Publicado em 25 de jul.

[Resolvido] Infecção após instalação de arquivo de instalação do office 2016

#topicos-resolvidos-seguranca-malwares #ativação do office #office #travando #vírus

Olá,

Depois de tentar ativar o office, acho que o computador ficou infectado por vírus. Trava o tempo todo e fica abrindo páginas no navegador Edge sem parar. Verifiquei com o SDefender, mas não encontrou nenhuma ameaça. Seguem logs:

**Addition: https://www.cjoint.com/c/HGzoVqnmOI7
FRST: https://www.cjoint.com/c/HGzoWHMtph7**

Obrigado,

Weick

Edit: receio ter aberto o tópico no local errado. Tentei mover, mas acredito que somente moderadores podem fazer isso. Caso esteja em local errado, peço a gentileza de mover.

Discussão (23)

Entre ou cadastre-se para participar da discussão

Entrar Criar conta

DigRam· 26 de jul.

/_ Boa Noite! Weick _\

CHR NewTab: Default -> "active" : true,

"entry" : "chrome-extension://pbdpajcdgknpendpmecafmopknefafha/index.html"
CHR Extension: (Sem Nome) - C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2017-03-31]
CHR Extension: (Sem Nome) - C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbdpajcdgknpendpmecafmopknefafha [2018-07-25]
CHR Extension: (Sem Nome) - C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-05-04]

> Remova estas extensões que foram configuradas ao Chrome.

> Copie estas informações que estão em vermelho,para o Bloco de Notas.

> Salve-as com o nome fixlist. << Texto ou Unicode,caso solicite!

> Salve-as ao desktop! ( Área de trabalho ... )

start::

CloseProcesses:

CHR HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx

HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRHOjYN9_5EdL7qPpMxkVuvqY6tXmgtW6wAq_3G5aRco9xrGZxVyM2GZowPWLCnrE5-o3T5PvCiWBNp7C365g29QHzrQ_-Q6i6SMeSurTM_DlqpsmQW-vgJ-s5jnpv1WFmjBqtjya1W23S7WHC-Kg3Npq-3_weHm1OPiPYTC1ZIReyP9n5FUImu5Wf0A,,&q={searchTerms}

HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRHOjYN9_5EdL7qPpMxkVuvqY6tXmgtW6wAq_3G5aRco9xrGZxVyM2GZowPWLCnrE5-o3T5PvCiWBNp7C365g29QHzrQ_-Q6i2FbbulbtMY_yhObfZdyUfOkI7kD0ZA0LYE6wMhUmU5eiW6pFIWauP8C0c831GHhjlFuXbHmEibJBW4nmFSdVyH_qDWg,,

HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung17win10.msn.com/?pc=SMTE

SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL =

SearchScopes: HKLM-x32 -> ielnksrch URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRHOjYN9_5EdL7qPpMxkVuvqY6tXmgtW6wAq_3G5aRco9xrGZxVyM2GZowPWLCnrE5-o3T5PvCiWBNp7C365g29QHzrQ_-Q6i6SMeSurTM_DlqpsmQW-vgJ-s5jnpv1WFmjBqtjya1W23S7WHC-Kg3Npq-3_weHm1OPiPYTC1ZIReyP9n5FUImu5Wf0A,,&q={searchTerms}

SearchScopes: HKU\S-1-5-21-4216877997-3920459586-2356809368-1001 -> DefaultScope {ielnksrch} URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRHOjYN9_5EdL7qPpMxkVuvqY6tXmgtW6wAq_3G5aRco9xrGZxVyM2GZowPWLCnrE5-o3T5PvCiWBNp7C365g29QHzrQ_-Q6i6SMeSurTM_DlqpsmQW-vgJ-s5jnpv1WFmjBqtjya1W23S7WHC-Kg3Npq-3_weHm1OPiPYTC1ZIReyP9n5FUImu5Wf0A,,&q={searchTerms}

SearchScopes: HKU\S-1-5-21-4216877997-3920459586-2356809368-1001 -> {72B10185-4FDD-4808-B788-0FF5F4CD5EE6} URL =

SearchScopes: HKU\S-1-5-21-4216877997-3920459586-2356809368-1001 -> {ielnksrch} URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRHOjYN9_5EdL7qPpMxkVuvqY6tXmgtW6wAq_3G5aRco9xrGZxVyM2GZowPWLCnrE5-o3T5PvCiWBNp7C365g29QHzrQ_-Q6i6SMeSurTM_DlqpsmQW-vgJ-s5jnpv1WFmjBqtjya1W23S7WHC-Kg3Npq-3_weHm1OPiPYTC1ZIReyP9n5FUImu5Wf0A,,&q={searchTerms}

	HKLM\...\RunOnce: [OMEWPRODUCT_4RRFH] => C:\Program Files (x86)\c4e5i2idlbs\OOBC5V8XNIXC5DE.exe [193536 2018-07-25] (BLJO) <==== ATENÇÃO

	HKLM\...\RunOnce: [zdkvpsyzhf3] => C:\Program Files (x86)\PMLO\3483853.exe [664576 2018-07-25] ()

	HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\...\Run: [820BKYM9V8OASAZ] => C:\Program Files\A949NS6C3O\A949NS6C3.exe [807936 2018-07-25] (BLJO)

	HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\...\Run: [429699] => C:\Users\Maple Bear\AppData\Roaming\cls4bkk0nhm\0gxe04bloba.exe [537110 2018-07-25] (Gobm )

	HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\...\Run: [M0D7OJRDPF3F6NY] => C:\Program Files (x86)\c4e5i2idlbs\NF0EX.exe [807936 2018-07-25] (BLJO)

	HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\...\Run: [VC1FWU7Y5L7D8BJ] => C:\Program Files\V1OBNIOUTS\V1OBNIOUT.exe [807936 2018-07-25] (BLJO)

	HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\...\Run: [UEALPTNUMJEH081] => C:\Program Files\K7BMDM64GL\K7BMDM64G.exe [807936 2018-07-25] (BLJO)

	HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\...\Run: [302225] => C:\Users\Maple Bear\AppData\Roaming\24rdlfd0zir\tzja4yvdwjd.exe [537110 2018-07-25] (Gobm )

	HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\...\Run: [5481861] => C:\Users\Maple Bear\AppData\Roaming\2ltuu2jza0t\2ftovy5o1l2.exe [537110 2018-07-25] (Gobm )

	HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\...\Run: [1675006] => C:\Users\Maple Bear\AppData\Roaming\k4mm4u3gy20\2ri0gursg3e.exe [537110 2018-07-25] (Gobm )

	HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\...\Run: [CH84B2JIHH5X4SC] => C:\Program Files\ZISY2WDKFX\MTLJUW7JF.exe [807936 2018-07-25] (BLJO)

	HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\...\Run: [1258538] => C:\Users\Maple Bear\AppData\Roaming\odo1acbzw4o\5vc1e2cenqa.exe [537110 2018-07-25] (Gobm )

	HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\...\Run: [BQLVFXD9T03PGIF] => C:\Program Files\1QGDTP0T64\O19YLPUS7.exe [807936 2018-07-25] (BLJO)

	HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\...\Run: [J57LKTND4O41WEU] => C:\Program Files\NTFAJC7CK1\UW3WJF3WE.exe [807936 2018-07-25] (BLJO)

	HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\...\Run: [6177928] => C:\Users\Maple Bear\AppData\Roaming\fuhvesj40b5\q3xcuyv5arf.exe [537110 2018-07-25] (Gobm )

	AppInit_DLLs: C:\ProgramData\Voyasollam\Sumtom.dll => Nenhum Arquivo

	AppInit_DLLs-x32: C:\ProgramData\Voyasollam\Ranloting.dll => Nenhum Arquivo

	GroupPolicy: Restrição - Chrome <==== ATENÇÃO

	CHR HKLM\SOFTWARE\Policies\Google: Restrição <==== ATENÇÃO

	R2 backlh; C:\ProgramData\Logic Cramble\set.exe [3780096 2018-07-24] () [Arquivo não assinado] <==== ATENÇÃO

	R2 Nettrans; C:\ProgramData\PrefsSecure\Nettrans.exe [43520 2018-07-25] () [Arquivo não assinado] <==== ATENÇÃO

	2018-07-25 10:50 - 2018-07-25 10:50 - 000000000 ____D C:\Users\Maple Bear\AppData\Roaming\fuhvesj40b5

	2018-07-25 10:50 - 2018-07-25 10:50 - 000000000 ____D C:\Program Files\NTFAJC7CK1

	2018-07-25 10:29 - 2018-07-25 10:29 - 000000000 ____D C:\Users\Maple Bear\AppData\Roaming\odo1acbzw4o

	2018-07-25 10:29 - 2018-07-25 10:29 - 000000000 ____D C:\Program Files\ZISY2WDKFX

	2018-07-25 10:29 - 2018-07-25 10:29 - 000000000 ____D C:\Program Files\1QGDTP0T64

	2018-07-25 10:28 - 2018-07-25 10:28 - 000140800 _____ C:\Users\Maple Bear\AppData\Local\installer.dat

	2018-07-25 10:28 - 2018-07-25 10:28 - 000000000 ____D C:\Users\Maple Bear\AppData\Roaming\k4mm4u3gy20

	2018-07-25 10:28 - 2018-07-25 10:28 - 000000000 ____D C:\Users\Maple Bear\AppData\Roaming\2ltuu2jza0t

	2018-07-25 10:34 - 2018-07-25 10:34 - 000375522 _____ ( ) C:\Users\Maple Bear\AppData\Local\Temp\0sz253ohanr.exe

	2018-07-25 10:23 - 2018-07-25 10:23 - 002971704 _____ (BitTorrent Inc.) C:\Users\Maple Bear\AppData\Local\Temp\Ativador_Office_2016_PERMANENTE_DEFINITIVO.exe

	2013-12-08 19:39 - 2013-12-08 19:39 - 000052224 _____ () C:\Users\Maple Bear\AppData\Local\Temp\Ernestine.dll

	2018-07-25 10:24 - 2018-07-25 10:24 - 000540672 _____ () C:\Users\Maple Bear\AppData\Local\Temp\installer_mi.exe

	2018-07-25 10:24 - 2018-07-25 10:24 - 000820224 _____ () C:\Users\Maple Bear\AppData\Local\Temp\RegOrganizer.exe

	2018-07-25 10:25 - 2018-07-25 10:37 - 015440200 _____ (ChemTable Software ) C:\Users\Maple Bear\AppData\Local\Temp\run.exe

	2018-07-25 10:24 - 2018-07-25 10:24 - 008047387 _____ () C:\Users\Maple Bear\AppData\Local\Temp\s2s.exe

	2018-07-25 10:24 - 2018-07-25 10:24 - 000667136 _____ () C:\Users\Maple Bear\AppData\Local\Temp\setup.exe

	2018-07-25 10:24 - 2018-07-25 10:24 - 000688786 _____ ( ) C:\Users\Maple Bear\AppData\Local\Temp\setupGI.exe

	2018-07-25 10:23 - 2018-07-25 10:23 - 000838656 _____ () C:\Users\Maple Bear\AppData\Local\Temp\TigerTrade.exe

	2018-07-25 10:24 - 2018-07-25 10:24 - 000256674 _____ () C:\Users\Maple Bear\AppData\Local\Temp\veninstall.exe

	2018-07-25 10:24 - 2018-07-25 10:24 - 001130527 _____ (Digital LLC ) C:\Users\Maple Bear\AppData\Local\Temp\whiteclick.exe

	2018-07-25 10:50 - 2018-07-25 10:50 - 000715264 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-TR7N1.tmp\q3xcuyv5arf.tmp

	2018-07-25 10:51 - 2018-07-25 10:51 - 000715264 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-NEHDJ.tmp\0gxe04bloba.tmp

	2018-07-25 10:51 - 2018-07-25 10:51 - 000715264 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-6B0Q2.tmp\tzja4yvdwjd.tmp

	2018-07-25 10:51 - 2018-07-25 10:51 - 000715264 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-39QHF.tmp\2ftovy5o1l2.tmp

	2018-07-25 10:51 - 2018-07-25 10:51 - 000715264 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-EB7CN.tmp\2ri0gursg3e.tmp

	2018-07-25 10:51 - 2018-07-25 10:51 - 000715264 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-L7G6H.tmp\q3xcuyv5arf.tmp

	2018-07-25 10:51 - 2018-07-25 10:51 - 000715264 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-V581P.tmp\5vc1e2cenqa.tmp

	2018-07-25 10:51 - 2018-07-25 10:51 - 000113152 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\_ctypes.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000080896 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\bz2.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 001585152 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\_hashlib.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000128512 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\win32api.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000137728 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\pywintypes27.dll

	2018-07-25 10:51 - 2018-07-25 10:51 - 000548864 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\pythoncom27.dll

	2018-07-25 10:51 - 2018-07-25 10:51 - 000689664 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\unicodedata.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000438784 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\win32com.shell.shell.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 001489408 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\wx._core_.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 001007104 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\wx._gdi_.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 001039872 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\wx._windows_.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 001325056 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\wx._controls_.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000916992 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\wx._misc_.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 001084416 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\pysqlite2._sqlite.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000149504 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\win32file.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000136192 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\win32security.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000007680 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\hashobjs_ext.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000020992 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\thumbnails_ext.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000118784 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\usb_ext.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000047616 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\_socket.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 002224640 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\_ssl.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000014848 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\common.time34.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000023040 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\win32event.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000034304 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\windows.conditional.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000020480 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\windows.winwrap.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000110080 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\windows.volumes.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000223232 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\win32gui.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000173568 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\_elementtree.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000169472 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\pyexpat.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000048128 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\win32inet.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000103424 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\wx._html2.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000046080 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\_psutil_windows.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000633272 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\windows._cacheinvalidation.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000011776 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\win32crypt.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000301568 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\PIL._imaging.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000032256 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\_multiprocessing.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 005458944 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\cello.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000026112 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\_yappi.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000044032 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\win32process.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000027648 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\win32pipe.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000010752 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\select.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000029696 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\win32pdh.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000038400 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\windows.connectivity.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000073216 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\windows.device_monitor.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000020480 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\win32profile.pyd

	2018-07-25 10:51 - 2018-07-25 10:51 - 000026624 _____ () C:\Users\Maple Bear\AppData\Local\Temp\_MEI95882\win32ts.pyd

	2018-07-25 10:50 - 2018-07-25 10:50 - 000024240 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-U5I04.tmp\_isetup\_isdecmp.dll

	2018-07-25 10:50 - 2008-10-15 17:44 - 000205312 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-U5I04.tmp\itdownload.dll

	2018-07-25 10:51 - 2018-07-25 10:51 - 000024240 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-M13M9.tmp\_isetup\_isdecmp.dll

	2018-07-25 10:51 - 2008-10-15 17:44 - 000205312 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-M13M9.tmp\itdownload.dll

	2018-07-25 10:51 - 2018-07-25 10:51 - 000024240 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-MNF76.tmp\_isetup\_isdecmp.dll

	2018-07-25 10:51 - 2008-10-15 17:44 - 000205312 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-MNF76.tmp\itdownload.dll

	2018-07-25 10:51 - 2018-07-25 10:51 - 000024240 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-IQCUC.tmp\_isetup\_isdecmp.dll

	2018-07-25 10:51 - 2008-10-15 17:44 - 000205312 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-IQCUC.tmp\itdownload.dll

	2018-07-25 10:51 - 2018-07-25 10:51 - 000024240 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-VF9I0.tmp\_isetup\_isdecmp.dll

	2018-07-25 10:51 - 2008-10-15 17:44 - 000205312 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-VF9I0.tmp\itdownload.dll

	2018-07-25 10:51 - 2018-07-25 10:51 - 000024240 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-77EC1.tmp\_isetup\_isdecmp.dll

	2018-07-25 10:51 - 2008-10-15 17:44 - 000205312 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-77EC1.tmp\itdownload.dll

	2018-07-25 10:51 - 2018-07-25 10:51 - 000024240 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-GDIF4.tmp\_isetup\_isdecmp.dll

	2018-07-25 10:51 - 2008-10-15 17:44 - 000205312 _____ () C:\Users\Maple Bear\AppData\Local\Temp\is-GDIF4.tmp\itdownload.dll  

	Task: {2E5DA6B3-85F3-4437-B305-954CC6B92C08} - System32\Tasks\KMSAutoNet => C:\ProgramData\KMSAutoS\KMSAuto Net.exe [2015-08-10] ()

	Task: {6B374E88-B012-4905-9A00-C39D8AC8B9B0} - System32\Tasks\psv_ZerSonlab => cmd.exe /c regedit.exe /s "C:\ProgramData\Voyasollam\Transron.reg" & del "C:\ProgramData\Voyasollam\Transron.reg" & SCHTASKS /Delete /TN "psv_ZerSonlab" /F <==== ATENÇÃO

	Task: {6BCDDB2B-466D-4310-A659-766ED7336B2D} - System32\Tasks\psv_EcoDontex => cmd.exe /c regedit.exe /s "C:\ProgramData\Voyasollam\Lamlab.reg" & del "C:\ProgramData\Voyasollam\Lamlab.reg" & SCHTASKS /Delete /TN "psv_EcoDontex" /F <==== ATENÇÃO

	Task: {7B4B4C1B-20DB-43F7-94B5-2B25400D9BF5} - \Microsoft\Windows\UNP\RunCampaignManager -> Nenhum Arquivo <==== ATENÇÃO

	Task: {B2CFC389-6160-4236-8A37-529662C02C4E} - System32\Tasks\psv_Lightron => cmd.exe /c regedit.exe /s "C:\ProgramData\Voyasollam\VilaQuosoft.reg" & del "C:\ProgramData\Voyasollam\VilaQuosoft.reg" & SCHTASKS /Delete /TN "psv_Lightron" /F <==== ATENÇÃO

	Task: {DD4EA8FA-DF71-4DA4-941A-757FF467BC45} - System32\Tasks\psv_Dentophase => cmd.exe /c regedit.exe /s "C:\ProgramData\Voyasollam\KonRunla.reg" & del "C:\ProgramData\Voyasollam\KonRunla.reg" & SCHTASKS /Delete /TN "psv_Dentophase" /F <==== ATENÇÃO

	Task: {FA3E1221-3080-428C-8F36-322C41F2D4A8} - System32\Tasks\psv_Toughdox => cmd.exe /c regedit.exe /s "C:\ProgramData\Voyasollam\Hottax.reg" & del "C:\ProgramData\Voyasollam\Hottax.reg" & SCHTASKS /Delete /TN "psv_Toughdox" /F <==== ATENÇÃO

	FirewallRules: [{61F2D792-0C2F-4B61-B44B-B235B6D9882E}] => (Allow) C:\Users\Maple Bear\AppData\Local\Temp\WZSE0.TMP\Network\EpsonNetSetup\ENEasyApp.exe

	FirewallRules: [{F54D3E4F-827A-488C-8885-79574DC72346}] => (Allow) C:\Users\Maple Bear\AppData\Local\Temp\WZSE0.TMP\Network\EpsonNetSetup\ENEasyApp.exe

	AlternateDataStreams: C:\WINDOWS\system32\Drivers\wsddfac.sys:X5ZN8aGXs4 [2410]

	C:\Program Files (x86)\c4e5i2idlbs\OOBC5V8XNIXC5DE.exe

	C:\Users\Maple Bear\AppData\Roaming\cls4bkk0nhm\0gxe04bloba.exe

	C:\Users\Maple Bear\AppData\Roaming\24rdlfd0zir\tzja4yvdwjd.exe

	C:\Users\Maple Bear\AppData\Roaming\2ltuu2jza0t\2ftovy5o1l2.exe

	C:\Users\Maple Bear\AppData\Roaming\k4mm4u3gy20\2ri0gursg3e.exe

	C:\Users\Maple Bear\AppData\Local\Temp\is-TR7N1.tmp\q3xcuyv5arf.tmp

	C:\Users\Maple Bear\AppData\Local\Temp\is-NEHDJ.tmp\0gxe04bloba.tmp

	C:\Users\Maple Bear\AppData\Local\Temp\is-6B0Q2.tmp\tzja4yvdwjd.tmp

	C:\Users\Maple Bear\AppData\Local\Temp\is-39QHF.tmp\2ftovy5o1l2.tmp

	C:\Users\Maple Bear\AppData\Local\Temp\is-EB7CN.tmp\2ri0gursg3e.tmp

	C:\Users\Maple Bear\AppData\Local\Temp\is-L7G6H.tmp\q3xcuyv5arf.tmp

	C:\Users\Maple Bear\AppData\Local\Temp\is-V581P.tmp\5vc1e2cenqa.tmp

	C:\Users\Maple Bear\AppData\Roaming\odo1acbzw4o\5vc1e2cenqa.exe

	C:\Users\Maple Bear\AppData\Roaming\fuhvesj40b5\q3xcuyv5arf.exe

	C:\Program Files (x86)\c4e5i2idlbs\NF0EX.exe

	C:\Program Files\NTFAJC7CK1\UW3WJF3WE.exe

	C:\Program Files\1QGDTP0T64\O19YLPUS7.exe

	C:\Program Files\NTFAJC7CK1\UW3WJF3WE.exe

	C:\Program Files\ZISY2WDKFX\MTLJUW7JF.exe

	C:\Program Files\V1OBNIOUTS\V1OBNIOUT.exe

	C:\Program Files\K7BMDM64GL\K7BMDM64G.exe

	C:\Program Files\A949NS6C3O\A949NS6C3.exe    

	CreateRestorePoint:

	Emptytemp:

	Hosts:

	end::

	 

	/applications/core/interface/imageproxy/imageproxy.php?img=https://imgur.com/IsRtnte.jpg&key=e02edae083edace15c6933c009d0a904d47de872b8951907e93617b0282d936c" />

	 

	> Execute **FRST/FRST64** >> Clique "**Corrigir**" << *Aguarde!*

	> Poste o **relatório** "*Resultado da Correção pela Farbar Recovery Scan Tool*". (**Fixlog.txt**)

	> **Este** e **outros relatórios**,podem ser encontrados **na pasta**: Disco Local (**C**) >> FRST >> ***Logs***

	 

	/applications/core/interface/imageproxy/imageproxy.php?img=http://r17.imgfast.net/users/1712/29/07/67/smiles/434264.gif&key=8b580fd8c41338fe0925cd84ba4dbbb4293b15fe6a04cbd03d242b4e86624720" />

	< Peço aos **visitantes** que **não** utilizem este **script** em **outros** computadores,sob risco de **danos** aos mesmos! >

	 

	[]s

Weick· 26 de jul.

Oi, DigRam.

Muito obrigado pelas orientações.

Segue novo relatório.

Fixlog: https://www.cjoint.com/c/HGAoFGmYp67

Precisei iniciar o sistema em modo de segurança porque não estava mais conseguindo abrir o fórum nem no Edge nem no Chrome.

DigRam· 26 de jul.

/_ Weick _\

Editei meu Post anterior,para as corretas informações "em vermelho",que você deve copiar a um Bloco de Notas. Salve-as ao desktop,com o nome fixlist.

Abra a FRST e clique Corrigir.

Aguarde a finalização e poste: Fixlog.txt

[]s

Weick· 26 de jul.

Segue log:

Resultado da Correção pela Farbar Recovery Scan Tool (x64) Versão: 21.07.2018

Executado por Maple Bear (26-07-2018 14:22:16) Run:2

Executando a partir de C:\Users\Maple Bear\Desktop

Perfis Carregados: Maple Bear (Perfis Disponíveis: Maple Bear)

Modo da Inicialização: Normal

==============================================

fixlist Conteúdo:

*****************

CHR NewTab: Default -> "active" : true,

"entry" : "chrome-extension://pbdpajcdgknpendpmecafmopknefafha/index.html"

CHR Extension: (Sem Nome) - C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2017-03-31]

CHR Extension: (Sem Nome) - C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbdpajcdgknpendpmecafmopknefafha [2018-07-25]

CHR Extension: (Sem Nome) - C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-05-04]

*****************

	"Chrome NewTab" => removido (a) com sucesso.

	"entry" : "chrome-extension://pbdpajcdgknpendpmecafmopknefafha/index.html" => Erro: Nenhuma correção automática foi encontrada para esta entrada.

	CHR Extension: (Sem Nome) - C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2017-03-31] => Erro: Nenhuma correção automática foi encontrada para esta entrada.

	CHR Extension: (Sem Nome) - C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbdpajcdgknpendpmecafmopknefafha [2018-07-25] => Erro: Nenhuma correção automática foi encontrada para esta entrada.

	CHR Extension: (Sem Nome) - C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-05-04] => Erro: Nenhuma correção automática foi encontrada para esta entrada.

	 

	==== Fim de Fixlog 14:22:17 ====

Weick· 26 de jul.

DigRam,

Segue novo log:

https://www.cjoint.com/c/HGAs3Hf6vq7

O sistema foi reiniciado após a limpeza, mas ao reinicializar ainda permanece abrindo as páginas no navegador Edge (laserveradedomaina.com)

Obrigado,

Weick

DigRam· 27 de jul.

/_ Boa Noite! Weick _\

> Baixe: < ZHPCleaner > /applications/core/interface/imageproxy/imageproxy.php?img=http://i.imgur.com/6LcRokv.jpg&key=4684c965737c18f7476fe10aa0d12f9a5f0279583460e462d3bcad9875ed3ea0" /> ... de Nicolas Coolman

> Ou |Aqui!| << Mirror!

> Estando na página,clique /applications/core/interface/imageproxy/imageproxy.php?img=http://i.imgur.com/7ukwnm8.jpg&key=411680a7552ecf5560e81caa8178fc7cb71e09190a8cbd96b9b9f256cdfd3139" />

> Salve-a ao desktop! ( ZHPCleaner.exe )

> Desabilite seu antivírus e execute ZHPCleaner.exe <<

/applications/core/interface/imageproxy/imageproxy.php?img=https://imgur.com/nDQ00tR.jpg&key=5a7684e4ed599a69b7680762ec1e2092f2d6d3e0149cc28a4fbaede09240d2f7" />

	> Ao **abrir** esta tela,**evite** clicar em **Update** ou **Atualização**,para não ser **direcionado** ao **ZHPBrowser**.

	> Ps: **Feche** a **mensagem** ao clicar no **[**"**X**"**]**.

	 

	[/applications/core/interface/imageproxy/imageproxy.php?img=http://7.t.imgbox.com/6MKUYyzn.jpg&key=8f3fd1595941bd85ca77864e608c9a5cb5b4cb9870e031caf9d8839bddf0baed" />](http://imgbox.com/6MKUYyzn)

	 

	> Com a **ferramenta aberta**,clique em **Scanner**.

	 

	/applications/core/interface/imageproxy/imageproxy.php?img=http://i.imgur.com/ljOOETD.jpg&key=17f616a66a0ac1f98d58b7ad72fc71eb684f7e9613c302777e420d4af6d64274" />

	 

	> Aguarde a **conclusão!**

	 

	/applications/core/interface/imageproxy/imageproxy.php?img=http://i.imgur.com/9g2LW3p.jpg&key=0e1bebfae36cbb4c260bebf282446e492aa1234bbb6cdf835ba00e03c61990c3" />

	 

	> Ao concluir,clique **Repair**.

	 

	/applications/core/interface/imageproxy/imageproxy.php?img=https://imgur.com/88z05Yv.jpg&key=cf7e167afcb455fcd466b03d0e05ddf3a78efd594e8e4e5680a40e1a10f74511" />

	 

	> Ps: Ignore **possíveis alertas** quanto à sua **configuração de rede**. (**DNS**)

	> Clique **Sim** >> **Sim!**

	 

	[/applications/core/interface/imageproxy/imageproxy.php?img=http://7.t.imgbox.com/CWxMrxRA.jpg&key=0766b1401c7f2a3c0d7d2272860c2b83abcae35df2605b9ebf777fd9dec628f7" />](http://imgbox.com/CWxMrxRA)

	 

	> Surgirão **guias** que estarão em **vermelho**,indicando **problemas a serem reparados**.

	> Clique **Repair**.

	 

	/applications/core/interface/imageproxy/imageproxy.php?img=http://i.imgur.com/fN86PG8.jpg&key=0627b2d6ba9a8d38506700f60ee02989c4346b5b8c2a5f812deb142e1dc5d4dd" />

	 

	> Ao **concluir**,clique **Report**.

	> Poste o **log** de **reparo**: **~ Type : Reparo**

Citar

file:///C:/Users/xxx../AppData/Roaming/ZHP/ZHPCleaner.html

Ps: Ao clicar "Report",você obterá o relatório,dentre outras informações,em formato HTML.

file:///C:/Users/xxx.../AppData/Roaming/ZHP/ZHPCleaner.txt

Este será seu relatório direto,obtido ao modificar na barra de endereços,de (.html) para (.txt).

Basta selecionar (ctrl + A),copiar (ctrl + C) e colar ao seu Post ou Bloco de Notas. (ctrl + V)

/applications/core/interface/imageproxy/imageproxy.php?img=https://imgur.com/dcE3kmT.jpg&key=6927a8e39f6822c8d13a6aa591b0ac9dc793f8e5d162632c795e53618d6572c6" />

Disponibilize o relatório em Cjoint.com ou utilize spoiler,cuja instrução está ao final daquela página.

Outra opção,é hospedar o relatório em Hébergement de fichiers, Security-x.fr.

[Abs]

Weick· 27 de jul.

Bom dia,

Segue relatório: https://www.cjoint.com/c/HGBjYdacpl7

Reiniciei o computador e as janelas do Edge não aparecem mais. Acho que estamos perto da solução! A única coisa que estou achando estranha são esses processos que aparecem no gerenciador de tarefas (segue print).

Obrigado,

Weick

DigRam· 27 de jul.

/_ Weick _\

Citar

https://nicolascoolman.eu/2017/09/15/adware-wizzcaster/

Não vi referências aos processos,mas não diferem muito do adware wizzcaster.

> Baixe: < /applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/AdwCleaner_Logo2_zps580bcd78.jpg&key=71530441ef1621c6398a69f0f5fae6f7f5c87897579baf8487ec306c4e109626" /> > ( ... par Xplode )

> Ou daqui: < AdwCleaner > << Link!

> Ao acessar,clique em "Download Now".

> Salve-o ao desktop!

> Desabilite seu antivírus!

< /applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/Executar_Administrador.jpg&key=29bbf2d3836c6859afe3923102565f782321b5a7a2787d5bb24cc9918d13e9bd" /> >

> Clique direito em adwcleaner.exe,e escolha sua execução como administrador.

> Clique "Definições".

/applications/core/interface/imageproxy/imageproxy.php?img=https://imgur.com/XZTQ4T3.jpg&key=2222c2a03e84c8a3bac88773e5d38e54e881fc6fa40b2c4f344c1a8be11eba89" />

> Estando em "Definições",deixe as configurações conforme este banner.

/applications/core/interface/imageproxy/imageproxy.php?img=https://imgur.com/bk0BviF.jpg&key=96ac2b7643e0e946084fe8eb3fc85c5650becd4e85eab476e50ac9b37d51e811" />

> Ps: Dê início ao scan,clicando em "Verificar Agora".

> Ao concluir,clique "Limpar e Reparar".

> Na mensagem,clique "Limpar e Reiniciar".

> Ao concluir,clique "Ver Ficheiro de Registos".

> Copie e poste o relatório! (Mode: Clean)/(AdwCleaner[C00])

[]s

Weick· 27 de jul.

Spoiler

# -------------------------------

# Malwarebytes AdwCleaner 7.2.2.0

# -------------------------------

# Build: 07-17-2018

# Database: 2018-07-25.1

# Support: https://www.malwarebytes.com/support

# -------------------------------

# Mode: Clean

# -------------------------------

# Start: 07-27-2018

# Duration: 00:00:06

# OS: Windows 10 Home Single Language

# Cleaned: 36

# Failed: 0

*** [ Services ] ***

No malicious services cleaned.

*** [ Folders ] ***

Deleted C:\ProgramData\Voyasollams

Deleted C:\Windows\Syswow64\SSL

Deleted C:\Users\Maple Bear\AppData\Local\WhiteClick

*** [ Files ] ***

Deleted C:\Users\Maple Bear\appdata\local\installationconfiguration.xml

Deleted C:\Users\Maple Bear\AppData\Local\Main.dat

Deleted C:\Windows\SysWOW64\findit.xml

*** [ DLL ] ***

No malicious DLLs cleaned.

*** [ WMI ] ***

No malicious WMI cleaned.

*** [ Shortcuts ] ***

No malicious shortcuts cleaned.

*** [ Tasks ] ***

No malicious tasks cleaned.

*** [ Registry ] ***

Deleted HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\11598763487076930564

Deleted HKLM\Software\MICROSOFT\TechnologyDesktopnew

Deleted HKLM\SOFTWARE\MICROSOFT\Speedycar

Deleted HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\VOYASOLLAM.EXE

Deleted HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\VOYASOLLAM.EXE

Deleted HKLM\Software\Wow6432Node\mtVoyasollam

Deleted HKCU\Software\Microsoft\BigTime

Deleted HKLM\Software\Microsoft\DMunversion

Deleted HKLM\Software\Wow6432Node\MICROSOFT\WINDOWS NT\CURRENTVERSION\SILENTPROCESSEXIT\Voyasollam.exe

Deleted HKU\S-1-5-18\Environment|SNP

Deleted HKLM\System\CurrentControlSet\Services\EventLog\Application\Application Hosting

Deleted HKCU\Software\Microsoft\Internet Explorer\SearchScopes|DefaultScope

Deleted HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes|DefaultScope

Deleted HKCU\Software\mtApService

Deleted HKLM\Software\Wow6432Node\mtApService

Deleted HKU\.DEFAULT\Environment|SNP

Deleted HKCU\Software\MICROSOFT\wewewe

Deleted HKLM\Software\Wow6432Node\SrcAAAesom Browser Enhancer

Deleted HKLM\Software\SrcAAAesom Browser Enhancer

Deleted HKCU\Software\WajIEnhance

Deleted HKLM\Software\Wow6432Node\CLASSES\APPID\56BF5154-0B48-4ADB-902A-6C8B12E270D9

Deleted HKLM\SOFTWARE\CLASSES\APPID\56BF5154-0B48-4ADB-902A-6C8B12E270D9

Deleted HKCU\Software\Microsoft\{cc6eb6d8-85b7-435p-8b86-51e4d16ea76d}

Deleted HKLM\Software\Microsoft\PrIncub

Deleted HKLM\Software\Microsoft\MPrForShutT

Deleted HKLM\Software\Microsoft\PrAmNP

Deleted HKLM\Software\Microsoft\NSaveA

Deleted HKLM\Software\Microsoft\APreSam

*** [ Chromium (and derivatives) ] ***

No malicious Chromium entries cleaned.

*** [ Chromium URLs ] ***

Deleted https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuLH2byhed3g02SoNi4QVwBEebRpqZKmL_uily4GbZLL5c-S2_83jfzjLCAmslX9v8De2p5UnTR7OZrqB6TiKmHBKNCMQJsDrNkA2VHtl91WB1_gXrmK0g6Tjopl3f2-uQcxd6S_eLB0OZbOs1a3i7SMuyBGMDn

Deleted WebSearch

*** [ Firefox (and derivatives) ] ***

No malicious Firefox entries cleaned.

*** [ Firefox URLs ] ***

No malicious Firefox URLs cleaned.

*************************

[+] Delete IFEO

[+] Delete Prefetch

[+] Delete Tracing Keys

[+] Reset Chromium Policies

[+] Reset IE Policies

[+] Reset Proxy Settings

*************************

AdwCleaner[S00].txt - [4254 octets] - [27/07/2018 17:44:41]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########

DigRam· 27 de jul.

/_ Weick _\

> Baixe: < /applications/core/interface/imageproxy/imageproxy.php?img=http://i.imgur.com/k00HFWk.jpg&key=41c7ebadcdf490a10bc7c2aaf09be7632d88314ee5403bb58d213d715265d441" class="ipsImage" alt="k00HFWk.jpg" data-imageproxy-source="http://i.imgur.com/k00HFWk.jpg" /> > < /applications/core/interface/imageproxy/imageproxy.php?img=http://i.imgur.com/6LcRokv.jpg&key=4684c965737c18f7476fe10aa0d12f9a5f0279583460e462d3bcad9875ed3ea0" class="ipsImage" alt="6LcRokv.jpg" data-imageproxy-source="http://i.imgur.com/6LcRokv.jpg" /> > ( ... de Nicolas Coolman )

/applications/core/interface/imageproxy/imageproxy.php?img=http://www.nicolascoolman.fr/wp-content/plugins/wpdm-download-button/images/54003ae4505a2.jpg&key=64d34f15ec269def53f78e9ba6f75fc67098165d11823b42da6f7982b6018dd5" class="ipsImage" alt="54003ae4505a2.jpg" data-imageproxy-source="http://www.nicolascoolman.fr/wp-content/plugins/wpdm-download-button/images/54003ae4505a2.jpg" />

ftp://zebulon.fr/ZHPDiag3.exe

> Ou daqui!

> Estando na página,clique: Télécharger

> Salve-a ao desktop! ( ZHPDiag3 )

/applications/core/interface/imageproxy/imageproxy.php?img=http://i1377.photobucket.com/albums/ah43/caedurodrigues/Removal%2520Tools2/Icon_zhpdiag3_zpsaigd3wcv.jpg&key=af766b55352aec73845b5681f0b096fd2e0ac10427c0871588b3fea898ffce8a" class="ipsImage" alt="Icon_zhpdiag3_zpsaigd3wcv.jpg" data-imageproxy-source="http://i1377.photobucket.com/albums/ah43/caedurodrigues/Removal%20Tools2/Icon_zhpdiag3_zpsaigd3wcv.jpg" />

> Feche o navegador!

> Execute ZHPDiag3.exe,como administrador,para instalar a ferramenta!

/applications/core/interface/imageproxy/imageproxy.php?img=https://imgur.com/6Z3ntic.jpg&key=363a2b0fdb9217d35d847bdd12b636168e1a1c8d990dd64b8b281288dba7c381" class="ipsImage" alt="6Z3ntic.jpg" data-imageproxy-source="https://imgur.com/6Z3ntic.jpg" />

> Ao surgir esta tela,evite clicar em Atualização! Feche-a clicando no [X].

/applications/core/interface/imageproxy/imageproxy.php?img=https://imgur.com/vS5oRNY.jpg&key=7144c46a3241175abf6a417e6f81a3423e3eac731775fd2358232fd800bc9c56" class="ipsImage" alt="vS5oRNY.jpg" data-imageproxy-source="https://imgur.com/vS5oRNY.jpg" />

> Clique Scanner.

/applications/core/interface/imageproxy/imageproxy.php?img=https://imgur.com/hbwgVJ0.jpg&key=1baf62dc0a278dbf5a9fa55e312eefb2d08ba87c556385cb4d02e9ea7d4a2a0a" class="ipsImage" alt="hbwgVJ0.jpg" data-imageproxy-source="https://imgur.com/hbwgVJ0.jpg" />

> Aguarde a conclusão! ( ...de 1% até 100% )

/applications/core/interface/imageproxy/imageproxy.php?img=http://i.imgur.com/au97Ide.jpg&key=810e49f2521c590269545ed80e8328eefd6c27d3cfb7216d8be74dbec407242b" class="ipsImage" alt="au97Ide.jpg" data-imageproxy-source="http://i.imgur.com/au97Ide.jpg" />

> À seguir,clique Relatório.

> O relatório estará disponibilizado em formato html.

file:///C:/Users/xxx.../AppData/Roaming/ZHP/ZHPDiag

.html

file:///C:/Users/xxx.../AppData/Roaming/ZHP/ZHPDiag.txt

Este será seu relatório direto,obtido ao modificar na barra de endereços,de (.html) para (.txt).

Depois,basta selecionar (ctrl + A),copiar (ctrl + C) e colar ao seu Post ou Bloco de Notas. (ctrl + V)

> Copie-o a um Bloco de Notas.

> Poste-o em sua resposta! (~ Modo: Scanner)

> Ps: Como o log será extenso,hospede-o em Pjjoint.malekal.

/applications/core/interface/imageproxy/imageproxy.php?img=https://2-t.imgbox.com/k1Jh97St.jpg&key=ce8143563ec33f7e669672871c6944666022613d4bc6dfc7f940e2bdf7ca3513" class="ipsImage" alt="k1Jh97St.jpg" data-imageproxy-source="https://2-t.imgbox.com/k1Jh97St.jpg" />

> Ou acesse: < 1fichier.com >

> Ou acesse: < /applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/Cjoint_Logo.jpg&key=bc3f249ffa4fec167155636520ebfd1fed8f6c8d63b5aa0b8cd82fb55aa2edb7" class="ipsImage" alt="Cjoint_Logo.jpg" data-imageproxy-source="http://i1143.photobucket.com/albums/n629/j2ram/Cjoint_Logo.jpg" /> >

> Clique no botão Parcourir...

> Busque o relatório ao desktop.

> Clique no botão Abrir.

> Clique no botão "Créer le lien Cjoint".

> Copie o link que está ao lado de "Le lien a été créé" e poste-o em sua resposta.

/applications/core/interface/imageproxy/imageproxy.php?img=http://t.imgbox.com/acrVh6GY.jpg&key=a98031df11d71116e6fc6fe6586a03c4ab49a7be484751ed5881cb409d37ce42" class="ipsImage" alt="acrVh6GY.jpg" data-imageproxy-source="http://t.imgbox.com/acrVh6GY.jpg" />

> O link ao relatório,que é este assinalado,deverá ser colado em sua resposta.

/applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/Copierlelien_zpsd51f499f.jpg&key=660428e74964025a431cba1b51ee2132f7bbee4aaf74172bd3f0a3be25c5b2b1" class="ipsImage" alt="Copierlelien_zpsd51f499f.jpg" data-imageproxy-source="http://i1143.photobucket.com/albums/n629/j2ram/Copierlelien_zpsd51f499f.jpg" />

> Ou clique "**Copier le lien (*)" e cole o link ao seu Post**.

[]s

Weick· 31 de jul.

Boa tarde,

Segue relatório.

https://www.cjoint.com/cHGFqxQjf8O7

Não consigo mais abrir a página do imasters nem no Edge nem no Chrome. Ela fecha sozinha quando tento acessar.

DigRam· 31 de jul.

/_Boa Tarde! Weick _\

2 horas atrás, Weick disse:

Boa tarde,

Segue relatório.

https://www.cjoint.com/cHGFqxQjf8O7

Não consigo mais abrir a página do imasters nem no Edge nem no Chrome. Ela fecha sozinha quando tento acessar.

> Somente do iMasters?

> Não consigo acesso ao relatório do ZHPDiag,por este link que postou. (Cjoint.com)

https://forum.imasters.com.br/topic/452207-pjjointmalekal-hospedagem-inteligente/

Poste-o em pjjoint.malekal ,e cole aqui o link ao relatório.

[]s

Weick· 1 de ago.

Bom dia,

Até o momento, sim, somente o do iMasters.

Segue novo link:

https://pjjoint.malekal.com/files.php?id=20180801_e12m9r13k9m6

Abraço,

Weick

DigRam· 2 de ago.

/_ Boa Noite! Weick _\

> Baixe: < /applications/core/interface/imageproxy/imageproxy.php?img=http://i1377.photobucket.com/albums/ah43/caedurodrigues/Removal%2520Tools2/ZHPFix_Icon_zpsokw8gsh4.jpg&key=f55beee45223292ac170e207f20afa3b01f5e5d3f213f707f6f1f65047afee6e" /> > << Link!

Citar

http://www.commentcamarche.net/download/telecharger-34102185-zhpfix

> Ou aqui!

> Estando na página,clique: "Télécharger"

> Salve-o ao desktop!

> Instale-o,clicando em: Suivant >> ***Suivant >>...>> Suivant >> Suivant >> Installer >> Terminer***

Citar

Ps: Caso surja uma mensagem do

Windows com a frase "Deseja permitir que o programa de um fornecedor desconhecido faça alterações neste computador?" Clique "Sim"

> Execute este script na ferramenta ZHPFix.

Script ZHPFix

	SS - Auto   [26/07/2018] [  973768]  ZTUzZWM3NDExNGQ0ZWU (ZTUzZWM3NDExNGQ0ZWU) . (...) - C:\Program Files\ZTUzZWM3NDExNGQ0ZWU\YjZjZWFiYjljMDE3.exe  =>PUP.Optional.Wajam  =>PUP.Optional.Wajam

	G0 - GCSP: Preferences [User Data\Default][HomePage] [http://feed.helperbar.com](http://feed.helperbar.com) =>PUP.Optional.HelperBar

	R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://%66%65%65%64.%68%65%6c%70%65%72%62%61%72.%63%6f%6d/?p=mko_awfzxipyrystty34mamef947lyudltbxijwf_47u5patwwhshphidnfrtetnsu9ln4ovrosxw3qg0v6vq_pi0dwhpyfvghh1xerug7gkz5esmecfd4u7qzia_mix9yvscxybs6_isuxz8ecled5h03pp-8ep6i0mrllcscmz5cao3siojmzsbgoi&q={searchterms}  =>.SUP.Linkury

	R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchUrl,Default = http://%66%65%65%64.%68%65%6c%70%65%72%62%61%72.%63%6f%6d/?p=mko_awfzxipyrystty34mamef947lyudltbxijwf_47u5patwwhshphidnfrtetnsu9ln4ovrosxw3qg0v6vq_pi0dwhpyfvghh1xerug7gkz5esmecfd4u7qzia_mix9yvscxybs6_isuxz8ecled5h03pp-8ep6i0mrllcscmz5cao3siojmzsbgoi&q={searchterms}  =>.SUP.Linkury

	R1 - HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://%66%65%65%64.%68%65%6c%70%65%72%62%61%72.%63%6f%6d/?p=mko_awfzxipyrystty34mamef947lyudltbxijwf_47u5patwwhshphidnfrtetnsu9ln4ovrosxw3qg0v6vq_pi0dwhpyfvghh1xerug7gkz5esmecfd4u7qzia_mix9yvscxybs6_isuxz8ecled5h03pp-8ep6i0mrllcscmz5cao3siojmzsbgoi&q={searchterms}  =>.SUP.Linkury

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [306X312R0NHD77K] . (. - .) -- C:\Program Files\0R2FMMGO2K\0R2FMMGO2.exe (.Not File.)  =>.SUP.Orphan

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [9076895] . (. - .) -- C:\Users\Maple Bear\AppData\Roaming\ifhcspx2ikc\disl10x0sok.exe (.Not File.)  =>.SUP.Orphan

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [6008864] . (. - .) -- C:\Users\Maple Bear\AppData\Roaming\zlolaxqabgi\wlhj2hu3nbb.exe (.Not File.)  =>.SUP.Orphan

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [Spotify] . (. - .) -- --minimized.  =>.SUP.Orphan

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [Free Download Manager] . (. - .) -- C:\Program Files\FreeDownloadManager.ORG\Free Download Manager\fdm.exe (.Not File.)  =>.SUP.Orphan

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [IXM5LGBMJKNOYPO] . (. - .) -- C:\Program Files\K1YIWLVSU3\XQ4X5K1TU.exe (.Not File.)  =>.SUP.Orphan

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [7684565] . (. - .) -- C:\Users\Maple Bear\AppData\Roaming\t2rvsfmayfl\3ho5kdlg10j.exe (.Not File.)  =>.SUP.Orphan

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [KWTAR679ZT9XGIA] . (. - .) -- C:\Program Files\5S6YIMOOLV\HHDDQLUPK.exe (.Not File.)  =>.SUP.Orphan

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [4640116] . (. - .) -- C:\Users\Maple Bear\AppData\Roaming\gzz1uzfnff0\i4dhctwkqrf.exe (.Not File.)  =>.SUP.Orphan

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [4ND541F9JDTDJ4C] . (. - .) -- C:\Program Files\D3YPSE3AM8\3HCJ8CFCK.exe (.Not File.)  =>.SUP.Orphan

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [6777332] . (. - .) -- C:\Users\Maple Bear\AppData\Roaming\pttczbotijo\5uybgtpvgr3.exe (.Not File.)  =>.SUP.Orphan

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [3IBJM5C6ZA1W7IK] . (. - .) -- C:\Program Files\FXGNA9PN30\V6C5YEZTP.exe (.Not File.)  =>.SUP.Orphan

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [9391062] . (. - .) -- C:\Users\Maple Bear\AppData\Roaming\hjjtnhr3eko\hlwwv0ttpad.exe (.Not File.)  =>.SUP.Orphan

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [MATTCRY3VVPWWAE] . (. - .) -- C:\Program Files\THZ1V89HI1\666G37FIH.exe (.Not File.)  =>.SUP.Orphan

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [4649048] . (. - .) -- C:\Users\Maple Bear\AppData\Roaming\mplwzptjvre\gucxkyftpjc.exe (.Not File.)  =>.SUP.Orphan

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [EWN6U5GCCBBNP1N] . (. - .) -- C:\Program Files\U7QH33N86O\U7QH33N86.exe (.Not File.)  =>.SUP.Orphan

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [3673502] . (. - .) -- C:\Users\Maple Bear\AppData\Roaming\5ytpwjxdug4\hhrl1le3erk.exe (.Not File.)  =>.SUP.Orphan

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [306X312R0NHD77K] . (. - .) -- C:\Program Files\0R2FMMGO2K\0R2FMMGO2.exe (.Not File.)  =>.SUP.Orphan

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [9076895] . (. - .) -- C:\Users\Maple Bear\AppData\Roaming\ifhcspx2ikc\disl10x0sok.exe (.Not File.)  =>.SUP.Orphan

	O4 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\..\Run: [6008864] . (. - .) -- C:\Users\Maple Bear\AppData\Roaming\zlolaxqabgi\wlhj2hu3nbb.exe (.Not File.)  =>.SUP.Orphan

	O23 - Service: ZTUzZWM3NDExNGQ0ZWU (ZTUzZWM3NDExNGQ0ZWU) . (...) - C:\Program Files\ZTUzZWM3NDExNGQ0ZWU\YjZjZWFiYjljMDE3.exe {319A5DD25B165F00E7FD142A}  =>PUP.Optional.Wajam

	O43 - CFD: 27/07/2018 - [] D -- C:\Program Files\KMSpico  =>HackTool.KMSpico

	[HKEY_USERS\S-1-5-18\Environment]:SNP  =>PUP.Optional.Salus

	HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\SOFTWARE\Chromium  =>.Chromium

	HKLM\SYSTEM\CurrentControlSet\Services\ZTUzZWM3NDExNGQ0ZWU  =>PUP.Optional.Wajam

	HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\WinRAR32  =>.SUP.Orphan

	HKLM\Software\Classes\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}  =>.SUP.Orphan

	HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR32  =>.SUP.Orphan

	HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{ielnksrch}  =>.SUP.Linkury

	HKLM\SOFTWARE\mtApService  =>PUP.Optional.Salus

	HKCU\SOFTWARE\Chromium  =>.Chromium

	C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\File System\002  =>.SUP.Temporary.Chrome

	C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\File System\003  =>.SUP.Temporary.Chrome

	C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\File System\Plugins  =>.SUP.Temporary.Chrome

	C:\Program Files\ZTUzZWM3NDExNGQ0ZWU\YjZjZWFiYjljMDE3.exe  =>PUP.Optional.Wajam

	C:\WINDOWS\System32\drivers\ZGZmMzNhODg5MjgyMG.sys  =>PUP.Optional.Wajam

	C:\Program Files\KMSpico  =>HackTool.KMSpico

	ServiceStop:ZTUzZWM3NDExNGQ0ZWU

	EmptyPrefetch

	FirewallRaz

	ShortcutFix

	Emptytemp

	EmptyClsid

	Ifeofix

	 

	> Selecione e **copie** estas **informações** que estão em **vermelho**,para o **Bloco de Notas**.

	> Com o **Bloco de Notas** aberto,faça: **ctrl+a** >> **ctrl+c**. ( Selecionar e Copiar )

	> À seguir,**minimize** o **Bloco de Notas**.

	 

	> Abra a ferramenta **ZHPFix**. < /applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/My%2520Tools%25203/My%2520Tools%25204/ZHPFix_logo2_zpsea0f2aa4.jpg&key=d5542cfa8c2927966334db1e22757054447548c1fa99304069314737b6934181" /> >

	 

	[/applications/core/interface/imageproxy/imageproxy.php?img=http://9.t.imgbox.com/SMjZDzwL.jpg&key=9fb9e74b778bac608fed796bac0f6c88a94eb9e9498bb6c8f9ea9831c4b79d9c" />](http://imgbox.com/SMjZDzwL)

	 

	> Clique **IMPORTAÇÃO** >> **OK**.

	> Ao clicar "**OK**",verifique se o **campo** está **limpo** para que **receba**,somente,as **informações** do **script**.

	> Não encontrando **anormalidades**,clique "**GO**".

	 

	/applications/core/interface/imageproxy/imageproxy.php?img=http://i.imgur.com/iwKZUZb.jpg&key=4387b1aae1cbc293eb0810703925ec5bbc98a8c7d097a57bf9ab391aaafba674" />

	 

	> Ou,clique **CONFIGURAR** >> **Personalizar**.

	> **Cole** as informações contidas no **Bloco de Notas**,ao **campo** da ferramenta.

	> Clique "**GO**" >> ***Oui ***>> ***Oui***

	> Poste o **relatório!** (C:\Users\Usuário\AppData\Roaming\ZHP\**ZHPFix[R1].txt**)

	 

	/applications/core/interface/imageproxy/imageproxy.php?img=http://r17.imgfast.net/users/1712/29/07/67/smiles/434264.gif&key=8b580fd8c41338fe0925cd84ba4dbbb4293b15fe6a04cbd03d242b4e86624720" />

	< Peço aos **visitantes** que **não** utilizem este **script** em **seus** computadores,sob risco de **danos** aos mesmos! >

	 

	[Abs]

Weick· 6 de ago.

Bom dia,

Não consigo executar o script. Nas duas opções (importação e configurar/personalizar) dá o mesmo problema:

DigRam· 6 de ago.

/_ Boa Tarde! Weick _\

/applications/core/interface/imageproxy/imageproxy.php?img=https://imgur.com/bfjb01S.jpg&key=a0462bcc93a89a98e816a5dc9b88ec13b3aaa2d7b19777ef600910ad093cc1b8" />

Esta linha que destaquei,foi copiada sem erros ao script?

O campo estava limpo ao efetuar a cópia?

Verifique estas condições,que podem invalidar o script de ser executado.

[]s

Weick· 7 de ago.

Consegui.

Segue relatório.

	Rapport de ZHPFix 2017.06.13.1 par Nicolas Coolman, Update du 13/06/2017

	Fichier d'export Registre : 

	Run by Maple Bear at 07/08/2018 06:43:35

	High Elevated Privileges : OK

	Windows 8 Home Premium Edition, 64-bit Service Pack 1 (17134)

	Reciclagem vazia (00mn 14s)

	Prefetcher vazio

	Reparação de atalhos do navegador

	========== Processo memória ==========

	ELIMINA REINICIAR: Memory Process: C:\Program Files\ZTUzZWM3NDExNGQ0ZWU\YjZjZWFiYjljMDE3.exe

	ELIMINA REINICIAR: Memory Process: C:\WINDOWS\System32\drivers\ZGZmMzNhODg5MjgyMG.sys

	========== Estado dos serviços ==========

	ZTUzZWM3NDExNGQ0ZWU Parado

	========== Chaves do Registo ==========

	ELIMINÉ:³ Service: ZTUzZWM3NDExNGQ0ZWU

	ELIMINÉ:³ HKLM\SYSTEM\CurrentControlSet\Services\ZTUzZWM3NDExNGQ0ZWU

	ELIMINÉ:³ HKLM\Software\Classes\*\ShellEx\ContextMenuHandlers\WinRAR32

	ELIMINÉ:³ HKLM\Software\Classes\Folder\ShellEx\ContextMenuHandlers\WinRAR32

	ELIMINÉ: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{ielnksrch}

	ELIMINÉ: HKCU\SOFTWARE\Chromium

	========== Valores do Registo ==========

	ELIMINÉ RunValue: 306X312R0NHD77K

	ELIMINÉ RunValue: 9076895

	ELIMINÉ RunValue: 6008864

	ELIMINÉ RunValue: Spotify

	ELIMINÉ RunValue: Free Download Manager

	ELIMINÉ RunValue: IXM5LGBMJKNOYPO

	ELIMINÉ RunValue: 7684565

	ELIMINÉ RunValue: KWTAR679ZT9XGIA

	ELIMINÉ RunValue: 4640116

	ELIMINÉ RunValue: 4ND541F9JDTDJ4C

	ELIMINÉ RunValue: 6777332

	ELIMINÉ RunValue: 3IBJM5C6ZA1W7IK

	ELIMINÉ RunValue: 9391062

	ELIMINÉ RunValue: MATTCRY3VVPWWAE

	ELIMINÉ RunValue: 4649048

	ELIMINÉ RunValue: EWN6U5GCCBBNP1N

	ELIMINÉ RunValue: 3673502

	Ausente Valor Perfil Padrão: FirewallRaz : 

	Ausente Valor Perfil Domínio FirewallRaz : 

	Nenhum valor presente na chave de exceções do registo (FirewallRaz)

	========== Elementos dos dados do Registo ==========

	ELIMINÉ: R1 Search Page = https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkZ5ESMecFD4u7qzIA_MiX9yVsCxYBs6_iSuxz8eCLEd5h03Pp-8Ep6i0mrLLcsCMz5Cao3siOjMZsBGOI&q={searchTerms}

	========== Preferências do navegador ==========

	AGORA Chrome File: C:\Users\Maple Bear\AppData\Local\Google\Chrome\User Data\Default\Preferences

	AUSENTE Chrome Site: [http://feed.helperbar.com](http://feed.helperbar.com)

	========== Pastas ==========

	Nenhuma pasta CLSID local utilizador vazia

	========== Ficheiros ==========

	ELIMINÉ Temporários windows (3125) (129.086.696 octets)

	========== Outros ==========

	NÃO-TRATADO R1 - HKUS\S-1-5-21-4216877997-3920459586-2356809368-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bars6_isuxz8ecled5h03pp-8ep6i0mrllcscmz5cao3siojmzsbgoi&q={searchterms}

	NÃO-TRATADO [HKU\S-1-5-21-4216877997-3920459586-2356809368-1001\SOFTWARE\Chromium]

	========== Recapitulativo ==========

	2 : Processo memória

	6 : Chaves do Registo

	20 : Valores do Registo

	1 : Elementos dos dados do Registo

	1 : Pastas

	1 : Ficheiros

	2 : Preferências do navegador

	1 : Estado dos serviços

	2 : Outros

	End of clean in 06mn 37s

	========== Caminho do ficheiro do relatório ==========

	C:\Users\Maple Bear\AppData\Roaming\ZHP\ZHPFix[R1].txt - 07/08/2018 06:43:49 [3117]

DigRam· 7 de ago.

/_ Bom Dia! Weick _\

/applications/core/interface/imageproxy/imageproxy.php?img=https://imgur.com/xTNAob2.jpg&key=11fd029c65acaed4c266e0886b767c129138f089111f5b76b28744d0f2eab2d8" class="ipsImage" alt="xTNAob2.jpg" data-imageproxy-source="https://imgur.com/xTNAob2.jpg" />

> Estes objetos/arquivos,ainda aparecem na linha de processos?

> Baixe: < /applications/core/interface/imageproxy/imageproxy.php?img=http://i1143.photobucket.com/albums/n629/j2ram/My%2520Tools%25202/RogueKiller_Logo.jpg&key=99f754ad8ac3afe28f2674c5df4045eed7cd3d0d73384947ed6af1127ec30157" /> > ( ... by Adlice Software ) ( 64 bits version )

> Ps: Desabilite seu antivírus a ao acessar o link,escolha o plano Free!

> Role a página e clique "DOWNLOAD".

> Escolha "Installer 32/64 bits [Fosshub Mirror]" ou Portable 32 bits ou Portable 64 bits. (V12.12.12.0)

> Salve-o ao desktop!

> Feche aplicativos que estejam abertos!

> Execute-o e aceite a Eula.

Citar

http://www.adlice.com/thanks-downloading-roguekiller/

> Feche esta página da Adlice Software,que lhe abre ao navegador.

> Ps: Se o "Filtro SmartScreen",do navegador IE,bloquear o anti-malware,clique em "Mais informações".

> À seguir,clique: "Executar de qualquer maneira"

> Clique na guia "SCAN" >> "Start Scan".

> Aguarde a conclusão!

> Clique "Open Report" >> "Open TXT".

> Copie e poste o relatório! (Modo: Escanear)

[]s

Weick· 8 de ago.

Em 07/08/2018 at 10:09, DigRam disse:

> Estes objetos/arquivos,ainda aparecem na linha de processos?

Olá,

Não, estes processos não aparecem mais no gerenciador de tarefas.

Estou enfrentando dificuldades com o RogueKiller. Ele inicia o scan, mas em um dado momento, ele fecha sozinho (da mesma forma que a página do fórum fecha sozinha). Quando tento abrir o RogueKiller novamente (indo pelo diretório em C:/Arquivos de Programas/...) a própria pasta fecha sozinha, não me permitindo abrir o programa. Daí tenho que reiniciar o computador para tentar novamente.

É isso que estou fazendo agora, rodando o scan mais uma vez para ver se consigo e então postar o relatório. Se tiver alguma dica de como fazer isso, agradeceria.

Weick· 8 de ago.

Consegui!

Segue report:

Spoiler

RogueKiller V12.12.30.0 (x64) [Aug 6 2018] (Free) por Adlice Software

mail : http://www.adlice.com/contact/

Feedback : https://forum.adlice.com

Site : http://www.adlice.com/download/roguekiller/

Blog : http://www.adlice.com

Sistema Operacional : Windows 10 (10.0.17134) 64 bits version

Iniciou : Modo normal

Usuário : Maple Bear [Administrador]

Started from : C:\Program Files\RogueKiller\RogueKiller64.exe

Modo : Escanear -- Data : 08/08/2018 10:31:13 (Duration : 00:42:42)

¤¤¤ Processos : 3 ¤¤¤

[Root.Wajam] svchost.exe(2672) -- c:\Windows\System32\svchost.exe[7] -> Encontrado

[Proc.Injected] rundll32.exe(3436) -- C:\Windows\SysWOW64\rundll32.exe[-] -> Encontrado

[VT.Detected] hmtjgjdtalqowcqt.zmtjg(3436) -- C:\WINDOWS\hmtjgjdtalqowcqt.zmtjg[-] -> Encontrado

¤¤¤ Registro : 17 ¤¤¤

[PUP.Gen1] (X86) HKEY_LOCAL_MACHINE\Software\mtApService -> Encontrado

[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\mtApService -> Encontrado

[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\mtApService -> Encontrado

[PUP.Linkury|VT.Unknown] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\AppmallosayoV (C:\ProgramData\\AppmallosayoV\\AppmallosayoV.exe shuz -f "C:\ProgramData\\AppmallosayoV\\AppmallosayoV.dat" -l -a) -> Encontrado

[Root.Wajam] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ZGZmMzNhODg5MjgyMG (system32\drivers\ZGZmMzNhODg5MjgyMG.sys) -> Encontrado

[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main | Start Page : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkazK6e0NISXaBrBIUb80Xv37wYgvgeZrUGAYS7LpXr6RVcLqb0EkSR5blLVcOkNF3LOjl9e584hcnXTem -> Encontrado

[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main | Start Page : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkazK6e0NISXaBrBIUb80Xv37wYgvgeZrUGAYS7LpXr6RVcLqb0EkSR5blLVcOkNF3LOjl9e584hcnXTem -> Encontrado

[PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main | Search Page : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkZ5ESMecFD4u7qzIA_MiX9yVsCxYBs6_iSuxz8eCLEd5h03Pp-8Ep6i0mrLLcsCMz5Cao3siOjMZsBGOI&q={searchTerms} -> Encontrado

[PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main | Search Page : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkZ5ESMecFD4u7qzIA_MiX9yVsCxYBs6_iSuxz8eCLEd5h03Pp-8Ep6i0mrLLcsCMz5Cao3siOjMZsBGOI&q={searchTerms} -> Encontrado

[PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main | Search Bar : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkZ5ESMecFD4u7qzIA_MiX9yVsCxYBs6_iSuxz8eCLEd5h03Pp-8Ep6i0mrLLcsCMz5Cao3siOjMZsBGOI&q={searchTerms} -> Encontrado

[PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\Microsoft\Internet Explorer\Main | Search Bar : https://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyudltbXijWF_47u5PatwWhshPHIdNfRTEtnSu9Ln4ovROsxw3qG0v6vq_pI0dwHPYfvgHh1XeRUG7GkZ5ESMecFD4u7qzIA_MiX9yVsCxYBs6_iSuxz8eCLEd5h03Pp-8Ep6i0mrLLcsCMz5Cao3siOjMZsBGOI&q={searchTerms} -> Encontrado

[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 179.232.0.31 179.232.0.36 201.6.4.116 ([Brazil][Brazil][-]) -> Encontrado

[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{e31b5f51-1d5b-4fb3-8c6c-f0154f10d3bc} | DhcpNameServer : 179.232.0.31 179.232.0.36 201.6.4.116 ([Brazil][Brazil][-]) -> Encontrado

[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Encontrado

[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Encontrado

[VT.Detected] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs : C:\ProgramData\AppmallosayoV\Stannix.dll [-] -> Encontrado

[VT.Detected] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs : C:\ProgramData\AppmallosayoV\Med-Ex.dll [-] -> Encontrado

¤¤¤ Tarefas : 0 ¤¤¤

¤¤¤ Arquivos : 15 ¤¤¤

[PUP.Linkury][Arquivo] C:\ProgramData\AppmallosayoV\AppmallosayoV.exe -> Encontrado

[PUP.Gen0][Arquivo] C:\Windows\SECOH-QAD.exe -> Encontrado

[PUP.Linkury][Arquivo] C:\Windows\SysWOW64\findit.xml -> Encontrado

[Root.Wajam][Arquivo] C:\Windows\System32\drivers\ZGZmMzNhODg5MjgyMG.sys -> Encontrado

[PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.0_43458\utorrentie.exe -> Encontrado

[PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44366\utorrentie.exe -> Encontrado

[PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44390\utorrentie.exe -> Encontrado

[PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44416\utorrentie.exe -> Encontrado

[PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44472\utorrentie.exe -> Encontrado

[PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44484\utorrentie.exe -> Encontrado

[PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.4_44488\utorrentie.exe -> Encontrado

[PUP.Linkury][Arquivo] C:\Users\Maple Bear\AppData\Local\Vaiadex.exe -> Encontrado

[PUP.Linkury][Arquivo] C:\ProgramData\AppmallosayoV\AppmallosayoV.exe -> Encontrado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico -> Encontrado

[PUP.Multitimer][Pasta] C:\Program Files (x86)\Multitimer -> Encontrado

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Arquivos de hosts : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Carregado) ¤¤¤

¤¤¤ Navegadores : 0 ¤¤¤

¤¤¤ Verificação da MBR : ¤¤¤

+++++ PhysicalDrive0: ST500LM012 HN-M500MBB +++++

--- User ---

[MBR] 5aef40578600422a06b842a9ae851aa2

[BSP] 980fe462507a6040b4abe904a693c5ba : Empty MBR Code

Partition table:

0 - [MAN-MOUNT] EFI system partition | Offset (sectors): 2048 | Size: 100 MB

1 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 206848 | Size: 128 MB

2 - Basic data partition | Offset (sectors): 468992 | Size: 463814 MB

3 - [SYSTEM][MAN-MOUNT] | Offset (sectors): 950362112 | Size: 930 MB

4 - [SYSTEM][MAN-MOUNT] ??????a | Offset (sectors): 952266754 | Size: 10941 MB

5 - [SYSTEM][MAN-MOUNT] ????? | Offset (sectors): 974673923 | Size: 1024 MB

User = LL1 ... OK

User = LL2 ... OK

DigRam· 8 de ago.

/_ Boa Noite! Weick _\

[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 179.232.0.31 179.232.0.36 201.6.4.116 ([Brazil][Brazil][-]) -> Encontrado
[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{e31b5f51-1d5b-4fb3-8c6c-f0154f10d3bc} | DhcpNameServer : 179.232.0.31 179.232.0.36 201.6.4.116 ([Brazil][Brazil][-]) -> Encontrado

> Na operação de remoção,desmarque somente,estas caixinhas que apontam sua configuração de rede.

> Ao executar novamente a ferramenta,marque as outras e clique em "Remove Selected".

> Clique "Finish" >> "Open Report" >> "Open TXT".

> Agora,teremos o log apresentando a(s) remoções efetuadas! (Modo: Deletar)

> Copie-o e poste-o em sua resposta!

[]s

Weick· 9 de ago.

Bom dia,

Segue relatório:

Spoiler

RogueKiller V12.12.30.0 (x64) [Aug 6 2018] (Free) por Adlice Software

mail : http://www.adlice.com/contact/

Feedback : https://forum.adlice.com

Site : http://www.adlice.com/download/roguekiller/

Blog : http://www.adlice.com

Sistema Operacional : Windows 10 (10.0.17134) 64 bits version

Iniciou : Modo normal

Usuário : Maple Bear [Administrador]

Started from : C:\Program Files\RogueKiller\RogueKiller64.exe

Modo : Deletar -- Data : 08/08/2018 10:31:13 (Duration : 00:42:42)

¤¤¤ Processos : 3 ¤¤¤

[Root.Wajam] svchost.exe(2672) -- c:\Windows\System32\svchost.exe[7] -> [NoKill]

[Proc.Injected] rundll32.exe(3436) -- C:\Windows\SysWOW64\rundll32.exe[-] -> Interrompido [TermProc]

[VT.Detected] hmtjgjdtalqowcqt.zmtjg(3436) -- C:\WINDOWS\hmtjgjdtalqowcqt.zmtjg[-] -> Encontrado

¤¤¤ Registro : 17 ¤¤¤

[PUP.Gen1] (X86) HKEY_LOCAL_MACHINE\Software\mtApService -> Deletado

[PUP.Gen1] (X64) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\mtApService -> Deletado

[PUP.Gen1] (X86) HKEY_USERS\S-1-5-21-4216877997-3920459586-2356809368-1001\Software\mtApService -> Deletado

[Root.Wajam] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ZGZmMzNhODg5MjgyMG (system32\drivers\ZGZmMzNhODg5MjgyMG.sys) -> Deletado

[PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 179.232.0.31 179.232.0.36 201.6.4.116 ([Brazil][Brazil][-]) -> Não selecionado

[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Substituído (2)

[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Substituído (2)

[VT.Detected] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs : C:\ProgramData\AppmallosayoV\Stannix.dll [-] -> Substituído ()

[VT.Detected] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs : C:\ProgramData\AppmallosayoV\Med-Ex.dll [-] -> Substituído ()

¤¤¤ Tarefas : 0 ¤¤¤

¤¤¤ Arquivos : 15 ¤¤¤

[PUP.Linkury][Arquivo] C:\ProgramData\AppmallosayoV\AppmallosayoV.exe -> Deletado

[PUP.Gen0][Arquivo] C:\Windows\SECOH-QAD.exe -> Deletado

[PUP.Linkury][Arquivo] C:\Windows\SysWOW64\findit.xml -> Deletado

[Root.Wajam][Arquivo] C:\Windows\System32\drivers\ZGZmMzNhODg5MjgyMG.sys -> Removido na reinicialização [5]

[PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.0_43458\utorrentie.exe -> Deletado

[PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44366\utorrentie.exe -> Deletado

[PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44390\utorrentie.exe -> Deletado

[PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44416\utorrentie.exe -> Deletado

[PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44472\utorrentie.exe -> Deletado

[PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.3_44484\utorrentie.exe -> Deletado

[PUP.uTorrentAds][Arquivo] C:\Users\Maple Bear\AppData\Roaming\uTorrent\updates\3.5.4_44488\utorrentie.exe -> Deletado

[PUP.Linkury][Arquivo] C:\Users\Maple Bear\AppData\Local\Vaiadex.exe -> Deletado

[PUP.Linkury][Arquivo] C:\ProgramData\AppmallosayoV\AppmallosayoV.exe -> Removido na reinicialização [2]

[PUP.HackTool][Pasta] C:\Program Files\KMSpico -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Access\AccessVLReg32.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Access\AccessVLReg64.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Access\AccessVLRegWOW.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Access\Access_KMS_Client.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Access\Access_KMS_Client.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Access\Access_KMS_Client.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Access\Access_KMS_Client.RAC_Priv.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Access\Access_KMS_Client.RAC_Pub.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\Access -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Excel\ExcelVLReg32.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Excel\ExcelVLReg64.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Excel\ExcelVLRegWOW.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Excel\Excel_KMS_Client.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Excel\Excel_KMS_Client.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Excel\Excel_KMS_Client.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Excel\Excel_KMS_Client.RAC_Priv.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Excel\Excel_KMS_Client.RAC_Pub.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\Excel -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Groove\GrooveVLReg32.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Groove\GrooveVLReg64.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Groove\GrooveVLRegWOW.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Groove\Groove_KMS_Client.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Groove\Groove_KMS_Client.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Groove\Groove_KMS_Client.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Groove\Groove_KMS_Client.RAC_Priv.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Groove\Groove_KMS_Client.RAC_Pub.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\Groove -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\InfoPathVLReg32.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\InfoPathVLReg64.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\InfoPathVLRegWOW.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.RAC_Priv.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.RAC_Pub.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\InfoPath -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\OneNote\OneNoteVLReg32.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\OneNote\OneNoteVLReg64.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\OneNote\OneNoteVLRegWOW.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\OneNote\OneNote_KMS_Client.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\OneNote\OneNote_KMS_Client.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\OneNote\OneNote_KMS_Client.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\OneNote\OneNote_KMS_Client.RAC_Priv.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\OneNote\OneNote_KMS_Client.RAC_Pub.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\OneNote -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Outlook\OutlookVLReg32.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Outlook\OutlookVLReg64.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Outlook\OutlookVLRegWOW.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Outlook\Outlook_KMS_Client.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Outlook\Outlook_KMS_Client.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Outlook\Outlook_KMS_Client.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Outlook\Outlook_KMS_Client.RAC_Priv.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Outlook\Outlook_KMS_Client.RAC_Pub.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\Outlook -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\PowerPointVLReg32.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\PowerPointVLReg64.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\PowerPointVLRegWOW.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.RAC_Priv.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.RAC_Pub.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\ProjectProVLReg32.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\ProjectProVLReg64.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\ProjectProVLRegWOW.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.RAC_Priv.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.RAC_Pub.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\ProjectStdVLReg32.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\ProjectStdVLReg64.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\ProjectStdVLRegWOW.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.RAC_Priv.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.RAC_Pub.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\ProPlusVLReg32.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\ProPlusVLReg64.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\ProPlusVLRegWOW.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.RAC_Priv.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.RAC_Pub.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\ProPlus -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Publisher\PublisherVLReg32.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Publisher\PublisherVLReg64.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Publisher\PublisherVLRegWOW.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Publisher\Publisher_KMS_Client.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Publisher\Publisher_KMS_Client.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Publisher\Publisher_KMS_Client.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Publisher\Publisher_KMS_Client.RAC_Priv.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Publisher\Publisher_KMS_Client.RAC_Pub.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\Publisher -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\SmallBusBasicsVLReg32.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\SmallBusBasicsVLReg64.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\SmallBusBasicsVLRegWOW.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.RAC_Priv.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.RAC_Pub.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Standard\StandardVLReg32.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Standard\StandardVLReg64.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Standard\StandardVLRegWOW.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Standard\Standard_KMS_Client.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Standard\Standard_KMS_Client.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Standard\Standard_KMS_Client.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Standard\Standard_KMS_Client.RAC_Priv.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Standard\Standard_KMS_Client.RAC_Pub.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\Standard -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPrem_KMS_Client.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPrem_KMS_Client.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPrem_KMS_Client.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPrem_KMS_Client.RAC_Priv.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPrem_KMS_Client.RAC_Pub.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPro_KMS_Client.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPro_KMS_Client.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPro_KMS_Client.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPro_KMS_Client.RAC_Priv.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioPro_KMS_Client.RAC_Pub.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioStd_KMS_Client.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioStd_KMS_Client.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioStd_KMS_Client.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioStd_KMS_Client.RAC_Priv.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioStd_KMS_Client.RAC_Pub.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioVLReg32.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioVLReg64.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Visio\VisioVLRegWOW.reg -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\Visio -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Word\WordVLReg32.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Word\WordVLReg64.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Word\WordVLRegWOW.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Word\Word_KMS_Client.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Word\Word_KMS_Client.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Word\Word_KMS_Client.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Word\Word_KMS_Client.RAC_Priv.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2010\Word\Word_KMS_Client.RAC_Pub.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010\Word -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2010 -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Access\AccessVL_KMS_Client_OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Access\AccessVL_KMS_Client_PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Access\AccessVL_KMS_Client_PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\Access -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Excel\LicenseSetData._F7461D52_7C2B_43B2_8744_EA958E0BD09A.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Excel\LicenseSetData._F7461D52_7C2B_43B2_8744_EA958E0BD09A.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Excel\LicenseSetData._F7461D52_7C2B_43B2_8744_EA958E0BD09A.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\Excel -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\LicenseSetData._A30B8040_D68A_423F_B0B5_9CE292EA5A8F.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\LicenseSetData._A30B8040_D68A_423F_B0B5_9CE292EA5A8F.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\LicenseSetData._A30B8040_D68A_423F_B0B5_9CE292EA5A8F.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\InfoPath -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Lync\LicenseSetData._1B9F11E3_C85C_4E1B_BB29_879AD2C909E3.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Lync\LicenseSetData._1B9F11E3_C85C_4E1B_BB29_879AD2C909E3.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Lync\LicenseSetData._1B9F11E3_C85C_4E1B_BB29_879AD2C909E3.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\Lync -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\OneNote\LicenseSetData._EFE1F3E6_AEA2_4144_A208_32AA872B6545.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\OneNote\LicenseSetData._EFE1F3E6_AEA2_4144_A208_32AA872B6545.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\OneNote\LicenseSetData._EFE1F3E6_AEA2_4144_A208_32AA872B6545.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\OneNote -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Outlook\LicenseSetData._771C3AFA_50C5_443F_B151_FF2546D863A0.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Outlook\LicenseSetData._771C3AFA_50C5_443F_B151_FF2546D863A0.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Outlook\LicenseSetData._771C3AFA_50C5_443F_B151_FF2546D863A0.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\Outlook -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\pkeyconfig-office.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\LicenseSetData._8C762649_97D1_4953_AD27_B7E2C25B972E.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\LicenseSetData._8C762649_97D1_4953_AD27_B7E2C25B972E.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\LicenseSetData._8C762649_97D1_4953_AD27_B7E2C25B972E.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\LicenseSetData._427A28D1_D17C_4ABF_B717_32C780BA6F07.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\LicenseSetData._427A28D1_D17C_4ABF_B717_32C780BA6F07.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\LicenseSetData._427A28D1_D17C_4ABF_B717_32C780BA6F07.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\proplus.reg -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\ProPlus -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Publisher\LicenseSetData._00C79FF1_6850_443D_BF61_71CDE0DE305F.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Publisher\LicenseSetData._00C79FF1_6850_443D_BF61_71CDE0DE305F.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Publisher\LicenseSetData._00C79FF1_6850_443D_BF61_71CDE0DE305F.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\Publisher -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Standard\LicenseSetData._B13AFB38_CD79_4AE5_9F7F_EED058D750CA.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Standard\LicenseSetData._B13AFB38_CD79_4AE5_9F7F_EED058D750CA.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Standard\LicenseSetData._B13AFB38_CD79_4AE5_9F7F_EED058D750CA.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\Standard -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\visio.reg -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\VisioPro -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\LicenseSetData._AC4EFAF0_F81F_4F61_BDF7_EA32B02AB117.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\LicenseSetData._AC4EFAF0_F81F_4F61_BDF7_EA32B02AB117.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\LicenseSetData._AC4EFAF0_F81F_4F61_BDF7_EA32B02AB117.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\VisioStd -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Word\LicenseSetData._D9F5B1C6_5386_495A_88F9_9AD6B41AC9B3.OOB.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Word\LicenseSetData._D9F5B1C6_5386_495A_88F9_9AD6B41AC9B3.PL.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2013\Word\LicenseSetData._D9F5B1C6_5386_495A_88F9_9AD6B41AC9B3.PPDLIC.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013\Word -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2013 -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Access\AccessVL_KMS_Client-ppd.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Access\AccessVL_KMS_Client-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Access\AccessVL_KMS_Client-ul.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\Access -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-bridge-office.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-root-bridge-test.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-root.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-stil.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-ul.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Excel\ExcelVL_KMS_Client-ppd.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Excel\ExcelVL_KMS_Client-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Excel\ExcelVL_KMS_Client-ul.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\Excel -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Mondo\MondoVL_KMS_Client-ppd.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Mondo\MondoVL_KMS_Client-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Mondo\MondoVL_KMS_Client-ul.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\Mondo -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\OneNote\OneNoteVL_KMS_Client-ppd.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\OneNote\OneNoteVL_KMS_Client-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\OneNote\OneNoteVL_KMS_Client-ul.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\OneNote -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Outlook\OutlookVL_KMS_Client-ppd.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Outlook\OutlookVL_KMS_Client-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Outlook\OutlookVL_KMS_Client-ul.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\Outlook -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\pkeyconfig-office.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\PowerPointVL_KMS_Client-ppd.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\PowerPointVL_KMS_Client-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\PowerPointVL_KMS_Client-ul.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\ProjectProVL_KMS_Client-ppd.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\ProjectProVL_KMS_Client-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\ProjectProVL_KMS_Client-ul.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\ProjectStdVL_KMS_Client-ppd.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\ProjectStdVL_KMS_Client-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\ProjectStdVL_KMS_Client-ul.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ppd.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ul.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\ProPlus -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Publisher\PublisherVL_KMS_Client-ppd.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Publisher\PublisherVL_KMS_Client-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Publisher\PublisherVL_KMS_Client-ul.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\Publisher -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\SkypeforBusinessVL_KMS_Client-ul.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Standard\StandardVL_KMS_Client-ppd.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Standard\StandardVL_KMS_Client-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Standard\StandardVL_KMS_Client-ul.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\Standard -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\VisioProVL_KMS_Client-ppd.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\VisioProVL_KMS_Client-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\VisioProVL_KMS_Client-ul.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\VisioPro -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\VisioStdVL_KMS_Client-ppd.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\VisioStdVL_KMS_Client-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\VisioStdVL_KMS_Client-ul.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\VisioStd -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Word\WordVL_KMS_Client-ppd.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Word\WordVL_KMS_Client-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscert2016\Word\WordVL_KMS_Client-ul.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016\Word -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscert2016 -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\Core\Core-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\Core\Core-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW10\Core -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\Education\Education-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\Education\Education-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW10\Education -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\Enterprise\Enterprise-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\Enterprise\Enterprise-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW10\Enterprise -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-2-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-2-ul.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\pkeyconfig.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\Professional\Professional-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW10\Professional\Professional-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW10\Professional -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW10 -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-ul-phn.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-RAC-private.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-RAC-public.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-ul.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS-pl.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS-ul-phn.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS1-pl.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS1-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS1-ul-phn.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW6\Business -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-ul-phn.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-RAC-private.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-RAC-public.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-ul.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS-pl.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS-ul-phn.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS1-pl.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS1-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS1-ul-phn.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW6\BusinessN -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-ul-phn.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-RAC-private.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-RAC-public.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-ul.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS-pl.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS-ul-phn.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS1-pl.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS1-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS1-ul-phn.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW6\Enterprise -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW6\pkeyconfig.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW6 -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Embedded\pkeyconfig-embedded.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-pl.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-ul-phn.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-VLBA-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-VLBA-ul.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW7\Embedded -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW7\Enterprise -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\pkeyconfig.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-ul-phn.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-RAC-private.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-RAC-public.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-ul.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VLKMS1-pl.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VLKMS1-ul-oob.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VLKMS1-ul-phn.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW7\Professional -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW7 -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\Core\Core-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\Core\Core-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW8\Core -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\CoreN\CoreN-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\CoreN\CoreN-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW8\CoreN -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguage\CoreSingleLanguage-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguage\CoreSingleLanguage-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguage -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\Enterprise\Enterprise-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\Enterprise\Enterprise-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW8\Enterprise -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseN\EnterpriseN-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseN\EnterpriseN-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseN -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\pkeyconfig.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\Professional\Professional-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\Professional\Professional-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW8\Professional -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalN\ProfessionalN-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalN\ProfessionalN-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalN -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMC -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW8 -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\Core\Core-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\Core\Core-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW81\Core -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguage\CoreConnectedSingleLanguage-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguage\CoreConnectedSingleLanguage-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguage -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustry\EmbeddedIndustry-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustry\EmbeddedIndustry-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustry -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\Enterprise\Enterprise-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\Enterprise\Enterprise-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW81\Enterprise -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\pkeyconfig.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\Professional\Professional-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\Professional\Professional-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW81\Professional -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMC -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenter\ServerDatacenter-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenter\ServerDatacenter-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenter -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\ServerStandard\ServerStandard-Volume-GVLK-1-ul-oob-rtm.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\cert\kmscertW81\ServerStandard\ServerStandard-Volume-GVLK-1-ul-rtm.xrm-ms -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW81\ServerStandard -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert\kmscertW81 -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\cert -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\driver\Cert.cmd -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\driver\certELDI.pfx -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\driver\OpenVPN.cer -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\driver\tap-windows-9.21.0.exe -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\driver\UnInstallDriver.cmd -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\driver -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\icons\Error.png -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\icons\Information.png -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\icons\Question.png -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\icons\Warning.png -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\icons -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\logs\AutoPico.log -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\logs\KMSELDI.log -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\logs\Service_KMS.log -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\logs -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\AddExceptionsWD.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\AddExceptions_Defender.cmd -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\DisableSmartScreen.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\EnableSmartScreen.cmd -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\EnableSmartScreen.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\Install_Service.cmd -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\Install_Task.cmd -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\Log.cmd -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\RemoveExceptionsWD.reg -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\Restore_Watermark.cmd -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\Silent.cmd -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\scripts\UnInstall_Service.cmd -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\scripts -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\affirmative.mp3 -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\begin.mp3 -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\complete.mp3 -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\diagnostic.mp3 -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\enterauthorizationcode.mp3 -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\incomingtransmission.mp3 -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\inputfailed.mp3 -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\inputok.mp3 -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\processing.mp3 -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\transfer.mp3 -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\verified.mp3 -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\sounds\warning.mp3 -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\sounds -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\TokensBackup\Keys.txt -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\TokensBackup\Windows\cache\cache.dat -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\TokensBackup\Windows\cache -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\TokensBackup\Windows\data.dat -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\TokensBackup\Windows\pkeyconfig.xrm-ms -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\TokensBackup\Windows\tokens.dat -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\TokensBackup\Windows -> Deletado

[PUP.HackTool][Pasta] C:\Program Files\KMSpico\TokensBackup -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\unins000.dat -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\unins000.exe -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\UninsHs.exe -> Deletado

[PUP.HackTool][Arquivo] C:\Program Files\KMSpico\Vestris.ResourceLib.dll -> Deletado

[PUP.Multitimer][Pasta] C:\Program Files (x86)\Multitimer -> Deletado

¤¤¤ WMI : 0 ¤¤¤

¤¤¤ Arquivos de hosts : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Carregado) ¤¤¤

¤¤¤ Navegadores : 0 ¤¤¤

¤¤¤ Verificação da MBR : ¤¤¤

+++++ PhysicalDrive0: ST500LM012 HN-M500MBB +++++

--- User ---

[MBR] 5aef40578600422a06b842a9ae851aa2

[BSP] 980fe462507a6040b4abe904a693c5ba : Empty MBR Code

Partition table:

0 - [MAN-MOUNT] EFI system partition | Offset (sectors): 2048 | Size: 100 MB

1 - [MAN-MOUNT] Microsoft reserved partition | Offset (sectors): 206848 | Size: 128 MB

2 - Basic data partition | Offset (sectors): 468992 | Size: 463814 MB

3 - [SYSTEM][MAN-MOUNT] | Offset (sectors): 950362112 | Size: 930 MB

4 - [SYSTEM][MAN-MOUNT] ??????a | Offset (sectors): 952266754 | Size: 10941 MB

5 - [SYSTEM][MAN-MOUNT] ????? | Offset (sectors): 974673923 | Size: 1024 MB

User = LL1 ... OK

User = LL2 ... OK

DigRam· 17 de ago.

/_Boa Noite! Weick _\

Desculpe-me a demora,pois fiquei sem Internet.

Como encontra-se a situação de seu notebook?

Tudo Ok?

[]s