Tarefas.) -- C:\WINDOWS\System32\schedsvc.dll   [1265152]

O83 - Search Svchost Services: winmgmt (winmgmt) . (.Microsoft Corporation - WMI.) -- C:\WINDOWS\System32\wbem\WMIsvc.dll   [230400]

O83 - Search Svchost Services: MMCSS (MMCSS) . (.Microsoft Corporation - Serviço Agendador de Classes de Multimídia.) -- C:\WINDOWS\System32\mmcss.dll   [71168]

O83 - Search Svchost Services: browser (browser) . (.Microsoft Corporation - DLL de Serviço Pesquisador de Computadores.) -- C:\WINDOWS\System32\browser.dll   [135168]

O83 - Search Svchost Services: ProfSvc (ProfSvc) . (.Microsoft Corporation - ProfSvc.) -- C:\WINDOWS\System32\profsvc.dll   [225280]

O83 - Search Svchost Services: SessionEnv (SessionEnv) . (.Microsoft Corporation - Serviço de Configuração da Área de Trabalho Remota.) -- C:\WINDOWS\System32\sessenv.dll   [339968]

O83 - Search Svchost Services: wercplsupport (wercplsupport) . (.Microsoft Corporation - Relatórios de Problemas e Soluções.) -- C:\WINDOWS\System32\wercplsupport.dll   [84992]

O83 - Search Svchost Services: hkmsvc (hkmsvc) . (.Microsoft Corporation - Serviço de Gerenciamento de Chaves.) -- C:\WINDOWS\System32\kmsvc.dll   [101376]

O83 - Search Svchost Services: BDESVC (BDESVC) . (.Microsoft Corporation - Serviço BDE.) -- C:\WINDOWS\System32\bdesvc.dll   [348672]

O83 - Search Svchost Services: lfsvc (lfsvc) . (.Microsoft Corporation - Serviço de Estrutura de Localização do Windows.) -- C:\WINDOWS\System32\GeofenceMonitorService.dll   [521728]

O83 - Search Svchost Services: wlidsvc (wlidsvc) . (.Microsoft Corporation - Serviço Conta da Microsoft®.) -- C:\WINDOWS\System32\wlidsvc.dll   [1639424]

O83 - Search Svchost Services: Themes (Themes) . (.Microsoft Corporation - DLL do Serviço de Tema do Shell do Windows.) -- C:\WINDOWS\System32\themeservice.dll   [59392]

O83 - Search Svchost Services: DsmSvc (DsmSvc) . (.Microsoft Corporation - Gerenciador de Instalação de Dispositivo.) -- C:\WINDOWS\System32\DeviceSetupManager.dll   [206848]

O83 - Search Svchost Services: NcaSvc (NcaSvc) . (.Microsoft Corporation - Serviço Assistente de Conectividade de Rede da Microsoft.) -- C:\WINDOWS\System32\ncasvc.dll   [166400]

O83 - Search Svchost Services: Rasauto (Rasauto) . (.Microsoft Corporation - Gerenciador de Discagem Automática de Acesso Remoto.) -- C:\WINDOWS\System32\rasauto.dll   [102912]

O83 - Search Svchost Services: Rasman (Rasman) . (.Microsoft Corporation - Gerenciador de conexão de acesso remoto.) -- C:\WINDOWS\System32\rasmans.dll   [542208]

O83 - Search Svchost Services: Remoteaccess (Remoteaccess) . (.Microsoft Corporation - Gerenciador de Interface Dinâmica.) -- C:\WINDOWS\System32\mprdim.dll   [226816]

O83 - Search Svchost Services: SENS (SENS) . (.Microsoft Corporation - Serviço de Notificação de Eventos do Sistema (SENS).) -- C:\WINDOWS\System32\sens.dll   [73728]

O83 - Search Svchost Services: Sharedaccess (Sharedaccess) . (.Microsoft Corporation - Componentes do Microsoft NAT Helper.) -- C:\WINDOWS\System32\ipnathlp.dll   [452608]

O83 - Search Svchost Services: Tapisrv (Tapisrv) . (.Microsoft Corporation - Servidor de telefonia do Microsoft® Windows.) -- C:\WINDOWS\System32\tapisrv.dll   [313344]

O83 - Search Svchost Services: wuauserv (wuauserv) . (.Microsoft Corporation - Windows Update Agent.) -- C:\WINDOWS\System32\wuaueng.dll   [3678720]

O83 - Search Svchost Services: BITS (BITS) . (.Microsoft Corporation - Serviço de transferência inteligente de tela de fundo.) -- C:\WINDOWS\System32\qmgr.dll   [933376]

O83 - Search Svchost Services: ShellHWDetection (ShellHWDetection) . (.Microsoft Corporation - DLL de serviços do Shell do Windows.) -- C:\WINDOWS\System32\shsvcs.dll   [640000]

~ Services: 34 Scanned in 00mn 00s

---\\ Pesquisa adicional à raiz do sistema (radicular) (SPRF) (O84)

[MD5.9B806BB95DE75F34E851BEA93E416F51] [sPRF][05/02/2015] (...) -- C:\Users\Rafael\AppData\Roaming\unins000.dat   [16024]

[MD5.BCA7C7F35103894AC6D403C0917DF0F3] [sPRF][24/04/2015] (.No owner - Aut2Exe.) -- C:\Users\Rafael\Desktop\adwcleaner_4.202.exe   [2224640]

[MD5.48190C8B4A6BC41A830B515CC2B6BCEA] [sPRF][16/02/2014] (...) -- C:\Users\Rafael\Desktop\Gang Beasts.exe   [11283968]

[MD5.F2CD2FEBC420A46BF6B334680B27025F] [sPRF][27/11/2014] (...) -- C:\Users\Rafael\Desktop\GMStudio-Installer-1.4.1464.exe   [70573168]

[MD5.8EF6C98EEABACF8660D03B7C5F3C1EE1] [sPRF][26/04/2015] (...) -- C:\Users\Rafael\Desktop\zoek.exe   [1305600]

~ Files: 5 Scanned in 00mn 01s

---\\ Pesquisa de infeção Rogue (SRI) (O86)

O43 - CFD: 14/04/2015 - 23:12:11 - [] ----D C:\ProgramData\D0E43261231BCC5F8018B49E24D831B2

~ Files:  Scanned in 00mn 00s

---\\ Lista das exceções do FireWall (FirewallRules) (O87)

O87 - FAEL: "{7FC00755-A15A-4937-BD84-8E02DF7AE422}" | In - None - P6 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\Rafael\AppData\Roaming\uTorrent\uTorrent.exe  =>P2P.BitTorrent

O87 - FAEL: "{70093928-19F4-42E6-AB0F-C1ECD9595C9A}" | In - None - P17 - TRUE | .(.BitTorrent Inc. - µTorrent.) -- C:\Users\Rafael\AppData\Roaming\uTorrent\uTorrent.exe  =>P2P.BitTorrent

~ Firewall: 2 Scanned in 00mn 08s

---\\ Listagem dos dados da chave NameSpace (MNS) (O92)

O92 - MNS:  - {1CF1260C-4DD0-4ebb-811F-33C572699FDE}

O92 - MNS:  - {374DE290-123F-4565-9164-39C4925E467B}

O92 - MNS:  - {3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}

O92 - MNS:  - {A0953C92-50DC-43bf-BE83-3742FED03C9C}

O92 - MNS:  - {A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}

O92 - MNS:  - {B4BFCC3A-DB2C-424C-B029-7FE99A87C641}

~ MNS: 6 Scanned in 00mn 00s

---\\ Estado general dos serviços não Microsoft (EGS) (SR=Executados, SS=Parados)

SS - | Demand 23/12/2013 279024 |  (cphs) . (.Intel Corporation.) - C:\WINDOWS\SysWow64\IntelCpHeciSvc.exe

SS - | Auto 27/01/2015 107912 |  (gupdate) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

SS - | Demand 27/01/2015 107912 |  (gupdatem) . (.Google Inc..) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

SS - | Demand 27/08/2013 828376 |  (Intel® Capability Licensing Service TCP IP Interface) . (.Intel® Corporation.) - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe

SS - | Demand 03/06/2014 533760 |  (Lenovo EasyPlus Hotspot) . (.Lenovo.) - C:\Program Files (x86)\Common Files\lenovo\easyplussdk\bin\EPHotspot64.exe

SS - | Demand 16/10/2014 272776 |  (LSCWinService) . (...) - C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe

SS - | Auto 17/03/2015 1871160 |  (MBAMScheduler) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

SS - | Auto 17/03/2015 1080120 |  (MBAMService) . (.Malwarebytes Corporation.) - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

SS - | Auto 02/01/2015 315488 |  (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe

SS - | Demand 29/10/2014 38792 | C:\WINDOWS\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\WINDOWS\System32\svchost.exe

SR - | Auto 29/10/2013 317568 |  (AtherosSvc) . (.Windows ® Win 7 DDK provider.) - C:\Program Files (x86)\Bluetooth Suite\adminservice.exe

SR - | Auto 25/07/2013 206552 |  (CxAudMsg) . (.Conexant Systems Inc..) - C:\WINDOWS\system32\CxAudMsg64.exe

SR - | Auto 09/10/2013 99632 |  (ETDService) . (.ELAN Microelectronics Corp..) - C:\Program Files\Elantech\ETDService.exe

SR - | Auto 29/09/2014 546104 |  (GbpSv) . (.GAS Tecnologia.) - C:\Program Files (x86)\GbPlugin\gbpsv.exe

SR - | Auto 26/02/2014 16232 |  (IAStorDataMgrSvc) . (.Intel Corporation.) - C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

SR - | Auto 27/08/2013 747520 |  (Intel® Capability Licensing Service Interface) . (.Intel® Corporation.) - C:\Program Files\Intel\iCLS Client\HeciServer.exe

SR - | Auto 16/09/2013 169432 |  (jhi_service) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

SR - | Auto 21/05/2014 584960 |  (Lenovo System Agent Service) . (.LENOVO INCORPORATED..) - C:\Program Files\Lenovo\iMController\SystemAgentService.exe

SR - | Auto 28/11/2014 198192 |  (LenovoWiFiHotspotSvr) . (.Lenovo(beijing) Limited.) - C:\Windows\System32\LenovoWiFiHotspotSvr.exe

SR - | Auto 16/09/2013 390616 |  (LMS) . (.Intel Corporation.) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

SR - | Auto 24/04/2012 390632 |  (RichVideo64) . (...) - C:\Program Files\CyberLink\Shared files\RichVideo64.exe

SR - | Auto 22/07/1658 0 |  (SAService) . (.Conexant Systems, Inc..) - C:\WINDOWS\System32\SAsrv.exe

SR - | Auto 28/11/2014 68368 |  (VeriFaceSrv) . (...) - C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe

SR - | Auto 06/09/2014 847160 |  (Warsaw Technology) . (.GAS Tecnologia LTDA.) - C:\Program Files\Diebold\Warsaw\core.exe

SR - | Demand 22/07/1658 0 |  (WdNisSvc) . (...) - C:\Program Files (x86)\Windows Defender\NisSrv.exe

SR - | Auto 22/07/1658 0 |  (WinDefend) . (...) - C:\Program Files (x86)\Windows Defender\MsMpEng.exe

SR - | Auto 22/07/1658 0 |  (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe  =>.Microsoft Corporation

SR - | Auto 29/10/2013 323584 |  (ZAtheros Bt and Wlan Coex Agent) . (.Atheros.) - C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe

~ Services:  Scanned in 00mn 12s

---\\ Pesquisa de infeção no Registo Mestre de Inicialização (MBR) (080)

Run by Rafael at 27/04/2015 21:02:17

~ OS 64 not supported by MBR tool

~ MBR: 0 Scanned in 00mn 00s

---\\ Pesquisa de infeção no Registo Mestre de Inicialização (MBRCheck) (080)

Written by ad13, http://ad13.geekstog

Run by Rafael at 27/04/2015 21:02:19

******* Dump file Name *******

C:\PhysicalDisk0_MBR.bin

~ MBR:  Scanned in 00mn 02s

---\\ Scâner Aditional (088)

Database Version : 13008 - (25/04/2015)

Clés trouvées (Keys found) : 1

Valeurs trouvées (Values found) : 3

Dossiers trouvés  (Folders found) : 2

Fichiers trouvés  (Files found) : 1

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent]   =>P2P.BitTorrent^

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]:uTorrent   =>P2P.BitTorrent^

C:\ProgramData\Microsoft Toolkit   =>Trojan.AutoKMS^

C:\Users\Rafael\AppData\Roaming\uTorrent   =>P2P.µTorrent^

[HKCU\Software\BitTorrent]   =>P2P.BitTorrent^

~ Additionnel Scan: 265834 Items scanned in 00mn 14s

---\\ Informações complémentaires do módulos

~ http://nicolascoolman.fr/g2-google-chrome-extensions/  =>.Google Chrome, Arranque,Pesquisa,Extensões (G0,G1,G2)

~ http://nicolascoolman.fr/r5-internet-explorer-proxy-management-iepm/  =>.Internet Explorer, Gestão do Proxy (R5)

~ http://nicolascoolman.fr/o2-browser-helper-objects-de-navigateur/  =>.Browser Helper Objects do navegador (02)

~ http://nicolascoolman.fr/o4-applications-demarrees-par-le-registre/  =>.Aplicações iniciadas por registo & pastas (04)

~ AMI: 4 Scanned in 00mn 00s

---\\ Sumário das deteções encontradas na sua estação

http://nicolascoolman.fr/trojan-autokms  =>Trojan.AutoKMS

~ MSI: 1 link(s) detected in 00mn 00s

End of the scan (1182 lines in 05mn 45s)(2.6)

:seta: Há vários programas desnecessários iniciando junto com o Windows, o que torna o seu PC mais lento. Para corrigir isto, siga as dicas deste tutorial:

Escolhendo Programas que Iniciam com o PC

De preferência deixe apenas os programas de segurança (anti-vírus/anti-spywares/firewall) iniciarem junto com o Windows.

Use também o programa Ccleaner, indicado neste tutorial acima, para fazer uma limpeza e otimização do PC.

___________________________________________________________________________

:seta: Selecione e copie todo o texto destacado em vermelho abaixo (começando em script zhpfix e indo até emptyclsid)

script zhpfix

SysRestore

[HKCU\Software\Baidu Security]

O43 - CFD: 28/11/2014 - 09:49:53 - [] ----D C:\Program Files (x86)\Baidu Security

O43 - CFD: 28/11/2014 - 09:50:02 - [] ----D C:\ProgramData\Baidu Security

O43 - CFD: 21/04/2015 - 21:45:22 - [] ----D C:\ProgramData\boost_interprocess

O43 - CFD: 14/04/2015 - 23:12:11 - [] ----D C:\ProgramData\D0E43261231BCC5F8018B49E24D831B2

O43 - CFD: 26/01/2015 - 21:36:59 - [] ----D C:\Users\Rafael\AppData\Roaming\Baidu Security

O69 - SBI: SearchScopes [HKCU] {012E1000-F331-11DB-8314-0800200C9A66} - (Google) - http://www.google.com

O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com

O69 - SBI: SearchScopes [HKCU] {D7860755-F07F-4E0C-8E10-5FBF636B8CD7} [DefaultScope] - (Bing) - http://www.bing.com

C:\ProgramData\D0E43261231BCC5F8018B49E24D831B2

ShortcutFix

EmptyTemp

EmptyFlash

emptyclsid

_____________________________________________________________________________________________________________

:seta: Vá no menu: Iniciar > Todos os programas > ZHP > Clique com o botão direito do mouse sobre o Zhpfix e escolha a opção de Executar como administrador > Clique em Importação > Clique no botão GO > Clique em Oui > Caso queira que os arquivos da lixeira sejam excluídos clique em Oui novamente > Um relatório aparecerá no bloco de notas.

Copie este relatório e poste em sua próxima resposta e nos diga como está o PC depois destes procedimentos.

Nota: Esse script foi elaborado somente para este computador, de acordo com os arquivos e chaves presentes.

Aos visitantes: Se estiverem com um problema semelhante, não utilizem esse script, pois o uso sem supervisão pode causar danos ao sistema.

Rapport de ZHPFix 2015.4.9.5 par Nicolas Coolman, Update du 18/03/2015

Fichier d'export Registre :

Run by Rafael at 28/04/2015 22:35:54

High Elevated Privileges : OK

Windows 8 Home Premium Edition, 64-bit Service Pack 1 (9600)

Boa noite Power Max!

Fiz os procedimentos, as propagandas ainda não saíram!

mas está mais rápido a navegação

Reciclagem vazia (00mn 04s)

Reparação de atalhos do navegador

========== Chaves do Registo ==========

ELIMINÉ: HKCU\Software\Baidu Security

ELIMINÉ: SearchScopes :{012E1000-F331-11DB-8314-0800200C9A66}

ELIMINÉ: SearchScopes :{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

ELIMINÉ: SearchScopes :{D7860755-F07F-4E0C-8E10-5FBF636B8CD7}

========== Pastas ==========

Nenhuma pasta CLSID local utilizador vazia

========== Ficheiros ==========

ELIMINÉ Temporários windows (15) (2.099.418 octets)

ELIMINÉ Flash Cookies (0) (0 octets)

========== Restauração Sistema ==========

Ponto de restauro do sistema criado com sucesso

========== Recapitulativo ==========

4 : Chaves do Registo

1 : Pastas

2 : Ficheiros

1 : Restauração Sistema

End of clean in 00mn 34s

========== Caminho do ficheiro do relatório ==========

C:\Users\Rafael\AppData\Roaming\ZHP\ZHPFix[R1].txt - 28/04/2015 22:35:58 [1071]

Faça o download do < ZHPCleaner > < /applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/NicolasCoolman.jpg&key=31eaca9d787a5cb7b785eaca882cfe95bdd41bfffaf35086b6e7ecf044ef83cf" alt="NicolasCoolman.jpg" />> ( ... de Nicolas Coolman )

Obs: Ao acessar o link acima clique no botão Télécharger referente ao ZHPCleaner para baixá-lo, tal como mostra a imagem abaixo:

/applications/core/interface/imageproxy/imageproxy.php?img=http://1.bp.blogspot.com/-XrvMIHU4fq8/U-aZGnLHUMI/AAAAAAAAhog/DrsOUsZ4FKI/s1600/tutorial_do_zhpcleaner_2.jpg&key=62c7d7c7c3f51241c1fb6d310912f8f1f311cf57fe86fb92293eae54f2e92db8" alt="tutorial_do_zhpcleaner_2.jpg" />

Para executá-lo corretamente siga as dicas desta postagem:

Tutorial completo do ZHPCleaner

Após a utilização dele, copie todo o conteúdo do seu relatório ZHPCleaner.txt e poste em sua próxima resposta.

Boa noite Power Max,

as propagandas persistem;

~ ZHPCleaner v2015.4.29.198 by Nicolas Coolman (29/04/2015)

~ Run by Rafael (Administrator) (29/04/2015 22:53:22)

~ Forum : http://forum.nicolascoolman.fr

~ Facebook : https://www.facebook.com/nicolascoolman1

~ State version : Version OK

~ Type : Reparo

~ Report : C:\Users\Rafael\Desktop\ZHPCleaner.txt

~ Quarantine : C:\Users\Rafael\AppData\Roaming\ZHP\ZHPCleaner_Quarantine.txt

~ UAC : Activate

~ Boot Mode : Normal (Normal boot)

~ Windows 81, 64-bit (Build 9600)

---\\ Serviços (0)

~ Nenhum ítem malicioso foi encontrado.

---\\ Navegadores de Internet (0)

~ Nenhum ítem malicioso foi encontrado.

---\\ Arquivo hosts (2)

SUBSTITUIDO:

Número de redirecionamentos encontrados 1/20

---\\ Tarefas automáticas agendadas. (0)

~ Nenhum ítem malicioso foi encontrado.

---\\ Explorer ( Arquivos, Pastas) (3)

MOVIDO pasta: C:\WINDOWS\AutoKMS\AutoKMS.log (Trojan.AutoKMS)

MOVIDO arquivo: C:\ProgramData\Microsoft Toolkit (Trojan.AutoKMS)

MOVIDO arquivo: C:\WINDOWS\AutoKMS (Trojan.AutoKMS)

---\\ Registro ( Chaves, Valores, Dados ) (1)

SUPRIMIDO valor: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_624A76E5D876DF68D809BD3DD31AB481 ["C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window] (PUP.Vosteran)

---\\ Resultado de reparação

Reparação efectuada com sucesso

~ Este navegador está faltando ! (Mozilla Firefox)

~ Este navegador está faltando ! (Opera Software)

---\\ Estatísticas

~ Items scan : 3385

~ Items encontrado : 1

~ items cancelados : 0

~ Items réparo : 4

End of clean at 22:53:32

===================

ZHPCleaner-[R]-29042015-22_53_32.txt

ZHPCleaner--29042015-22_52_56.txt

Abra o Malwarebytes que você instalado em seu PC.

Clique na opção Atualize na tela principal dele, para que ele seja atualizado.

_________________________________________________

Siga as dicas abaixo para fazer a limpeza completa:

Alterando o idioma do Malwarebytes para o português:

Caso o idioma do seu Malwarebytes esteja em inglês é bem simples mudá-lo para nossa língua. Para isto abra o Malwarebytes e clique em Settings > Clique na palavra English > Clique na opção Português (Brasil) > como mostra esta imagem:

/applications/core/interface/imageproxy/imageproxy.php?img=http://4.bp.blogspot.com/-kdlrNX2UkE0/VRrBV0EccAI/AAAAAAAAm-c/KbeBLVH58DE/s1600/tutorial-do-malwarebytes-12.jpg&key=c92dee6a2174c537f5a175c2853d1d29e547fdeb573aa25d729116dd6f2a2061" alt="tutorial-do-malwarebytes-12.jpg" />

___________________________________________________________________________

Como executar uma verificação personalizada com o Malwarebytes:

• Abra o Malwarebytes > Clique em Verificar > clique em Verificação Personalizada > Clique em Configurar Varredura:

/applications/core/interface/imageproxy/imageproxy.php?img=http://3.bp.blogspot.com/-tH45mY1TAwo/VRqias8FBFI/AAAAAAAAm8M/ESl_okOmFcU/s1600/tutorial-do-malwarebytes-1.jpg&key=850794c045458e6240aa030389fd9446710882576a4ed03d927ac349272c0ab4" alt="tutorial-do-malwarebytes-1.jpg" />

Surgirá mais esta tela abaixo na qual você marcará todas as caixinhas do lado direito da tela para que todas as áreas de seu PC e mídias removíveis ligadas a ele possam ser escaneadas. E do lado esquerdo da tela deixe marcadas todas estas opções:

Verificar Objetos na Memória

Verificar Inicialização e Registro

Verificar Arquivos Compactados

Verificar Rootkits

Quanto ao restante, deixe da forma já pré-configurada pelo Malwarebytes.

Depois disto clique no botão Verificar Agora como mostra a imagem abaixo:

/applications/core/interface/imageproxy/imageproxy.php?img=http://4.bp.blogspot.com/-fzL_o1JZdzk/VRqj4yy4OZI/AAAAAAAAm8Y/jTTJCoxRRv8/s1600/tutorial-do-malwarebytes-2.jpg&key=640cd38471b68602212fabe7376b94cda75186c8c25d9e82e6a662033014c1f4" alt="tutorial-do-malwarebytes-2.jpg" />

Aguarde enquanto o escaneamento é realizado. Ele demora de acordo com a quantidade de arquivos que você possua em seu computador:

/applications/core/interface/imageproxy/imageproxy.php?img=http://2.bp.blogspot.com/-ZuLCGpkiCC8/VRqlWy7UJgI/AAAAAAAAm8k/u6Uojg4Ug-s/s1600/tutorial-do-malwarebytes-3.jpg&key=38d22b8895ca791426b0e4e4db21be3dc6c0cf9ff13782f4ca2fcd523c5874f7" alt="tutorial-do-malwarebytes-3.jpg" />

Assim que a verificação terminar, aparecerá a frase Verificação Personalizada completada com sucesso. Caso seu PC esteja seguro e sem ameaças, uma mensagem parecida com esta abaixo aparecerá informando que "Ameaças Identificadas: 0" (Ou seja: Nenhum ítem malicioso foi detectado). Neste caso tudo está certo, seu computador está normal e você clicará no botão Terminar:

/applications/core/interface/imageproxy/imageproxy.php?img=http://1.bp.blogspot.com/-aikgWF97noM/VRqu7FOiKRI/AAAAAAAAm80/CXCDyWAa5iE/s1600/tutorial-do-malwarebytes-4.jpg&key=c560d8b1b3b627794c9639ef877ec74b558cbedbdba63c76f5e9f28f20c81ae4" alt="tutorial-do-malwarebytes-4.jpg" />

Caso seja detectada alguma ameaça em seu PC surgirá uma mensagem como esta abaixo próximo ao relógio do Windows com a frase Verificação Terminada - Malware Detectado na qual você clicará nela:

/applications/core/interface/imageproxy/imageproxy.php?img=http://2.bp.blogspot.com/-s9ZpQbBk3Uc/VRrIDsxEXNI/AAAAAAAAm-s/KZfNDK3We-k/s1600/tutorial-do-malwarebytes-13.jpg&key=65f5c5e7bdcbe89da4b2286766e9432cb5ea3740667adcfc5e64b3ac45bb2cb0" alt="tutorial-do-malwarebytes-13.jpg" />

Neste momento aparecerá quais os malwares e itens potencialmente indesejáveis que foram detectados e os locais onde eles se encontram. Para remover a infecção, deixe todas as caixinhas marcadas em todos os itens que queira remover e clique no botão Remover Selecionadas, como mostra esta imagem:

/applications/core/interface/imageproxy/imageproxy.php?img=http://4.bp.blogspot.com/-ceIKFVvsMa4/VRrKrKgkJbI/AAAAAAAAm-4/Bl24zmzgEbo/s1600/tutorial-do-malwarebytes-14.jpg&key=1ae8bd0a725b9dcab62148dea867b178997307986aca93d8c3f0aecac91d6260" alt="tutorial-do-malwarebytes-14.jpg" />

Surgirá então uma outra tela parecida com esta abaixo informando que as ameaças foram enviadas à quarentena, na qual você clicará no botão Terminar:

/applications/core/interface/imageproxy/imageproxy.php?img=http://1.bp.blogspot.com/-jA7x-zQHPGA/VRrMm5RRZtI/AAAAAAAAm_E/tZ-dJsxO2r0/s1600/tutorial-do-malwarebytes-15.jpg&key=2620db10edd21dafd93aaebe1ad0a02c1d3054a73205835d2429f07c61ead559" alt="tutorial-do-malwarebytes-15.jpg" />

Alguns malwares são rebeldes e podem necessitar de uma reinicialização do PC para que sejam removidos. Caso isto seja solicitado pelo Malwarebytes, aceite esta reinicialização pelo Malwarebytes.

Depois disto é só postar o novo Scan Log (log de verificação) que o Malwarebytes irá criar em sua próxima resposta:

/applications/core/interface/imageproxy/imageproxy.php?img=http://2.bp.blogspot.com/-yMdprRgrUi8/VRq2laaIklI/AAAAAAAAm9Y/1lhE9WtS4HU/s1600/tutorial-do-malwarebytes-7.jpg&key=c02a9b1529af17124552ae7c905292c03ff4a0e09f881f7ed05b3c7b3ddd0205" alt="tutorial-do-malwarebytes-7.jpg" />

Tópico Arquivado

Como o autor não respondeu por mais de 10 dias, o tópico foi arquivado.

Caso você seja o autor do tópico e quer reabrir, envie uma mensagem privada para um moderador da área juntamente com o link para este tópico e explique o motivo da reabertura.