Ionara 2 Denunciar post Postado Dezembro 2, 2014 Bem uma mensagem que surgiu anteriormente, surge a qualquer momento, agora copiei: a instrução no 0x7454697b fez referencia "a memória no 0x7454697b. A memória não pode ser written. OK para finalizar. pode ser vírus? seg log HIJACKTHIS Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 22:45:47, on 01/12/2014 Platform: Windows 7 SP1 (WinNT 6.00.3505) MSIE: Internet Explorer v8.00 (8.00.7601.17514) Boot mode: Normal Running processes: C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Windows\SysWOW64\ctfmon.exe C:\PROGRA~2\GbPlugin\GbpSv.exe C:\Users\Usuario\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Usuario\AppData\Local\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\AVG\AVG2015\avgui.exe C:\Users\Usuario\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Usuario\AppData\Local\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com.br/?gws_rd=ssl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=userinit.exe, O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office12\GR469A~1.DLL O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\Program Files (x86)\GbPlugin\gbiehcef.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2015\avgui.exe" /TRAYONLY O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" O4 - HKCU\..\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [Google Update] "C:\Users\Usuario\AppData\Local\Google\Update\GoogleUpdate.exe" /c O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO LOCAL') O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIÇO LOCAL') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO DE REDE') O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIÇO DE REDE') O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Skype Click to Call settings - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL O15 - Trusted Zone: imagem.caixa.gov.br O15 - Trusted Zone: internetbanking.caixa.gov.br O15 - Trusted Zone: internetbankingpf.caixa.gov.br O15 - Trusted Zone: www.caixa.gov.br O15 - Trusted Zone: http://www.caixa.gov.br O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~2\MICROS~1\Office12\GRA32A~1.DLL O18 - Protocol: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O20 - Winlogon Notify: GbPluginCef - C:\Program Files (x86)\GbPlugin\gbiehCef.dll O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe O23 - Service: Watchdog do AVG (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: Gbp Service (GbpSv) - GAS Tecnologia - C:\PROGRA~2\GbPlugin\GbpSv.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\SysWOW64\IoctlSvc.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Rapport Management Service (RapportMgmtService) - IBM Corp. - C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: VIA Karaoke digital mixer Service (VIAKaraokeService) - Unknown owner - C:\Windows\system32\viakaraokesrv.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 8801 bytes Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Dezembro 2, 2014 Boa Noite! Ionara > Já verificou seus pentes de memória? > Baixe: < ZHPDiag2.exe > < > ( ... de Nicolas Coolman ) > Salve-o no disco local! ( C ou D ) > Desabilite seu antivírus e execute "ZHPDiag2.exe",para instalar a ferramenta. > Execute o ícone do pergaminho. ( ZHPDiag ) > Clique "COMPLETA" e aguarde a conclusão! > Clique OK e,ao concluir,poste o relatório! ( ZHPDiag.txt ) > Ps: Como o log será extenso,envie-o à Pjjoint.malekal. > Ou acesse: < > > Maiores informações: < |Link| > A+ Compartilhar este post Link para o post Compartilhar em outros sites
Ionara 2 Denunciar post Postado Dezembro 2, 2014 Bom dia, na verificação com o ZHP completa ocorreu o mesmo erro de antes, seguindo as instruções, antivírus desabilitado, dá seguinte mensagem sempre no momento de verificação do "SCAN DEFAULT VALUES PUP Eoreso" memória insuficiente, e tenho que finalizar.... Compartilhar este post Link para o post Compartilhar em outros sites
Ionara 2 Denunciar post Postado Dezembro 2, 2014 Enfim o ZHP rodou, segue link do log... http://cjoint.com/?DLcwvift6zr link copiado, por que o navegador, travava sempre.... Melhor postar o log.... ~ Relatório do ZHPDiag v2014.11.30.168 - Nicolas Coolman (30/11/2014) ~ Iniciado por Usuario (02/12/2014 19:02:28) ~ Facebook : https://www.facebook.com/nicolascoolman1 ~ Endereço do Webforum : http://forum.nicolascoolman.fr ~ Tradução pelo utilizador ~ Estatuto da versão : Versão atualizada. ~ Lista Branca : Desativado pelo Utilizador ~ Elevação dos Privilégios : OK ~ Controle de Conta de Utilizador : Deactivate by user ---\\ Navegadores Internet MSIE: Internet Explorer v8.0.7601.17514 ---\\ Informações sobre os produtos Windows ~ Langage: Portugais Windows Vista Ultimate, 64-bit Service Pack 1 (Build 6000) Windows Server License Manager Script : OK Software Protection Service (Protection logicielle) : OK Windows Automatic Updates : OK ---\\ Softwares de proteçao do sistema AVG 2015 v15.0.5577 Malwarebytes Anti-Malware versão 2.0.3.1025 ---\\ Softwares d'optimização do sistema ---\\ Softwares de partilha do PeerToPeer (P2P) ---\\ Monitoramento dos softwares Adobe Flash Player 11 Plugin Adobe Reader 9 - Português ---\\ Informações sobre o sistema ~ Processor: Intel64 Family 6 Model 42 Stepping 7, GenuineIntel ~ Operating System: 64 Bits Boot mode: Normal (Normal boot) Total RAM: 8098 MB (79% free) System Restore: Activé (Enable) System drive C: has 205 GB (83%) free of 244 GB ---\\ Modo de conexão ao sistema ~ Computer Name: USUARIO-PC ~ User Name: Usuario ~ All Users Names: Usuario, HomeGroupUser$, Convidado, Administrador, ~ Unselected Option: None Logged in as Administrator ---\\ As variáveis de ambiente ~ System Unit : C:\ ~ %AppZHP% : C:\Users\Usuario\AppData\Roaming\ZHP\ ~ %AppData% : C:\Users\Usuario\AppData\Roaming\ ~ %Desktop% : C:\Users\Usuario\Desktop\ ~ %Favorites% : C:\Users\Usuario\Favorites\ ~ %LocalAppData% : C:\Users\Usuario\AppData\Local\ ~ %StartMenu% : C:\Users\Usuario\AppData\Roaming\Microsoft\Windows\Start Menu\ ~ %Windir% : C:\Windows\ ~ %System% : C:\Windows\System32\ ---\\ Enumeração das unidades dos discos C: Hard drive, Flash drive, Thumb drive (Free 205 Go of 244 Go) D: Hard drive, Flash drive, Thumb drive (Free 222 Go of 222 Go) E: CD-ROM drive (Not Inserted) ---\\ Estado do Centro de Segurança do Windows [HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiSpywareOverride: OK [HKLM\SOFTWARE\Microsoft\Security Center\Svc] AntiVirusOverride: OK [HKLM\SOFTWARE\Microsoft\Security Center\Svc] FirewallOverride: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] EnableLUA: Modified [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN] CheckedValue: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] CheckedValue: OK [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations] Application: OK [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] Shell: OK [HKLM\SYSTEM\CurrentControlSet\Services\COMSysApp] Type: OK ~ Security Center: 40 Scanned in 00mn 00s ---\\ Pesquisa particular de ficheiros genéricos [MD5.AC4C51EB24AA95B77F705AB159189E24] - (.Microsoft Corporation - Windows Explorer.) (.20/11/2010 - 04:24:46.) -- C:\Windows\Explorer.exe [2872320] [MD5.94355C28C1970635A31B3FE52EB7CEBA] - (.Microsoft Corporation - Aplicativo de Inicialização do Windows.) (.13/07/2009 - 22:39:52.) -- C:\Windows\System32\Wininit.exe [129024] [MD5.F6C5302E1F4813D552F41A0AC82455E5] - (.Microsoft Corporation - Internet Extensions para Win32.) (.20/11/2010 - 04:27:30.) -- C:\Windows\System32\wininet.dll [1188864] [MD5.1151B1BAA6F350B1DB6598E0FEA7C457] - (.Microsoft Corporation - Aplicativo de Logon do Windows.) (.20/11/2010 - 04:25:32.) -- C:\Windows\System32\Winlogon.exe [390656] [MD5.067FA52BFB59A56110A12312EF9AF243] - (.Microsoft Corporation - Biblioteca de Licenciamento de Software.) (.20/11/2010 - 04:27:28.) -- C:\Windows\System32\sppcomapi.dll [232448] [MD5.D31DC7A16DEA4A9BAF179F3D6FBDB38C] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.20/11/2010 - 00:23:36.) -- C:\Windows\system32\Drivers\AFD.sys [499712] [MD5.02062C0B390B7729EDC9E69C680A6F3C] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.13/07/2009 - 22:52:21.) -- C:\Windows\system32\Drivers\atapi.sys [24128] [MD5.B8BD2BB284668C84865658C77574381A] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13/07/2009 - 20:19:47.) -- C:\Windows\system32\Drivers\Cdfs.sys [92160] [MD5.F036CE71586E93D94DAB220D7BDF4416] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20/11/2010 - 00:19:22.) -- C:\Windows\system32\Drivers\Cdrom.sys [147456] [MD5.9BB2EF44EAA163B29C4A4587887A0FE4] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20/11/2010 - 00:26:34.) -- C:\Windows\system32\Drivers\DfsC.sys [102400] [MD5.97BFED39B6B79EB12CDDBFEED51F56BB] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20/11/2010 - 01:43:44.) -- C:\Windows\system32\Drivers\HDAudBus.sys [122368] [MD5.FA55C73D4AFFA7EE23AC4BE53B4592D3] - (.Microsoft Corporation - Driver de porta i8042.) (.13/07/2009 - 20:19:57.) -- C:\Windows\system32\Drivers\i8042prt.sys [105472] [MD5.AF9B39A7E7B6CAA203B3862582E9F2D0] - (.Microsoft Corporation - IP Network Address Translator.) (.13/07/2009 - 21:10:03.) -- C:\Windows\system32\Drivers\IpNat.sys [116224] [MD5.FAF015B07E3A2874A790A39B7D2C579F] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.20/11/2010 - 00:27:44.) -- C:\Windows\system32\Drivers\MRxSmb.sys [158208] [MD5.09594D1089C523423B32A4229263F068] - (.Microsoft Corporation - MBT Transport driver.) (.20/11/2010 - 00:23:22.) -- C:\Windows\system32\Drivers\netBT.sys [261632] [MD5.05D78AA5CB5F3F5C31160BDB955D0B7C] - (.Microsoft Corporation - Driver do Sistema de Arquivos NT.) (.20/11/2010 - 04:33:48.) -- C:\Windows\system32\Drivers\ntfs.sys [1659776] [MD5.0086431C29C35BE1DBC43F52CC273887] - (.Microsoft Corporation - Driver de porta paralela.) (.13/07/2009 - 21:00:41.) -- C:\Windows\system32\Drivers\Parport.sys [97280] [MD5.471815800AE33E6F1C32FB1B97C490CA] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.20/11/2010 - 01:52:36.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [129536] [MD5.548260A7B8654E024DC30BF8A7C5BAA4] - (.Microsoft Corporation - SMB Transport driver.) (.13/07/2009 - 21:09:09.) -- C:\Windows\system32\Drivers\smb.sys [93184] [MD5.DDAD5A7AB24D8B65F8D724F5C20FD806] - (.Microsoft Corporation - TDI Translation Driver.) (.20/11/2010 - 00:21:58.) -- C:\Windows\system32\Drivers\tdx.sys [119296] [MD5.0D08D2F3B3FF84E433346669B5E0F639] - (.Microsoft Corporation - Driver de cópia de sombra de volume.) (.20/11/2010 - 04:34:04.) -- C:\Windows\system32\Drivers\volsnap.sys [295808] ~ Generic Processes: Scanned in 00mn 00s ---\\ Estatuto dos ficheiros ocultos (Oculto/Total) ~ Mes images (My Pictures) : 1/94 ~ Mes Favoris (My Favorites) : 1/22 ~ Mes Documents (My Documents) : 1/3 ~ Mon Bureau (My Desktop) : 1/137 ~ Menu demarrer (Programs) : 1/27 ~ Hidden Files: Scanned in 00mn 00s ---\\ Processos lançados [MD5.C44031488DED58FCE58E5D94BC345D30] - (.Nero AG - Nero Home.) -- C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1840424] [PID.2792] [MD5.8ED1BDDD6293E9E585A79E3BFFE9F12A] - (.IBM Corp. - RapportService.) -- C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe [2607384] [PID.2908] [MD5.4312B4DD07050FC58146756634058CE8] - (.AVG Technologies CZ, s.r.o. - AVG User Interface.) -- C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3653136] [PID.3040] [MD5.887CAA31048EB8ED09A0CBD0E6F46F09] - (.Oracle Corporation - Java Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776] [PID.3016] [MD5.638CD1D8AE8630E628D4E6462D3EF88E] - (.GAS Tecnologia - G-Buster Browser Defense - Service.) -- C:\Program Files (x86)\GbPlugin\GbpSv.exe [558904] [PID.360] [MD5.42D4456168E4A85AE1C29CCB008DC803] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files (x86)\ZHPDiag\ZHPDiag.exe [8135680] [PID.2532] [MD5.DCEB4D28DFFF5E95946F6084F0FFD356] - (.IBM Corp. - RapportMgmtService.) -- C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [1919256] [PID.980] [MD5.BA5BEC7FB1EABF3FBD38924AB45C7B3A] - (.AVG Technologies CZ, s.r.o. - AVG Watchdog Service.) -- C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [298080] [PID.1784] [MD5.1F79342D9EB530A48742F651E570983A] - (.Microsoft Corporation - Updates Skype Click to Call.) -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176] [PID.1812] [MD5.E4938E0A376CF0B9D989EE5C0A146891] - (.Microsoft Corporation - Phone Number Recognition (PNR) module.) -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520] [PID.1928] [MD5.2AAE889742376EDC5C3203DFB74F28FD] - (.Nero AG - Nero BackItUp.) -- C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe [877864] [PID.2068] [MD5.875E4E0661F3A5994DF9E5E3A0A4F96B] - (.Prolific Technology Inc. - PLFlash DeviceIoControl Service.) -- C:\Windows\SysWOW64\IoctlSvc.exe [81920] [PID.2148] [MD5.CB992AE1506985D9167E85883B4C3240] - (.Nero AG - Nero Home.) -- C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [537896] [PID.3780] ~ Processes Running: Scanned in 00mn 00s ---\\ Google Chrome, Arranque,Pesquisa,Extensões (G0,G1,G2) C:\Users\Usuario\AppData\Local\Google\Chrome\User Data\Default\Preferences ---\\ Pasta de extensão do Google Chrome ~ Google Lines Browser: 0 Scanned in 00mn 01s ---\\ Mozilla Firefox, Plugins,Arranque,Pesquisa,Extensões (P2,M0,M1,M2,M3) P2 - FPN: [HKLM] [@adobe.com/FlashPlayer] - (...) -- C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll P2 - FPN: [HKCU] [@tools.google.com/Google Update;version=3] - (.Google Inc. - Google Update.) -- C:\Users\Usuario\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll P2 - FPN: [HKCU] [@tools.google.com/Google Update;version=9] - (.Google Inc. - Google Update.) -- C:\Users\Usuario\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll P2 - FPN: [HKCU] [gastecnologia.com.br/sf/cef] - (.GAS Tecnologia - Internet Banking Helper.) -- C:\Users\Usuario\AppData\Local\GAS Tecnologia\GBBD\npsf_cef.dll ~ Firefox Browser: 4 Scanned in 00mn 00s ---\\ Internet Explorer, Arranque, Pesquisa, URLSearchHook( gancho de URL), Phishing (R0,R1,R3,R4) R0 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com R0 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com R0 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com R1 - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com R1 - HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs = res://ieframe.dll/tabswelcome.htm R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs,Tabs = res://ieframe.dll/tabswelcome.htm R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Extensions Off Page = about:noadd-ons R1 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main,Security Risk Page = about:securityrisk R3 - URLSearchHook: Microsoft Url Search Hook [64Bits] - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Microsoft Corporation - Navegador da Internet.) (8.00.7600.16385 (win7_rtm.090713-1255)) -- C:\Windows\SysWOW64\ieframe.dll R4 - HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter,EnabledV8 = 0 R4 - HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\PhishingFilter,EnabledV8 = 0 ~ IE Browser: 19 Scanned in 00mn 00s ---\\ Internet Explorer, Gestão do Proxy (R5) R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1 R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll ~ Proxy management: Scanned in 00mn 00s ---\\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe, F2 - REG:system.ini: Shell=C:\Windows\explorer.exe F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe ~ Keys: Scanned in 00mn 00s ---\\ Redireção do ficheiro Hosts (01) ~ Le fichier hôte est sain (The hosts file is clean) (21) ~ Hosts File: Scanned in 00mn 00s ---\\ Browser Helper Objects do navegador (02) O2 - BHO: AcroIEHelperStub [64Bits] - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} . (.Adobe Systems Incorporated - Adobe PDF Helper for Internet Explorer.) -- C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Groove GFS Browser Helper [64Bits] - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} . (.Microsoft Corporation - GrooveShellExtensions Module.) -- C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Java Plug-In SSV Helper [64Bits] - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} . (.Oracle Corporation - Java Platform SE binary.) -- C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll O2 - BHO: SkypeIEPluginBHO [64Bits] - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} . (.Microsoft Corporation - Skype Click to Call IE Add-on.) -- C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: G-Buster Browser Defense CEF [64Bits] - {C41A1C0E-EA6C-11D4-B1B8-444553540003} . (.Caixa Economica Federal - Gbieh Module.) -- C:\Program Files (x86)\GbPlugin\gbiehcef.dll O2 - BHO: Java Plug-In 2 SSV Helper [64Bits] - {DBC80044-A445-435b-BC74-9C25C1C588A9} . (.Oracle Corporation - Java Platform SE binary.) -- C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll ~ BHO: 7 Scanned in 00mn 00s ---\\ Aplicações iniciadas por registo & pastas (04) O4 - HKLM\..\Run: [igfxTray] . (.Intel Corporation - igfxTray Module.) -- C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] . (.Intel Corporation - hkcmd Module.) -- C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] . (.Intel Corporation - persistence Module.) -- C:\Windows\system32\igfxpers.exe O4 - HKCU\..\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] . (.Nero AG - Nero Home.) -- C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe O4 - HKCU\..\Run: [Google Update] . (.Google Inc. - Google Installer.) -- C:\Users\Usuario\AppData\Local\Google\Update\GoogleUpdate.exe O4 - HKLM\..\Wow6432Node\Run: [Adobe Reader Speed Launcher] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe O4 - HKLM\..\Wow6432Node\Run: [NBKeyScan] . (.Nero AG - Nero BackItUp.) -- C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe O4 - HKLM\..\Wow6432Node\Run: [GrooveMonitor] . (.Microsoft Corporation - GrooveMonitor Utility.) -- C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe O4 - HKLM\..\Wow6432Node\Run: [HDAudDeck] . (.VIA - VIA HD Audio CPL.) -- C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe O4 - HKLM\..\Wow6432Node\Run: [AVG_UI] . (.AVG Technologies CZ, s.r.o. - AVG User Interface.) -- C:\Program Files (x86)\AVG\AVG2015\avgui.exe O4 - HKLM\..\Wow6432Node\Run: [sunJavaUpdateSched] . (.Oracle Corporation - Java Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe =>.Oracle Corporation O4 - HKUS\S-1-5-19\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe O4 - HKUS\S-1-5-20\..\Run: [sidebar] . (.Microsoft Corporation - Gadgets da Área de Trabalho do Windows.) -- C:\Program Files (x86)\Windows Sidebar\Sidebar.exe O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe =>.Microsoft Corporation O4 - HKUS\S-1-5-21-4088202244-695289871-602143169-1000\..\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] . (.Nero AG - Nero Home.) -- C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe O4 - HKUS\S-1-5-21-4088202244-695289871-602143169-1000\..\Run: [Google Update] . (.Google Inc. - Google Installer.) -- C:\Users\Usuario\AppData\Local\Google\Update\GoogleUpdate.exe ~ Application: Scanned in 00mn 00s ---\\ Icones das opções IE invisiveis no painel das configurações (05) O5 - control.ini: [HKLM\..\Control Panel] inetcpl.cpl=no ~ IE Control Panel: 1 Scanned in 00mn 00s ---\\ Boutões da barra de ferramentas principal do Internet Explorer (09) O9 - Extra button: Skype Click to Call settings [64Bits] - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} . (...) -- c:\program files (x86)\skype\toolbars\internet explorer x64\icon.ico ~ IE Extra Buttons: Scanned in 00mn 00s ---\\ Winsock hijacker (Layered Service Provider) (O10) O10 - WLSP:\000000000001\Winsock LSP File . (.Microsoft Corporation - Network Location Awareness 2.) -- C:\Windows\system32\NLAapi.dll O10 - WLSP:\000000000002\Winsock LSP File . (.Microsoft Corporation - Provedor de Correção de Nomeação de Emails.) -- C:\Windows\system32\napinsp.dll O10 - WLSP:\000000000003\Winsock LSP File . (.Microsoft Corporation - PNRP Name Space Provider.) -- C:\Windows\system32\pnrpnsp.dll O10 - WLSP:\000000000004\Winsock LSP File . (.Microsoft Corporation - PNRP Name Space Provider.) -- C:\Windows\system32\pnrpnsp.dll O10 - WLSP:\000000000005\Winsock LSP File . (.Microsoft Corporation - Provedor de serviços do Microsoft Windows Sockets 2.0.) -- C:\Windows\system32\mswsock.dll O10 - WLSP:\000000000006\Winsock LSP File . (.Microsoft Corporation - LDAP RnR Provider DLL.) -- C:\Windows\system32\winrnr.dll ~ Winsock: 6 Scanned in 00mn 00s ---\\ Site na zona confiavél do Internet Explorer (05) O15 - Trusted Zone: [HKCU\...\Domains\www] http.caixa.gov.br ~ IE Zone Confiance: Scanned in 00mn 00s ---\\ Alteração Dominio/Clientes DNS (017) O17 - HKLM\System\CCS\Services\Tcpip\..\{2B0A5CA7-9A93-4AFF-9691-9F8594E88784}: DhcpNameServer = 172.16.0.254 O17 - HKLM\System\CS1\Services\Tcpip\..\{2B0A5CA7-9A93-4AFF-9691-9F8594E88784}: DhcpNameServer = 172.16.0.254 O17 - HKLM\System\CS2\Services\Tcpip\..\{2B0A5CA7-9A93-4AFF-9691-9F8594E88784}: DhcpNameServer = 172.16.0.254 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 172.16.0.254 ~ Domain: Scanned in 00mn 00s ---\\ Protocolo adicional (018) O18 - Handler: vbscript [64Bits] - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} . (.Microsoft Corporation - Visualizador de HTML da Microsoft ®.) -- C:\Windows\System32\mshtml.dll O18 - Filter: text/xml [64Bits] - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.dll =>.Microsoft Corporation ~ Protocole Additionnel: Scanned in 00mn 00s ---\\ Valor do Registo AppInit_DLLs e sub-chaves Winlogon Notify (autorun) (O20) O20 - Winlogon Notify: igfxcui . (.Intel Corporation - igfxdev Module.) -- C:\Windows\System32\igfxdev.dll ~ Winlogon: Scanned in 00mn 00s ---\\ Chave do Registo autorun ShellServiceObjectDelayLoad (SSO/SSODL) (O21) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. ~ SSODL: 1 Scanned in 00mn 00s ---\\ Lista dos serviços NT não Microsoft e não desativados (023) O23 - Service: AVGIDSAgent (AVGIDSAgent) . (.AVG Technologies CZ, s.r.o. - AVG Identity Protection Service.) - C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe O23 - Service: Watchdog do AVG (avgwd) . (.AVG Technologies CZ, s.r.o. - AVG Watchdog Service.) - C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe O23 - Service: Gbp Service (GbpSv) . (.GAS Tecnologia - G-Buster Browser Defense - Service.) - C:\Program Files (x86)\GbPlugin\GbpSv.exe O23 - Service: Nero BackItUp Scheduler 3 (Nero BackItUp Scheduler 3) . (.Nero AG - Nero BackItUp.) - C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: PLFlash DeviceIoControl Service (PLFlash DeviceIoControl Service) . (.Prolific Technology Inc. - PLFlash DeviceIoControl Service.) - C:\Windows\SysWOW64\IoctlSvc.exe O23 - Service: Rapport Management Service (RapportMgmtService) . (.IBM Corp. - RapportMgmtService.) - C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe O23 - Service: Skype Updater (SkypeUpdate) . (.Skype Technologies - Skype Updater Service.) - C:\Program Files (x86)\Skype\Updater\Updater.exe O23 - Service: VIA Karaoke digital mixer Service (VIAKaraokeService) . (.VIA Technologies, Inc. - Service binary.) - C:\Windows\System32\viakaraokesrv.exe ~ Services: 8 Scanned in 00mn 21s ---\\ Enumeração Ativa do Ambiente de trabalho & Editor MHTML (024) O24 - Default MHTML Editor: Last - .(...) - (.not file.) ~ Desktop Component: 4 Scanned in 00mn 00s ---\\ Listagem dos dados do BootExecute (Bex) (034) O34 - HKLM BootExecute: (autocheck autochk *) - File not found ~ BEX: 1 Scanned in 00mn 00s ---\\ Tarefas planificadas automaticamente (039) [MD5.506708142BC63DABA64F2D3AD1DCD5BF] [APT] [GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000Core] (.Google Inc..) -- C:\Users\Usuario\AppData\Local\Google\Update\GoogleUpdate.exe [116648] [MD5.506708142BC63DABA64F2D3AD1DCD5BF] [APT] [GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000UA] (.Google Inc..) -- C:\Users\Usuario\AppData\Local\Google\Update\GoogleUpdate.exe [116648] [MD5.00000000000000000000000000000000] [APT] [Run_Bobby_Browser] (...) -- C:\Users\Usuario\AppData\Local\BoBrowser\Application\bobrowser.exe (.not file.) [0] =>PUP.BoBrowser [MD5.C155A13687144076286989EF078112C2] [APT] [{4C00E39F-EC56-418C-8BED-28239473F78A}] (.Nicolas Coolman.) -- C:\Program Files (x86)\ZHPDiag\ZHPhep.exe [1917440] O39 - APT: GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000Core - (.Google Inc..) -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000Core.job [1034] O39 - APT: GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000Core - (.Google Inc..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000Core [1034] O39 - APT: GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000UA - (.Google Inc..) -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000UA.job [1086] O39 - APT: GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000UA - (.Google Inc..) -- C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000UA [1086] ~ Scheduled Task: 6 Scanned in 00mn 06s ---\\ Componentes instalados (ActiveSetup Installed Components) (040) O40 - ASIC: Microsoft Windows Media Player [64Bits] - >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} . (.Microsoft Corporation - Recursos do Windows Media Player.) -- C:\Windows\System32\wmploc.dll =>.Microsoft Corporation O40 - ASIC: Internet Explorer [64Bits] - >{26923b43-4d38-484f-9b9e-de460746276c} . (.Microsoft Corporation - Utilitário de Inicialização por Usuário do Internet Explorer.) -- C:\Windows\System32\ie4uinit.exe O40 - ASIC: Browser Customizations [64Bits] - >{60B49E34-C7CC-11D0-8953-00A0C90347FF} . (.Microsoft Corporation - Identidade visual IEAK.) -- C:\Windows\System32\iedkcs32.dll O40 - ASIC: Microsoft Windows Media Player 12.0 [64Bits] - {22d6f312-b0f6-11d0-94ab-0080c74c7e95} . (.Microsoft Corporation - Windows Media Player Extension.) -- C:\Windows\SysWOW64\wmpdxm.dll =>.Microsoft Corporation O40 - ASIC: Themes Setup [64Bits] - {2C7339CF-2B09-4501-B3F3-F3508C9228ED} . (.Microsoft Corporation - API de tema do Windows.) -- C:\Windows\System32\themeui.dll O40 - ASIC: Microsoft Windows [64Bits] - {44BBA840-CC51-11CF-AAFA-00AA00B6015C} . (.Microsoft Corporation - Windows Mail.) -- C:\Program Files (x86)\Windows Mail\WinMail.exe =>.Microsoft Corporation O40 - ASIC: Browsing Enhancements [64Bits] - {630b1da0-b465-11d1-9948-00c04f98bbc9} . (.Microsoft Corporation - Extensão shell da pasta FTP do Microsoft Internet Explorer.) -- C:\Windows\System32\msieftp.dll O40 - ASIC: Microsoft Windows Media Player [64Bits] - {6BF52A52-394A-11d3-B153-00C04F79FAA6} . (.Microsoft Corporation - Recursos do Windows Media Player.) -- C:\Windows\System32\wmploc.dll =>.Microsoft Corporation O40 - ASIC: Windows Desktop Update [64Bits] - {89820200-ECBD-11cf-8B85-00AA005B4340} . (.Microsoft Corporation - DLL comum do Shell do Windows.) -- C:\Windows\System32\shell32.dll O40 - ASIC: Web Platform Customizations [64Bits] - {89820200-ECBD-11cf-8B85-00AA005B4383} . (.Microsoft Corporation - Utilitário de Inicialização por Usuário do Internet Explorer.) -- C:\Windows\System32\ie4uinit.exe O40 - ASIC: (no name) [64Bits] - {89B4C1CD-B018-4511-B0A1-5476DBF70820} . (.Microsoft Corporation - Microsoft .NET IE SECURITY REGISTRATION.) -- C:\Windows\system32\mscories.dll ~ Active Setup: 11 Scanned in 00mn 00s ---\\ Drivers lançados ao arranque do sistema (041) O41 - Driver: C:\Windows\System32\drivers\afd.sys (AFD) . (.Microsoft Corporation - Ancillary Function Driver for WinSock.) - C:\Windows\system32\drivers\afd.sys O41 - Driver: (Avgdiska) . (.AVG Technologies CZ, s.r.o. - AVG File Vault Driver.) - C:\Windows\System32\DRIVERS\avgdiska.sys O41 - Driver: (AVGIDSDriver) . (.AVG Technologies CZ, s.r.o. - AVG IDS Application Activity Monitor Driver.) - C:\Windows\System32\DRIVERS\avgidsdrivera.sys O41 - Driver: (Avgldx64) . (.AVG Technologies CZ, s.r.o. - AVG AVI Loader Driver.) - C:\Windows\System32\DRIVERS\avgldx64.sys O41 - Driver: (Avgtdia) . (.AVG Technologies CZ, s.r.o. - AVG Network connection watcher.) - C:\Windows\System32\DRIVERS\avgtdia.sys O41 - Driver: (blbdrive) . (.Microsoft Corporation - BLB Drive Driver.) - C:\Windows\System32\DRIVERS\blbdrive.sys O41 - Driver: (cdrom) . (.Microsoft Corporation - SCSI CD-ROM Driver.) - C:\Windows\System32\DRIVERS\cdrom.sys O41 - Driver: C:\Windows\System32\drivers\dfsc.sys (DfsC) . (.Microsoft Corporation - DFS Namespace Client Driver.) - C:\Windows\System32\Drivers\dfsc.sys O41 - Driver: C:\Windows\System32\drivers\discache.sys (discache) . (.Microsoft Corporation - System Indexer/Cache Driver.) - C:\Windows\System32\drivers\discache.sys O41 - Driver: (mosfilterdrv) . (.NetFilterSDK.com - NetFilter SDK TDI Hook Driver (WPP).) - C:\Windows\System32\drivers\mosfilterdrv.sys O41 - Driver: (mssmbios) . (.Microsoft Corporation - System Management BIOS Driver.) - C:\Windows\System32\DRIVERS\mssmbios.sys O41 - Driver: (NetBIOS) . (.Microsoft Corporation - NetBIOS interface driver.) - C:\Windows\System32\DRIVERS\netbios.sys O41 - Driver: C:\Windows\System32\drivers\netbt.sys (NetBT) . (.Microsoft Corporation - MBT Transport driver.) - C:\Windows\System32\DRIVERS\netbt.sys O41 - Driver: C:\Windows\System32\drivers\nsiproxy.sys (nsiproxy) . (.Microsoft Corporation - NSI Proxy.) - C:\Windows\System32\drivers\nsiproxy.sys O41 - Driver: (pofilterdrv) . (.NetFilterSDK.com - NetFilter SDK TDI Hook Driver (WPP).) - C:\Windows\System32\drivers\pofilterdrv.sys O41 - Driver: C:\Windows\System32\drivers\pacer.sys (Psched) . (.Microsoft Corporation - Agendador de pacotes de serviço.) - C:\Windows\System32\DRIVERS\pacer.sys O41 - Driver: (RapportCerberus_80071) . (...) - C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_80071.sys O41 - Driver: (RapportEI64) . (.IBM Corp. - RapportEI64.) - C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys O41 - Driver: (RapportPG64) . (.IBM Corp. - RapportPG64.) - C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys O41 - Driver: C:\Windows\System32\wkssvc.dll (rdbss) . (.Microsoft Corporation - Driver do Subsistema de Buffer da Unidade R.) - C:\Windows\System32\DRIVERS\rdbss.sys O41 - Driver: C:\Windows\System32\DRIVERS\RDPCDD.sys (RDPCDD) . (.Microsoft Corporation - RDP Miniport.) - C:\Windows\System32\DRIVERS\RDPCDD.sys O41 - Driver: C:\Windows\System32\drivers\RDPENCDD.sys (RDPENCDD) . (.Microsoft Corporation - RDP Encoder Miniport.) - C:\Windows\System32\drivers\rdpencdd.sys O41 - Driver: C:\Windows\System32\drivers\RdpRefMp.sys (RDPREFMP) . (.Microsoft Corporation - RDP Reflector Driver Miniport.) - C:\Windows\System32\drivers\rdprefmp.sys O41 - Driver: (Serial) . (.Brother Industries Ltd. - Brother Serial I/F Driver (WDM).) - C:\Windows\System32\DRIVERS\serial.sys O41 - Driver: C:\Windows\System32\tcpipcfg.dll (tdx) . (.Microsoft Corporation - TDI Translation Driver.) - C:\Windows\System32\DRIVERS\tdx.sys O41 - Driver: (TermDD) . (.Microsoft Corporation - Remote Desktop Server Driver.) - C:\Windows\System32\DRIVERS\termdd.sys O41 - Driver: (VgaSave) . (.Microsoft Corporation - VGA/Super VGA Video Driver.) - C:\Windows\system32\drivers\vga.sys O41 - Driver: C:\Windows\System32\rascfg.dll (Wanarpv6) . (.Microsoft Corporation - MS Remote Access and Routing ARP Driver.) - C:\Windows\System32\DRIVERS\wanarp.sys O41 - Driver: (WfpLwf) . (.Microsoft Corporation - WFP NDIS 6.20 Lightweight Filter Driver.) - C:\Windows\System32\DRIVERS\wfplwf.sys ~ Drivers: 87 Scanned in 00mn 00s ---\\ Software instalados (042) O42 - Logiciel: AVG 2015 - (.AVG Technologies.) [HKLM][64Bits] -- AVG O42 - Logiciel: AVG 2015 - (.AVG Technologies.) [HKLM][64Bits] -- {2B77B867-D7B9-4789-94E1-94D3BBBA642C} O42 - Logiciel: AVG 2015 - (.AVG Technologies.) [HKLM][64Bits] -- {41357956-5B67-489C-9F7D-FABACC2CD3CB} O42 - Logiciel: Adobe Flash Player 11 Plugin - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- Adobe Flash Player Plugin O42 - Logiciel: Adobe Reader 9 - Português - (.Adobe Systems Incorporated.) [HKLM][64Bits] -- {AC76BA86-7AD7-1046-7B44-A90000000001} O42 - Logiciel: Foxit PhantomPDF - (.Foxit Corporation.) [HKLM][64Bits] -- {4B6D9565-5CA8-4D2C-B9F6-0A2D7F67474F} O42 - Logiciel: GBBD Caixa Economica Federal - (...) [HKLM][64Bits] -- {5d01f486-f32d-462e-8830-cc1d116e8ece}_is1 O42 - Logiciel: Google Chrome - (.Google Inc..) [HKCU][64Bits] -- Google Chrome O42 - Logiciel: Intel® Processor Graphics - (.Intel Corporation.) [HKLM][64Bits] -- {F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA} O42 - Logiciel: Java 8 Update 25 - (.Oracle Corporation.) [HKLM][64Bits] -- {26A24AE4-039D-4CA4-87B4-2F83218025F0} O42 - Logiciel: Malwarebytes Anti-Malware versão 2.0.3.1025 - (.Malwarebytes Corporation.) [HKLM][64Bits] -- Malwarebytes Anti-Malware_is1 O42 - Logiciel: Nero 8 Ultra Edition HD - (.Nero AG.) [HKLM][64Bits] -- {D6C9AF27-9414-46C8-B9D8-D878BA041046} O42 - Logiciel: Proteção de Terminal Trusteer - (.Trusteer.) [HKLM][64Bits] -- Rapport_msi O42 - Logiciel: Qualcomm Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Dr - (.Qualcomm Atheros Communications Inc..) [HKLM][64Bits] -- {3108C217-BE83-42E4-AE9E-A56A2A92E549} O42 - Logiciel: RaidCall - (.raidcall.com.br.) [HKLM][64Bits] -- RaidCall O42 - Logiciel: Rapport - (.Trusteer.) [HKLM][64Bits] -- {1DD81E7D-0D28-4CEB-87B2-C041A4FCB215} O42 - Logiciel: Revo Uninstaller Pro 3.1.1 - (.VS Revo Group, Ltd..) [HKLM][64Bits] -- {67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1 O42 - Logiciel: Sid Meier's Civilization 4 - (.Firaxis Games.) [HKCU][64Bits] -- {CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8} O42 - Logiciel: Skype Click to Call - (.Microsoft Corporation.) [HKLM][64Bits] -- {6D1221A9-17BF-4EC0-81F2-27D30EC30701} O42 - Logiciel: Skype™ 6.20 - (.Skype Technologies S.A..) [HKLM][64Bits] -- {24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7} O42 - Logiciel: VCRedistSetup - (.Nero AG.) [HKLM][64Bits] -- {3921A67A-5AB1-4E48-9444-C71814CF3027} O42 - Logiciel: VIA Gerenciador de dispositivo de plataforma - (.VIA Technologies, Inc..) [HKLM][64Bits] -- InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169} O42 - Logiciel: Visual Studio 2012 x64 Redistributables - (.AVG Technologies.) [HKLM][64Bits] -- {8C775E70-A791-4DA8-BCC3-6AB7136F4484} O42 - Logiciel: Visual Studio 2012 x86 Redistributables - (.AVG Technologies CZ, s.r.o..) [HKLM][64Bits] -- {98EFF19A-30AB-4E4B-B943-F06B1C63EBF8} O42 - Logiciel: XP Codec Pack - (...) [HKLM][64Bits] -- XP Codec Pack O42 - Logiciel: neroxml - (.Nero AG.) [HKLM][64Bits] -- {56C049BE-79E9-4502-BEA7-9754A3E60F9B} ~ Logic: 43 Scanned in 00mn 00s ---\\ HKCU & HKLM Software Keys [HKCU\Software\AC3Filter] [HKCU\Software\Adobe] [HKCU\Software\Ahead] [HKCU\Software\AppDataLow\Software\JavaSoft] [HKCU\Software\AppDataLow] [HKCU\Software\AutoHelpDesk] [HKCU\Software\Avg] [HKCU\Software\Baidu Security] [HKCU\Software\BoBrowser] =>PUP.BoBrowser [HKCU\Software\Classes] [HKCU\Software\Clients] [HKCU\Software\Firaxis Games] [HKCU\Software\Foxit Software] [HKCU\Software\GNU] [HKCU\Software\Gabest] [HKCU\Software\GbPlugin] [HKCU\Software\Google] [HKCU\Software\IM Providers] [HKCU\Software\Intel\Indeo\4.1] [HKCU\Software\Intel] [HKCU\Software\JavaSoft] [HKCU\Software\Macromedia] [HKCU\Software\Mirage] [HKCU\Software\MozillaPlugins] [HKCU\Software\NeroDigital] [HKCU\Software\Nero] [HKCU\Software\Netscape] [HKCU\Software\ODBC] [HKCU\Software\Policies] [HKCU\Software\RealNetworks] [HKCU\Software\Skype] [HKCU\Software\Trend Micro] [HKCU\Software\Trolltech] [HKCU\Software\Trusteer] [HKCU\Software\VS Revo Group] [HKCU\Software\WinRAR SFX] [HKCU\Software\Wow6432Node] [HKCU\Software\XP Codec Pack] [HKLM\Software\ATI Technologies] [HKLM\Software\Audible] [HKLM\Software\Baidu Security] [HKLM\Software\Classes] [HKLM\Software\Clients] [HKLM\Software\Foxit Software] [HKLM\Software\IM Providers] [HKLM\Software\Intel] [HKLM\Software\JavaSoft] [HKLM\Software\JreMetrics] [HKLM\Software\Macromedia] [HKLM\Software\MozillaPlugins] [HKLM\Software\Nero] [HKLM\Software\ODBC] [HKLM\Software\Policies] [HKLM\Software\QSound Labs, Inc.] [HKLM\Software\RegisteredApplications] [HKLM\Software\Sonic] [HKLM\Software\Wow6432Node\Adobe] [HKLM\Software\Wow6432Node\Ahead] [HKLM\Software\Wow6432Node\Atheros Communications Inc.] [HKLM\Software\Wow6432Node\Audible] [HKLM\Software\Wow6432Node\Avg] [HKLM\Software\Wow6432Node\Baidu Security] [HKLM\Software\Wow6432Node\Baidu_Drp_pos] [HKLM\Software\Wow6432Node\C07ft5Y] [HKLM\Software\Wow6432Node\Clara] [HKLM\Software\Wow6432Node\Classes] [HKLM\Software\Wow6432Node\Clients] [HKLM\Software\Wow6432Node\Firaxis Games] [HKLM\Software\Wow6432Node\Foxit Software] [HKLM\Software\Wow6432Node\GNU] [HKLM\Software\Wow6432Node\Google] [HKLM\Software\Wow6432Node\IM Providers] [HKLM\Software\Wow6432Node\InstallShield] [HKLM\Software\Wow6432Node\Intel] [HKLM\Software\Wow6432Node\JavaSoft] [HKLM\Software\Wow6432Node\JreMetrics] [HKLM\Software\Wow6432Node\Macromedia] [HKLM\Software\Wow6432Node\Malwarebytes' Anti-Malware] [HKLM\Software\Wow6432Node\MozillaPlugins] [HKLM\Software\Wow6432Node\NeroDigital] [HKLM\Software\Wow6432Node\Nero] [HKLM\Software\Wow6432Node\ODBC] [HKLM\Software\Wow6432Node\Policies] [HKLM\Software\Wow6432Node\Qualcomm Atheros Communications Inc.] [HKLM\Software\Wow6432Node\RCBR] [HKLM\Software\Wow6432Node\RealNetworks] [HKLM\Software\Wow6432Node\RegisteredApplications] [HKLM\Software\Wow6432Node\Skype] [HKLM\Software\Wow6432Node\TrendMicro] [HKLM\Software\Wow6432Node\Trusteer] [HKLM\Software\Wow6432Node\VIA Technologies, Inc] [HKLM\Software\Wow6432Node\baidu] [HKLM\Software\Wow6432Node] ~ Key Software: 165 Scanned in 00mn 00s ---\\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43) O43 - CFD: 16/05/2011 - 16:26:29 - [] ----D C:\Program Files (x86)\Adobe O43 - CFD: 21/10/2014 - 16:14:43 - [] ----D C:\Program Files (x86)\AVG O43 - CFD: 23/11/2014 - 16:05:02 - [] ----D C:\Program Files (x86)\Common Files O43 - CFD: 27/11/2014 - 20:43:27 - [] ----D C:\Program Files (x86)\ESET O43 - CFD: 11/11/2014 - 22:36:55 - [] ----D C:\Program Files (x86)\Foxit Software O43 - CFD: 30/11/2014 - 00:07:41 - [] ----D C:\Program Files (x86)\GbPlugin O43 - CFD: 21/10/2014 - 19:31:20 - [0] ----D C:\Program Files (x86)\GUM8046.tmp O43 - CFD: 21/10/2014 - 12:37:48 - [] --H-D C:\Program Files (x86)\InstallShield Installation Information O43 - CFD: 21/10/2014 - 12:39:05 - [] ----D C:\Program Files (x86)\Intel O43 - CFD: 07/02/2011 - 03:11:15 - [] ----D C:\Program Files (x86)\Internet Explorer O43 - CFD: 05/11/2014 - 21:26:41 - [] ----D C:\Program Files (x86)\Java O43 - CFD: 21/10/2014 - 19:29:48 - [] ----D C:\Program Files (x86)\Malwarebytes Anti-Malware O43 - CFD: 16/05/2011 - 17:06:13 - [] ----D C:\Program Files (x86)\Microsoft Office O43 - CFD: 16/05/2011 - 17:06:12 - [] ----D C:\Program Files (x86)\Microsoft Visual Studio O43 - CFD: 16/05/2011 - 17:04:52 - [] ----D C:\Program Files (x86)\Microsoft Visual Studio 8 O43 - CFD: 16/05/2011 - 17:06:25 - [] ----D C:\Program Files (x86)\Microsoft Works O43 - CFD: 16/05/2011 - 17:06:04 - [] ----D C:\Program Files (x86)\Microsoft.NET O43 - CFD: 16/05/2011 - 17:06:16 - [] ----D C:\Program Files (x86)\MSBuild O43 - CFD: 16/05/2011 - 16:37:08 - [] ----D C:\Program Files (x86)\Nero O43 - CFD: 23/11/2014 - 16:07:05 - [0] ----D C:\Program Files (x86)\NJax O43 - CFD: 22/10/2014 - 18:42:13 - [] ----D C:\Program Files (x86)\RaidCall.BR O43 - CFD: 14/07/2009 - 03:32:38 - [] ----D C:\Program Files (x86)\Reference Assemblies O43 - CFD: 21/10/2014 - 16:13:14 - [] R---D C:\Program Files (x86)\Skype O43 - CFD: 26/11/2014 - 21:46:02 - [] ----D C:\Program Files (x86)\Trend Micro O43 - CFD: 05/11/2014 - 21:11:52 - [] ----D C:\Program Files (x86)\Trusteer O43 - CFD: 14/07/2009 - 02:57:06 - [0] --H-D C:\Program Files (x86)\Uninstall Information O43 - CFD: 21/10/2014 - 12:35:37 - [] ----D C:\Program Files (x86)\VIA O43 - CFD: 14/07/2009 - 15:55:40 - [] ----D C:\Program Files (x86)\Windows Defender O43 - CFD: 07/02/2011 - 03:11:15 - [] ----D C:\Program Files (x86)\Windows Mail =>.Microsoft Corporation O43 - CFD: 07/02/2011 - 03:11:14 - [] ----D C:\Program Files (x86)\Windows Media Player =>.Microsoft Corporation O43 - CFD: 14/07/2009 - 03:32:38 - [] ----D C:\Program Files (x86)\Windows NT O43 - CFD: 07/02/2011 - 03:11:14 - [] ----D C:\Program Files (x86)\Windows Photo Viewer O43 - CFD: 07/02/2011 - 03:11:14 - [] ----D C:\Program Files (x86)\Windows Portable Devices O43 - CFD: 07/02/2011 - 03:11:15 - [] ----D C:\Program Files (x86)\Windows Sidebar O43 - CFD: 24/11/2014 - 22:14:52 - [] ----D C:\Program Files (x86)\WinRAR O43 - CFD: 16/05/2011 - 16:09:42 - [] ----D C:\Program Files (x86)\XP Codec Pack O43 - CFD: 02/12/2014 - 18:59:54 - [] ----D C:\Program Files (x86)\ZHPDiag =>.Nicolas Coolman O43 - CFD: 16/05/2011 - 16:26:30 - [] ----D C:\Program Files (x86)\Common Files\Adobe O43 - CFD: 16/05/2011 - 17:06:12 - [] ----D C:\Program Files (x86)\Common Files\DESIGNER O43 - CFD: 30/11/2014 - 00:07:41 - [] ----D C:\Program Files (x86)\Common Files\InstallShield O43 - CFD: 21/10/2014 - 12:39:06 - [] ----D C:\Program Files (x86)\Common Files\Intel O43 - CFD: 16/11/2014 - 21:34:27 - [] ----D C:\Program Files (x86)\Common Files\Java O43 - CFD: 16/05/2011 - 17:06:24 - [] ----D C:\Program Files (x86)\Common Files\microsoft shared O43 - CFD: 16/05/2011 - 16:37:13 - [] ----D C:\Program Files (x86)\Common Files\Nero O43 - CFD: 14/07/2009 - 01:20:08 - [] ----D C:\Program Files (x86)\Common Files\Services O43 - CFD: 21/10/2014 - 16:12:03 - [] ----D C:\Program Files (x86)\Common Files\Skype O43 - CFD: 14/07/2009 - 01:20:08 - [] ----D C:\Program Files (x86)\Common Files\SpeechEngines O43 - CFD: 16/05/2011 - 17:04:40 - [] ----D C:\Program Files (x86)\Common Files\System O43 - CFD: 11/11/2014 - 22:42:46 - [] ----D C:\ProgramData\ABBYY O43 - CFD: 16/05/2011 - 16:26:44 - [] ----D C:\ProgramData\Adobe O43 - CFD: 14/07/2009 - 03:08:56 - [] -SH-D C:\ProgramData\Application Data O43 - CFD: 21/10/2014 - 19:38:47 - [] ----D C:\ProgramData\AVG2015 O43 - CFD: 23/11/2014 - 16:01:35 - [] ----D C:\ProgramData\baidu O43 - CFD: 24/11/2014 - 22:15:21 - [] ----D C:\ProgramData\Baidu Security O43 - CFD: 26/11/2014 - 20:31:20 - [0] ----D C:\ProgramData\boost_interprocess O43 - CFD: 21/10/2014 - 16:12:09 - [] --H-D C:\ProgramData\Common Files O43 - CFD: 16/05/2011 - 15:53:11 - [] -SH-D C:\ProgramData\Dados de aplicativos O43 - CFD: 14/07/2009 - 03:08:56 - [] -SH-D C:\ProgramData\Desktop O43 - CFD: 16/05/2011 - 15:53:11 - [] -SH-D C:\ProgramData\Documentos O43 - CFD: 14/07/2009 - 03:08:56 - [] -SH-D C:\ProgramData\Documents O43 - CFD: 14/07/2009 - 03:08:56 - [] -SH-D C:\ProgramData\Favorites O43 - CFD: 16/05/2011 - 15:53:11 - [] -SH-D C:\ProgramData\Favoritos O43 - CFD: 26/11/2014 - 20:48:08 - [] ----D C:\ProgramData\GAS Tecnologia O43 - CFD: 02/12/2014 - 06:30:13 - [] ----D C:\ProgramData\GbPlugin O43 - CFD: 30/11/2014 - 00:07:41 - [] ----D C:\ProgramData\Glyph O43 - CFD: 21/10/2014 - 19:29:46 - [] ----D C:\ProgramData\Malwarebytes O43 - CFD: 16/05/2011 - 15:53:11 - [] -SH-D C:\ProgramData\Menu Iniciar O43 - CFD: 02/12/2014 - 18:54:07 - [] ----D C:\ProgramData\MFAData O43 - CFD: 21/10/2014 - 19:14:42 - [] -S--D C:\ProgramData\Microsoft O43 - CFD: 10/11/2014 - 11:13:40 - [] ----D C:\ProgramData\Microsoft Help O43 - CFD: 16/05/2011 - 15:53:11 - [] -SH-D C:\ProgramData\Modelos O43 - CFD: 16/05/2011 - 16:37:09 - [] ----D C:\ProgramData\Nero O43 - CFD: 05/11/2014 - 21:26:43 - [] ----D C:\ProgramData\Oracle O43 - CFD: 11/11/2014 - 22:36:09 - [] ----D C:\ProgramData\Package Cache O43 - CFD: 21/10/2014 - 16:12:05 - [] ----D C:\ProgramData\Skype O43 - CFD: 14/07/2009 - 03:08:56 - [] -SH-D C:\ProgramData\Start Menu O43 - CFD: 05/11/2014 - 21:27:05 - [] ----D C:\ProgramData\Sun O43 - CFD: 14/07/2009 - 03:08:56 - [] -SH-D C:\ProgramData\Templates O43 - CFD: 05/11/2014 - 21:04:45 - [] ----D C:\ProgramData\Trusteer O43 - CFD: 16/11/2014 - 21:51:58 - [] ----D C:\ProgramData\VS Revo Group O43 - CFD: 16/05/2011 - 02:20:37 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories O43 - CFD: 14/07/2009 - 02:57:13 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools O43 - CFD: 21/11/2014 - 17:14:01 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG O43 - CFD: 30/11/2014 - 00:06:34 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firaxis Games O43 - CFD: 11/11/2014 - 22:37:16 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit PhantomPDF O43 - CFD: 16/05/2011 - 02:20:34 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games O43 - CFD: 16/11/2014 - 21:34:09 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java O43 - CFD: 14/07/2009 - 02:57:09 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance O43 - CFD: 21/10/2014 - 19:29:48 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware O43 - CFD: 29/11/2014 - 23:42:55 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office O43 - CFD: 16/05/2011 - 17:03:34 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nero 8 O43 - CFD: 13/11/2014 - 05:59:44 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Proteção de Terminal Trusteer O43 - CFD: 21/10/2014 - 20:48:48 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RaidCall O43 - CFD: 16/11/2014 - 21:51:58 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro O43 - CFD: 21/10/2014 - 16:12:03 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype O43 - CFD: 14/07/2009 - 02:54:24 - [] R---D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup O43 - CFD: 05/02/2011 - 12:41:21 - [0] R-H-D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tablet PC O43 - CFD: 16/05/2011 - 16:09:42 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XP Codec Pack 2.5.0 O43 - CFD: 02/12/2014 - 18:59:54 - [] ----D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP =>.Nicolas Coolman O43 - CFD: 22/10/2014 - 21:33:01 - [] ----D C:\Users\Usuario\AppData\Roaming\Adobe O43 - CFD: 21/10/2014 - 16:15:53 - [] ----D C:\Users\Usuario\AppData\Roaming\AVG2015 O43 - CFD: 23/11/2014 - 15:25:22 - [] ----D C:\Users\Usuario\AppData\Roaming\Baidu O43 - CFD: 30/11/2014 - 00:07:48 - [] ----D C:\Users\Usuario\AppData\Roaming\Firaxis Games O43 - CFD: 22/11/2014 - 18:36:11 - [] ----D C:\Users\Usuario\AppData\Roaming\Foxit Software O43 - CFD: 16/05/2011 - 15:55:38 - [] ----D C:\Users\Usuario\AppData\Roaming\Identities O43 - CFD: 30/11/2014 - 00:07:49 - [] ----D C:\Users\Usuario\AppData\Roaming\InstallShield Installation Information O43 - CFD: 05/02/2011 - 12:41:21 - [0] ----D C:\Users\Usuario\AppData\Roaming\Media Center Programs O43 - CFD: 01/12/2014 - 22:45:37 - [] -S--D C:\Users\Usuario\AppData\Roaming\Microsoft O43 - CFD: 21/10/2014 - 20:49:06 - [] ----D C:\Users\Usuario\AppData\Roaming\raidcall O43 - CFD: 23/10/2014 - 20:09:41 - [] ----D C:\Users\Usuario\AppData\Roaming\Skype O43 - CFD: 21/10/2014 - 16:15:09 - [] ----D C:\Users\Usuario\AppData\Roaming\TuneUp Software O43 - CFD: 21/10/2014 - 12:20:31 - [] ----D C:\Users\Usuario\AppData\Roaming\WinRAR O43 - CFD: 02/12/2014 - 19:03:04 - [] ----D C:\Users\Usuario\AppData\Roaming\ZHP =>.Nicolas Coolman O43 - CFD: 11/11/2014 - 22:42:48 - [] ----D C:\Users\Usuario\AppData\Local\Adobe O43 - CFD: 16/05/2011 - 17:03:36 - [] ----D C:\Users\Usuario\AppData\Local\Ahead O43 - CFD: 26/11/2014 - 21:10:51 - [] ----D C:\Users\Usuario\AppData\Local\Avg2015 O43 - CFD: 23/11/2014 - 16:04:56 - [] ----D C:\Users\Usuario\AppData\Local\BoBrowser =>PUP.BoBrowser O43 - CFD: 16/05/2011 - 15:55:25 - [] -SH-D C:\Users\Usuario\AppData\Local\Dados de aplicativos O43 - CFD: 26/11/2014 - 20:31:20 - [] ----D C:\Users\Usuario\AppData\Local\GAS Tecnologia O43 - CFD: 30/11/2014 - 12:46:43 - [] ----D C:\Users\Usuario\AppData\Local\Glyph O43 - CFD: 21/10/2014 - 19:31:17 - [] ----D C:\Users\Usuario\AppData\Local\Google O43 - CFD: 16/05/2011 - 15:55:25 - [] -SH-D C:\Users\Usuario\AppData\Local\Histórico O43 - CFD: 21/10/2014 - 16:12:09 - [] ----D C:\Users\Usuario\AppData\Local\MFAData O43 - CFD: 02/11/2014 - 20:33:57 - [] ----D C:\Users\Usuario\AppData\Local\Microsoft O43 - CFD: 12/11/2014 - 21:15:21 - [] ----D C:\Users\Usuario\AppData\Local\Microsoft Games O43 - CFD: 16/05/2011 - 17:04:30 - [0] ----D C:\Users\Usuario\AppData\Local\Microsoft Help O43 - CFD: 21/10/2014 - 19:29:26 - [] ----D C:\Users\Usuario\AppData\Local\Programs O43 - CFD: 21/10/2014 - 16:12:13 - [] ----D C:\Users\Usuario\AppData\Local\Skype O43 - CFD: 02/12/2014 - 19:02:22 - [] ----D C:\Users\Usuario\AppData\Local\Temp O43 - CFD: 16/05/2011 - 15:55:25 - [] -SH-D C:\Users\Usuario\AppData\Local\Temporary Internet Files O43 - CFD: 05/11/2014 - 21:11:53 - [] ----D C:\Users\Usuario\AppData\Local\Trusteer O43 - CFD: 16/05/2011 - 15:55:35 - [0] ----D C:\Users\Usuario\AppData\Local\VirtualStore O43 - CFD: 16/11/2014 - 21:52:02 - [] ----D C:\Users\Usuario\AppData\Local\VS Revo Group O43 - CFD: 14/07/2009 - 02:54:32 - [] R---D C:\Users\Usuario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories O43 - CFD: 16/05/2011 - 15:55:52 - [] R---D C:\Users\Usuario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools O43 - CFD: 30/11/2014 - 00:07:49 - [] ----D C:\Users\Usuario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games O43 - CFD: 16/05/2011 - 16:09:20 - [] ----D C:\Users\Usuario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome O43 - CFD: 01/12/2014 - 22:45:37 - [] ----D C:\Users\Usuario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis O43 - CFD: 14/07/2009 - 02:49:38 - [] R---D C:\Users\Usuario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance O43 - CFD: 21/10/2014 - 20:48:48 - [0] ----D C:\Users\Usuario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RaidCall O43 - CFD: 16/05/2011 - 15:55:52 - [] R---D C:\Users\Usuario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup O43 - CFD: 16/05/2011 - 16:09:41 - [] ----D C:\Users\Usuario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\XP Codec Pack 2.5.0 ~ Program Folder: 142 Scanned in 00mn 00s ---\\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044) O44 - LFC:[MD5.4653632BBF50E43F414D4F4A4EE0297B] - 02/12/2014 - 17:50:01 -S-A- . (...) -- C:\Windows\bootstat.dat [67584] O44 - LFC:[MD5.779E2374906F633E745A6CEB4EBB26C5] - 02/12/2014 - 17:50:09 ---A- . (...) -- C:\Windows\setupact.log [22662] O44 - LFC:[MD5.C2C6BD144B0E035ABE8F5A054A423854] - 02/12/2014 - 17:51:47 ---A- . (...) -- C:\Windows\WindowsUpdate.log [310744] O44 - LFC:[MD5.BE39FF18559C39D857A499C53D6FC4F7] - 02/12/2014 - 17:55:59 ---A- . (...) -- C:\Windows\System32\PerfStringBackup.INI [1499760] O44 - LFC:[MD5.F664BE735F399525FA39BAF11AC89DAC] - 02/12/2014 - 17:55:59 ---A- . (...) -- C:\Windows\System32\perfc009.dat [104214] O44 - LFC:[MD5.A2772D6E7CF09C420127406DEAE2DC43] - 02/12/2014 - 17:55:59 ---A- . (...) -- C:\Windows\System32\perfh009.dat [609896] O44 - LFC:[MD5.37732458D32296A796BEB26AAB636A24] - 02/12/2014 - 17:55:59 ---A- . (...) -- C:\Windows\System32\prfc0416.dat [125568] O44 - LFC:[MD5.65586B16ABDD0408C34CADD3159210AB] - 02/12/2014 - 17:55:59 ---A- . (...) -- C:\Windows\System32\prfh0416.dat [657176] O44 - LFC:[MD5.26C43960C99EE861A5D0EDC4DCF3B1C3] - 02/12/2014 - 17:56:28 ---A- . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Windows\System32\Drivers\MBAMSwissArmy.sys [129752] O44 - LFC:[MD5.5136C23598002F53C82AB47723378422] - 02/12/2014 - 17:59:03 ---A- . (.Nicolas Coolman - ZHPDiag Setup.) -- C:\ZHPDiag2.exe [6866303] O44 - LFC:[MD5.9BBA36FB28427D0AB8AEF916C791BB43] - 02/12/2014 - 18:01:11 ---A- . (...) -- C:\PhysicalDisk0_MBR.bin [512] O44 - LFC:[MD5.44F5C5E27D6825E4E62420BC29B8B533] - 23/11/2014 - 13:51:44 ---A- . (.Microsoft Corporation - No Comment.) -- C:\Windows\System32\d3dx9_26.dll [3767504] O44 - LFC:[MD5.701E1FED91369518F298AA092439ABC1] - 23/11/2014 - 13:52:24 ---A- . (...) -- C:\Windows\DirectX.log [42538] O44 - LFC:[MD5.F9F76890946E34C17D8378D792CF36F9] - 23/11/2014 - 14:06:36 ---A- . (.NetFilterSDK.com - NetFilter SDK TDI Hook Driver (WPP).) -- C:\Windows\System32\Drivers\pofilterdrv.sys [60736] O44 - LFC:[MD5.5809FE2F8DE47561830918496575B45A] - 23/11/2014 - 14:07:08 ---A- . (.NetFilterSDK.com - NetFilter SDK TDI Hook Driver (WPP).) -- C:\Windows\System32\Drivers\mosfilterdrv.sys [60728] O44 - LFC:[MD5.22DAE5ECBE01B270711ED9A39B98ED02] - 25/11/2014 - 20:44:18 ---A- . (...) -- C:\Windows\PFRO.log [9612] O44 - LFC:[MD5.09D1C065C13EB084F4119AF3DCECD1E6] - 26/11/2014 - 20:41:26 ---A- . (...) -- C:\Windows\ntbtlog.txt [807174] ~ Files: 17 Scanned in 00mn 01s ---\\ Negação do serviço (Local Security Authority) (048) O48 - LSA:Local Security Authority Authentication Packages . (.Microsoft Corporation - Microsoft Authentication Package v1.0.) -- C:\Windows\System32\msv1_0.dll O48 - LSA:Local Security Authority Notification Packages . (.Microsoft Corporation - Mecanismo cliente do 'Editor de configuração de segurança Windows'.) -- C:\Windows\System32\scecli.dll O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Pacote de Segurança Kerberos.) -- C:\Windows\System32\kerberos.dll O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Microsoft Authentication Package v1.0.) -- C:\Windows\System32\msv1_0.dll O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - TLS / SSL Security Provider.) -- C:\Windows\System32\schannel.dll O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Microsoft Digest Access.) -- C:\Windows\System32\wdigest.dll O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Web Service Security Package.) -- C:\Windows\System32\tspkg.dll O48 - LSA:Local Security Authority Security Packages . (.Microsoft Corporation - Pku2u Security Package.) -- C:\Windows\System32\pku2u.dll ~ LSA: 8 Scanned in 00mn 00s ---\\ Controlo do Modo de Segurança (CSB) (49) O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\sermouse.sys . (.Microsoft Corporation - Driver de porta de mouse serial.) -- C:\Windows\System32\Drivers\sermouse.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vga.sys . (.Microsoft Corporation - VGA/Super VGA Video Driver.) -- C:\Windows\System32\Drivers\vga.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\vgasave.sys . (...) -- C:\Windows\System32\Drivers\vgasave.sys (.not file.) O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\volmgr.sys . (.Microsoft Corporation - Volume Manager Driver.) -- C:\Windows\System32\Drivers\volmgr.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Minimal\volmgrx.sys . (.Microsoft Corporation - Driver de Extensão do Gerenciador de Volumes.) -- C:\Windows\System32\Drivers\volmgrx.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\ipnat.sys . (.Microsoft Corporation - IP Network Address Translator.) -- C:\Windows\System32\Drivers\ipnat.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\nsiproxy.sys . (.Microsoft Corporation - NSI Proxy.) -- C:\Windows\System32\Drivers\nsiproxy.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\rdpencdd.sys . (.Microsoft Corporation - RDP Encoder Miniport.) -- C:\Windows\System32\Drivers\rdpencdd.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\sermouse.sys . (.Microsoft Corporation - Driver de porta de mouse serial.) -- C:\Windows\System32\Drivers\sermouse.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vga.sys . (.Microsoft Corporation - VGA/Super VGA Video Driver.) -- C:\Windows\System32\Drivers\vga.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\vgasave.sys . (...) -- C:\Windows\System32\Drivers\vgasave.sys (.not file.) O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\volmgr.sys . (.Microsoft Corporation - Volume Manager Driver.) -- C:\Windows\System32\Drivers\volmgr.sys O49 - CSB:Control Safe Boot HKLM\...\CCS\Network\volmgrx.sys . (.Microsoft Corporation - Driver de Extensão do Gerenciador de Volumes.) -- C:\Windows\System32\Drivers\volmgrx.sys ~ CSB: 13 Scanned in 00mn 00s ---\\ Pesquisa de infeções nos drivers (HKLM)(TDSD) (O52) O52 - TDSD: \Drivers32\"msacm.l3acm"="C:\Windows\System32\l3codeca.acm" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm O52 - TDSD: \drivers.desc\"C:\Windows\System32\l3codeca.acm"="Fraunhofer IIS MPEG Layer-3 Codec" . (.Fraunhofer Institut Integrierte Schaltungen - MPEG Layer-3 Audio Codec for MSACM.) -- C:\Windows\System32\l3codeca.acm ~ TDSD: 2 Scanned in 00mn 00s ---\\ Enumeração das chaves do registo SecurityProviders (MCSP) (O54) O54 - MCSP:[HKLM\...\CurrentControlSet\Control] - (SecurityProviders) - (.Microsoft Corporation - Credential Delegation Security Package.) -- C:\Windows\System32\credssp.dll O54 - MCSP:[HKLM\...\ControlSet001\Control] - (SecurityProviders) - (.Microsoft Corporation - Credential Delegation Security Package.) -- C:\Windows\System32\credssp.dll ~ MSCP: 2 Scanned in 00mn 00s ---\\ Enumeração das chaves do registo PoliciesSystem (MWPS) (O55) O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorAdmin"=0 O55 - MWPS:[HKLM\...\Policies\System] - "ConsentPromptBehaviorUser"=3 O55 - MWPS:[HKLM\...\Policies\System] - "EnableInstallerDetection"=1 O55 - MWPS:[HKLM\...\Policies\System] - "EnableLUA"=0 O55 - MWPS:[HKLM\...\Policies\System] - "EnableSecureUIAPaths"=1 O55 - MWPS:[HKLM\...\Policies\System] - "EnableUIADesktopToggle"=0 O55 - MWPS:[HKLM\...\Policies\System] - "EnableVirtualization"=1 O55 - MWPS:[HKLM\...\Policies\System] - "PromptOnSecureDesktop"=0 O55 - MWPS:[HKLM\...\Policies\System] - "ValidateAdminCodeSignatures"=0 O55 - MWPS:[HKLM\...\Policies\System] - "dontdisplaylastusername"=0 O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticecaption"=0 O55 - MWPS:[HKLM\...\Policies\System] - "legalnoticetext"=0 O55 - MWPS:[HKLM\...\Policies\System] - "scforceoption"=0 O55 - MWPS:[HKLM\...\Policies\System] - "shutdownwithoutlogon"=1 O55 - MWPS:[HKLM\...\Policies\System] - "undockwithoutlogon"=1 O55 - MWPS:[HKLM\...\Policies\System] - "FilterAdministratorToken"=0 ~ MWPS: 16 Scanned in 00mn 00s ---\\ Enumeração das chaves do registo PoliciesExplorer (MWPE) (O56) O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktop"=1 O56 - MWPE:[HKLM\...\policies\Explorer] - "NoActiveDesktopChanges"=1 O56 - MWPE:[HKLM\...\policies\Explorer] - "ForceActiveDesktopOn"=0 ~ MWPE Keys: 3 Scanned in 00mn 00s ---\\ Lista dos drivers do sistema (SDL) (O58) O58 - SDL:13/07/2009 - 22:52:21 ---A- . (.Adaptec, Inc. - Adaptec Windows SAS/SATA Storport Driver.) -- C:\Windows\System32\Drivers\adp94xx.sys [491088] O58 - SDL:13/07/2009 - 22:52:21 ---A- . (.Adaptec, Inc. - Adaptec Windows SATA Storport Driver.) -- C:\Windows\System32\Drivers\adpahci.sys [339536] O58 - SDL:13/07/2009 - 22:52:21 ---A- . (.Adaptec, Inc. - Adaptec StorPort Ultra320 SCSI Driver (X64).) -- C:\Windows\System32\Drivers\adpu320.sys [182864] O58 - SDL:13/07/2009 - 22:52:21 ---A- . (.Acer Laboratories Inc. - ALi mini IDE Driver.) -- C:\Windows\System32\Drivers\aliide.sys [15440] O58 - SDL:20/11/2010 - 04:32:48 ---A- . (.Advanced Micro Devices - AHCI 1.2 Device Driver.) -- C:\Windows\System32\Drivers\amdsata.sys [107904] O58 - SDL:13/07/2009 - 22:52:20 ---A- . (.AMD Technologies Inc. - AMD Technology AHCI Compatible Controller Driver for Windows -.) -- C:\Windows\System32\Drivers\amdsbs.sys [194128] O58 - SDL:20/11/2010 - 04:32:48 ---A- . (.Advanced Micro Devices - Storage Filter Driver.) -- C:\Windows\System32\Drivers\amdxata.sys [27008] O58 - SDL:13/07/2009 - 22:52:21 ---A- . (.Adaptec, Inc. - Adaptec RAID Storport Driver.) -- C:\Windows\System32\Drivers\arc.sys [87632] O58 - SDL:13/07/2009 - 22:52:21 ---A- . (.Adaptec, Inc. - Adaptec SAS RAID WS03 Driver.) -- C:\Windows\System32\Drivers\arcsas.sys [97856] O58 - SDL:18/06/2014 - 20:03:34 ---A- . (.AVG Technologies CZ, s.r.o. - AVG File Vault Driver.) -- C:\Windows\System32\Drivers\avgdiska.sys [153368] O58 - SDL:29/10/2014 - 20:35:16 ---A- . (.AVG Technologies CZ, s.r.o. - AVG IDS Application Activity Monitor Driver..) -- C:\Windows\System32\Drivers\avgidsdrivera.sys [263960] O58 - SDL:18/06/2014 - 20:03:34 ---A- . (.AVG Technologies CZ, s.r.o. - AVG Application Activity Monitor Helper Driver.) -- C:\Windows\System32\Drivers\avgidsha.sys [190744] O58 - SDL:28/08/2014 - 19:47:24 ---A- . (.AVG Technologies CZ, s.r.o. - AVG AVI Loader Driver.) -- C:\Windows\System32\Drivers\avgldx64.sys [243480] O58 - SDL:18/07/2014 - 14:53:26 ---A- . (.AVG Technologies CZ, s.r.o. - AVG Logging Driver.) -- C:\Windows\System32\Drivers\avgloga.sys [313624] O58 - SDL:05/10/2014 - 19:41:40 ---A- . (.AVG Technologies CZ, s.r.o. - AVG Resident Shield Minifilter Driver.) -- C:\Windows\System32\Drivers\avgmfx64.sys [124184] O58 - SDL:18/06/2014 - 20:03:20 ---A- . (.AVG Technologies CZ, s.r.o. - AVG Anti-Rootkit Driver.) -- C:\Windows\System32\Drivers\avgrkx64.sys [31512] O58 - SDL:10/10/2014 - 13:14:32 ---A- . (.AVG Technologies CZ, s.r.o. - AVG Network connection watcher.) -- C:\Windows\System32\Drivers\avgtdia.sys [274200] O58 - SDL:10/06/2009 - 17:34:23 ---A- . (.Broadcom Corporation - Broadcom NetXtreme Gigabit Ethernet NDIS6.x Unified Driver..) -- C:\Windows\System32\Drivers\b57nd60a.sys [270848] O58 - SDL:10/06/2009 - 17:41:06 ---A- . (.Brother Industries, Ltd. - Windows ME USB Mass-Storage Bulk-Only Lower Filter Driver.) -- C:\Windows\System32\Drivers\BrFiltLo.sys [18432] O58 - SDL:10/06/2009 - 17:41:06 ---A- . (.Brother Industries, Ltd. - Windows ME USB Mass-Storage Bulk-Only Upper Filter Driver.) -- C:\Windows\System32\Drivers\BrFiltUp.sys [8704] O58 - SDL:13/07/2009 - 22:19:07 ---A- . (.Brother Industries Ltd. - Brother Serial I/F Driver (WDM).) -- C:\Windows\System32\Drivers\BrSerId.sys [286720] O58 - SDL:10/06/2009 - 17:41:10 ---A- . (.Brother Industries Ltd. - Brother Serial driver (WDM version).) -- C:\Windows\System32\Drivers\BrSerWdm.sys [47104] O58 - SDL:10/06/2009 - 17:41:10 ---A- . (.Brother Industries Ltd. - Brother USB MDM Driver.) -- C:\Windows\System32\Drivers\BrUsbMdm.sys [14976] O58 - SDL:10/06/2009 - 17:41:10 ---A- . (.Brother Industries Ltd. - Brother USB Serial Driver.) -- C:\Windows\System32\Drivers\BrUsbSer.sys [14720] O58 - SDL:10/06/2009 - 17:34:28 ---A- . (.Broadcom Corporation - Broadcom NetXtreme II GigE VBD.) -- C:\Windows\System32\Drivers\bxvbda.sys [468480] O58 - SDL:13/07/2009 - 22:52:31 ---A- . (.CMD Technology, Inc. - CMD PCI IDE Bus Driver.) -- C:\Windows\System32\Drivers\cmdide.sys [17488] O58 - SDL:10/06/2009 - 17:35:09 ---A- . (.Intel Corporation - Intel® PRO/1000 Adapter NDIS 6 deserialized driver.) -- C:\Windows\System32\Drivers\E1G6032E.sys [145792] O58 - SDL:13/07/2009 - 22:47:48 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys [530496] O58 - SDL:10/06/2009 - 17:34:33 ---A- . (.Broadcom Corporation - Broadcom NetXtreme II 10 GigE VBD.) -- C:\Windows\System32\Drivers\evbda.sys [3286016] O58 - SDL:10/06/2009 - 17:31:59 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys [31232] O58 - SDL:20/11/2010 - 04:33:36 ---A- . (.Hewlett-Packard Company - Smart Array SAS/SATA Controller Media Driver.) -- C:\Windows\System32\Drivers\HpSAMD.sys [78720] O58 - SDL:20/11/2010 - 04:33:40 ---A- . (.Intel Corporation - Intel Matrix Storage Manager driver - x64.) -- C:\Windows\System32\Drivers\iaStorV.sys [410496] O58 - SDL:27/01/2011 - 07:57:12 ---A- . (.Intel Corporation - Intel Graphics Kernel Mode Driver.) -- C:\Windows\System32\Drivers\igdkmd64.sys [12273408] O58 - SDL:13/07/2009 - 22:48:04 ---A- . (.Intel Corp./ICP vortex GmbH - Intel/ICP Raid Storport Driver.) -- C:\Windows\System32\Drivers\iirsp.sys [44112] O58 - SDL:15/10/2010 - 00:28:16 ---A- . (.Intel® Corporation - Intel® Display Audio Driver.) -- C:\Windows\System32\Drivers\IntcDAud.sys [317440] O58 - SDL:11/08/2011 - 14:54:16 ---A- . (.Atheros Communications, Inc. - Atheros Ar81xx series PCI-E Gigabit Ethernet Controller.) -- C:\Windows\System32\Drivers\L1C62x64.sys [104560] O58 - SDL:13/07/2009 - 22:48:04 ---A- . (.LSI Corporation - LSI Fusion-MPT FC Driver (StorPort).) -- C:\Windows\System32\Drivers\lsi_fc.sys [114752] O58 - SDL:13/07/2009 - 22:48:04 ---A- . (.LSI Corporation - LSI Fusion-MPT SAS Driver (StorPort).) -- C:\Windows\System32\Drivers\lsi_sas.sys [106560] O58 - SDL:13/07/2009 - 22:48:04 ---A- . (.LSI Corporation - LSI SAS Gen2 Driver (StorPort).) -- C:\Windows\System32\Drivers\lsi_sas2.sys [65600] O58 - SDL:13/07/2009 - 22:48:04 ---A- . (.LSI Corporation - LSI Fusion-MPT SCSI Driver (StorPort).) -- C:\Windows\System32\Drivers\lsi_scsi.sys [115776] O58 - SDL:01/10/2014 - 10:11:12 ---A- . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Windows\System32\Drivers\mbam.sys [25816] O58 - SDL:01/10/2014 - 10:11:16 ---A- . (.Malwarebytes Corporation - Malwarebytes Chameleon Protection Driver.) -- C:\Windows\System32\Drivers\mbamchameleon.sys [93400] O58 - SDL:02/12/2014 - 17:56:28 ---A- . (.Malwarebytes Corporation - Malwarebytes Anti-Malware.) -- C:\Windows\System32\Drivers\MBAMSwissArmy.sys [129752] O58 - SDL:13/07/2009 - 22:48:04 ---A- . (.LSI Corporation - MEGASAS RAID Controller Driver for Windows 7\Server 2008 R2 for.) -- C:\Windows\System32\Drivers\megasas.sys [35392] O58 - SDL:13/07/2009 - 22:48:04 ---A- . (.LSI Corporation, Inc. - LSI MegaRAID Software RAID Driver.) -- C:\Windows\System32\Drivers\MegaSR.sys [284736] O58 - SDL:21/10/2014 - 23:54:24 ---A- . (.NetFilterSDK.com - NetFilter SDK TDI Hook Driver (WPP).) -- C:\Windows\System32\Drivers\mosfilterdrv.sys [60728] O58 - SDL:01/10/2014 - 10:11:26 ---A- . (.Malwarebytes Corporation - Malwarebytes Web Access Control.) -- C:\Windows\System32\Drivers\mwac.sys [63704] O58 - SDL:13/07/2009 - 22:48:26 ---A- . (.IBM Corporation - IBM ServeRAID Controller Driver.) -- C:\Windows\System32\Drivers\nfrd960.sys [51264] O58 - SDL:20/11/2010 - 04:33:50 ---A- . (.NVIDIA Corporation - NVIDIA® nForce RAID Driver.) -- C:\Windows\System32\Drivers\nvraid.sys [148352] O58 - SDL:20/11/2010 - 04:33:50 ---A- . (.NVIDIA Corporation - NVIDIA® nForce Sata Performance Driver.) -- C:\Windows\System32\Drivers\nvstor.sys [166272] O58 - SDL:29/08/2014 - 10:13:06 ---A- . (.NetFilterSDK.com - NetFilter SDK TDI Hook Driver (WPP).) -- C:\Windows\System32\Drivers\pofilterdrv.sys [60736] O58 - SDL:13/07/2009 - 22:45:46 ---A- . (.QLogic Corporation - QLogic Fibre Channel Stor Miniport Driver.) -- C:\Windows\System32\Drivers\ql2300.sys [1524816] O58 - SDL:13/07/2009 - 22:45:45 ---A- . (.QLogic Corporation - QLogic iSCSI Storport Miniport Driver.) -- C:\Windows\System32\Drivers\ql40xx.sys [128592] O58 - SDL:29/10/2014 - 18:25:32 ---A- . (.IBM Corp. - RapportKE.) -- C:\Windows\System32\Drivers\RapportKE64.sys [534104] O58 - SDL:30/12/2009 - 10:21:26 ---A- . (.VS Revo Group - Revo Uninstaller Minifilter.) -- C:\Windows\System32\Drivers\revoflt.sys [31800] O58 - SDL:10/06/2009 - 17:37:19 ---A- . (.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) -- C:\Windows\System32\Drivers\secdrv.sys [23040] O58 - SDL:13/07/2009 - 21:00:40 ---A- . (.Brother Industries Ltd. - Brother Serial I/F Driver (WDM).) -- C:\Windows\System32\Drivers\serial.sys [94208] O58 - SDL:13/07/2009 - 22:45:45 ---A- . (.Silicon Integrated Systems Corp. - SiS RAID Stor Miniport Driver.) -- C:\Windows\System32\Drivers\sisraid2.sys [43584] O58 - SDL:13/07/2009 - 22:45:46 ---A- . (.Silicon Integrated Systems - SiS AHCI Stor-Miniport Driver.) -- C:\Windows\System32\Drivers\sisraid4.sys [80464] O58 - SDL:13/07/2009 - 22:45:55 ---A- . (.Promise Technology - Promise SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys [24656] O58 - SDL:14/12/2010 - 15:34:16 ---A- . (.VIA Technologies, Inc. - VIA High Definition Audio Function Driver.) -- C:\Windows\System32\Drivers\viahduaa.sys [1357424] O58 - SDL:13/07/2009 - 22:45:55 ---A- . (.VIA Technologies, Inc. - VIA Generic PCI IDE Bus Driver.) -- C:\Windows\System32\Drivers\viaide.sys [17488] O58 - SDL:13/07/2009 - 22:45:55 ---A- . (.VIA Technologies Inc.,Ltd - VIA RAID DRIVER FOR AMD-X86-64.) -- C:\Windows\System32\Drivers\vsmraid.sys [161872] ~ Drivers: 63 Scanned in 00mn 00s ---\\ Últimos ficheiros alterados ou criados (Utilizador) (061) O61 - LFC: 01/12/2014 - 19:03:11 R--A- . (.Trend Micro Inc..) -- C:\Users\Usuario\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe [388096] O61 - LFC: 02/12/2014 - 19:03:11 ---A- . (.Nicolas Coolman.) -- C:\Users\Usuario\Downloads\ZHPDiag2.exe [6866303] =>.Nicolas Coolman O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (...) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\PepperFlash\pepflashplayer.dll [14910280] O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (...) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\ffmpegsumo.dll [1677128] O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (...) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\libegl.dll [211272] O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (...) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\libexif.dll [310088] O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (...) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\libglesv2.dll [1077064] O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (...) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\pdf.dll [9009480] O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (...) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\widevinecdmadapter.dll [146760] O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (...) -- C:\Users\Usuario\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.6.703\_platform_specific\win_x86\widevinecdmadapter.dll [146760] O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (...) -- C:\Users\Usuario\AppData\Local\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\39.0.2171.71\39.0.2171.71_39.0.2171.65_chrome_updater.exe [1117264] O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (.Google Inc..) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\Installer\setup.exe [1087304] O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (.Google Inc..) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\chrome.dll [32211272] O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (.Google Inc..) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\chrome_child.dll [33988936] O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (.Google Inc..) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\chrome_elf.dll [133960] O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (.Google Inc..) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\delegate_execute.exe [2057544] O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (.Google Inc..) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\libpeerconnection.dll [2472776] O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (.Google Inc..) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\metro_driver.dll [510792] O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (.Google Inc..) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\nacl64.exe [1949000] O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (.Google Inc..) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\chrome.exe [856904] O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (.Microsoft Corporation.) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\d3dcompiler_46.dll [3231832] O61 - LFC: 25/11/2014 - 19:03:11 ---A- . (.Microsoft Corporation.) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\xinput1_3.dll [81768] O61 - LFC: 26/11/2014 - 19:03:11 ---A- . (...) -- C:\Users\Usuario\AppData\Roaming\unins000.exe [730322] O61 - LFC: 26/11/2014 - 19:03:11 ---A- . (.CAIXA.) -- C:\Users\Usuario\Documents\iGBPCEFgb.exe [2514272] O61 - LFC: 26/11/2014 - 19:03:11 ---A- . (.CAIXA.) -- C:\Users\Usuario\Downloads\iGBPCEFsf.exe [2514272] ~ 2057 Fichiers temporaires (Temporary files) ~ 3 Fichiers cookies (Cookies files) ~ Files: 25 Scanned in 00mn 00s ---\\ Lista das ferramentas de remoção de vírus (LAT) (063) O63 - Logiciel: ZHPDiag 2014 - (.Nicolas Coolman.) [HKLM] -- ZHPDiag_is1 =>.Nicolas Coolman O63 - Logiciel: HiJackThis - (.Trend Micro.) [HKLM] -- {45A66726-69BC-466B-A7A4-12FCBA4883D7} ~ ADS: Scanned in 00mn 00s ---\\ Lista dos serviços Legacy du registo (064) O64 - Services: CurCS - 18/06/2014 - C:\Windows\System32\DRIVERS\avgdiska.sys (Avgdiska) .(.AVG Technologies CZ, s.r.o. - AVG File Vault Driver.) - LEGACY_AVGDISKA O64 - Services: CurCS - 29/10/2014 - C:\Windows\System32\DRIVERS\avgidsdrivera.sys (AVGIDSDriver) .(.AVG Technologies CZ, s.r.o. - AVG IDS Application Activity Monitor Driver.) - LEGACY_AVGIDSDRIVER O64 - Services: CurCS - 18/06/2014 - C:\Windows\System32\DRIVERS\avgidsha.sys (AVGIDSHA) .(.AVG Technologies CZ, s.r.o. - AVG Application Activity Monitor Helper Dri.) - LEGACY_AVGIDSHA O64 - Services: CurCS - 28/08/2014 - C:\Windows\System32\DRIVERS\avgldx64.sys (Avgldx64) .(.AVG Technologies CZ, s.r.o. - AVG AVI Loader Driver.) - LEGACY_AVGLDX64 O64 - Services: CurCS - 18/07/2014 - C:\Windows\System32\DRIVERS\avgloga.sys (Avgloga) .(.AVG Technologies CZ, s.r.o. - AVG Logging Driver.) - LEGACY_AVGLOGA O64 - Services: CurCS - 05/10/2014 - C:\Windows\System32\DRIVERS\avgmfx64.sys (Avgmfx64) .(.AVG Technologies CZ, s.r.o. - AVG Resident Shield Minifilter Driver.) - LEGACY_AVGMFX64 O64 - Services: CurCS - 18/06/2014 - C:\Windows\System32\DRIVERS\avgrkx64.sys (Avgrkx64) .(.AVG Technologies CZ, s.r.o. - AVG Anti-Rootkit Driver.) - LEGACY_AVGRKX64 O64 - Services: CurCS - 10/10/2014 - C:\Windows\System32\DRIVERS\avgtdia.sys (Avgtdia) .(.AVG Technologies CZ, s.r.o. - AVG Network connection watcher.) - LEGACY_AVGTDIA O64 - Services: CurCS - 21/10/2014 - C:\Windows\System32\drivers\mosfilterdrv.sys (mosfilterdrv) .(.NetFilterSDK.com - NetFilter SDK TDI Hook Driver (WPP).) - LEGACY_MOSFILTERDRV O64 - Services: CurCS - 29/08/2014 - C:\Windows\System32\drivers\pofilterdrv.sys (pofilterdrv) .(.NetFilterSDK.com - NetFilter SDK TDI Hook Driver (WPP).) - LEGACY_POFILTERDRV O64 - Services: CurCS - 13/11/2014 - C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_80071.sys (RapportCerberus_80071) .(...) - LEGACY_RAPPORTCERBERUS_80071 =>.Cerberus O64 - Services: CurCS - 29/10/2014 - C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys (RapportEI64) .(.IBM Corp. - RapportEI64.) - LEGACY_RAPPORTEI64 O64 - Services: CurCS - 29/10/2014 - C:\Windows\System32\Drivers\RapportKE64.sys (RapportKE64) .(.IBM Corp. - RapportKE.) - LEGACY_RAPPORTKE64 O64 - Services: CurCS - 29/10/2014 - C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys (RapportPG64) .(.IBM Corp. - RapportPG64.) - LEGACY_RAPPORTPG64 O64 - Services: CurCS - 10/06/2009 - C:\Windows\System32\Drivers\secdrv.sys (secdrv) .(.Macrovision Corporation, Macrovision Europe - Macrovision SECURITY Driver.) - LEGACY_SECDRV O64 - Services: CurCS - 02/09/2014 - C:\Program Files (x86)\GbPlugin\wsftprp64.sys (Warsaw_PP) .(.GAS Tecnologia LTDA - GAS Tecnologia - Driver (PP).) - LEGACY_WARSAW_PP ~ Legacy: 84 Scanned in 00mn 00s ---\\ Associações Shell Spawning (O67) O67 - Shell Spawning: <.bat> <batfile>[HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.cpl> <cplfile>[HKLM\..\cplopen\Command] (.Microsoft Corporation - Windows Control Panel.) -- C:\Windows\System32\control.exe =>.Microsoft Corporation O67 - Shell Spawning: <.cmd> <cmdfile>[HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.com> <comfile>[HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.evt> <evtfile>[HKLM\..\open\Command] (.Microsoft Corporation - Iniciador do snap-in de 'Visualizar eventos'.) -- C:\Windows\System32\eventvwr.exe O67 - Shell Spawning: <.exe> <exefile>[HKLM\..\open\Command] (...) -- "%1" %* O67 - Shell Spawning: <.html> <htmlfile>[HKLM\..\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe O67 - Shell Spawning: <.js> <JSFile>[HKLM\..\open\Command] (.Microsoft Corporation - Microsoft ® Windows Based Script Host.) -- C:\Windows\System32\WScript.exe O67 - Shell Spawning: <.reg> <regfile>[HKLM\..\open\Command] (.Microsoft Corporation - Editor do Registro.) -- C:\Windows\regedit.exe O67 - Shell Spawning: <.scr> <scrfile>[HKLM\..\open\Command] (...) -- "%1" /S O67 - Shell Spawning: <.html> <ChromeHTML.CVYVKAYLBDTTKTZQRDBZE2T564>[HKCU\..\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\chrome.exe ~ FASS Keys: 11 Scanned in 00mn 00s ---\\ Menu de inicialização Internet (068) O68 - StartMenuInternet: <Google Chrome.CVYVKAYLBDTTKTZQRDBZE2T564> <Google Chrome>[HKLM\..\Shell\open\Command] (.Google Inc. - Google Chrome.) -- C:\Users\Usuario\AppData\Local\Google\Chrome\Application\chrome.exe O68 - StartMenuInternet: <IEXPLORE.EXE> <Internet Explorer>[HKLM\..\Shell\open\Command] (.Microsoft Corporation - Internet Explorer.) -- C:\Program Files (x86)\Internet Explorer\iexplore.exe ~ Keys: Scanned in 00mn 00s ---\\ Pesquisa de infeção nos navegadores da Internet (SBI) (069) O69 - SBI: SearchScopes [HKCU] {0633EE93-D776-472f-A0FF-E1416B8B2E3A} - (Bing) - http://www.bing.com O69 - SBI: SearchScopes [HKCU] {84B1A9CC-778C-4330-9528-A09FE7B4D337} [DefaultScope] - (Google) - http://www.google.com ~ Keys: Scanned in 00mn 00s ---\\ Listagem dos serviços iniciados pelo Svchost (SSS) (O83) O83 - Search Svchost Services: AeLookupSvc (AeLookupSvc) . (.Microsoft Corporation - Serviço de Experiência com Aplicativo.) -- C:\Windows\System32\aelupsvc.dll [72192] O83 - Search Svchost Services: CertPropSvc (CertPropSvc) . (.Microsoft Corporation - Serviço de Propagação de Certificado de Cartão Inteligente da Microsof.) -- C:\Windows\System32\certprop.dll [80384] O83 - Search Svchost Services: SCPolicySvc (SCPolicySvc) . (.Microsoft Corporation - Serviço de Propagação de Certificado de Cartão Inteligente da Microsof.) -- C:\Windows\System32\certprop.dll [80384] O83 - Search Svchost Services: lanmanserver (lanmanserver) . (.Microsoft Corporation - DLL de Serviço do Servidor.) -- C:\Windows\System32\srvsvc.dll [236032] O83 - Search Svchost Services: gpsvc (gpsvc) . (.Microsoft Corporation - Cliente da Diretiva de Grupo.) -- C:\Windows\System32\gpsvc.dll [777728] O83 - Search Svchost Services: IKEEXT (IKEEXT) . (.Microsoft Corporation - Extensão IKE.) -- C:\Windows\System32\ikeext.dll [853504] O83 - Search Svchost Services: AudioSrv (AudioSrv) . (.Microsoft Corporation - Serviço de Áudio do Windows.) -- C:\Windows\System32\Audiosrv.dll [679424] O83 - Search Svchost Services: Rasauto (Rasauto) . (.Microsoft Corporation - Gerenciador de Discagem Automática de Acesso Remoto.) -- C:\Windows\System32\rasauto.dll [99328] O83 - Search Svchost Services: Rasman (Rasman) . (.Microsoft Corporation - Gerenciador de conexão de acesso remoto.) -- C:\Windows\System32\rasmans.dll [344064] O83 - Search Svchost Services: Remoteaccess (Remoteaccess) . (.Microsoft Corporation - Gerenciador de Interface Dinâmica.) -- C:\Windows\System32\mprdim.dll [97792] O83 - Search Svchost Services: SENS (SENS) . (.Microsoft Corporation - Serviço de Notificação de Eventos do Sistema (SENS).) -- C:\Windows\System32\sens.dll [64512] O83 - Search Svchost Services: Sharedaccess (Sharedaccess) . (.Microsoft Corporation - Componentes do Microsoft NAT Helper.) -- C:\Windows\System32\ipnathlp.dll [359424] O83 - Search Svchost Services: Tapisrv (Tapisrv) . (.Microsoft Corporation - Servidor de telefonia do Microsoft® Windows.) -- C:\Windows\System32\tapisrv.dll [316928] O83 - Search Svchost Services: TermService (TermService) . (.Microsoft Corporation - Gerenciador de Conexões Remotas do Servidor Host da Sessão da Área de.) -- C:\Windows\System32\termsrv.dll [680960] O83 - Search Svchost Services: wuauserv (wuauserv) . (.Microsoft Corporation - Windows Update Agent.) -- C:\Windows\System32\wuaueng.dll [2420736] O83 - Search Svchost Services: BITS (BITS) . (.Microsoft Corporation - Serviço de transferência inteligente de plano de fundo.) -- C:\Windows\System32\qmgr.dll [849920] O83 - Search Svchost Services: ShellHWDetection (ShellHWDetection) . (.Microsoft Corporation - DLL de serviços do Shell do Windows.) -- C:\Windows\System32\shsvcs.dll [370688] O83 - Search Svchost Services: iphlpsvc (iphlpsvc) . (.Microsoft Corporation - Serviço que oferece conectividade IPv6 em uma rede IPv4..) -- C:\Windows\System32\iphlpsvc.dll [569344] O83 - Search Svchost Services: seclogon (seclogon) . (.Microsoft Corporation - DLL de serviço de logon secundário.) -- C:\Windows\system32\seclogon.dll [30720] O83 - Search Svchost Services: AppInfo (AppInfo) . (.Microsoft Corporation - Serviço de Informações de Aplicativos.) -- C:\Windows\System32\appinfo.dll [70656] O83 - Search Svchost Services: msiscsi (msiscsi) . (.Microsoft Corporation - Serviço de Descoberta iSCSI.) -- C:\Windows\System32\iscsiexe.dll [156672] O83 - Search Svchost Services: MMCSS (MMCSS) . (.Microsoft Corporation - Serviço Agendador de Classes de Multimídia.) -- C:\Windows\System32\mmcss.dll [67584] O83 - Search Svchost Services: winmgmt (winmgmt) . (.Microsoft Corporation - WMI.) -- C:\Windows\System32\wbem\WMIsvc.dll [242688] O83 - Search Svchost Services: SessionEnv (SessionEnv) . (.Microsoft Corporation - Serviço de Configuração da Área de Trabalho Remota.) -- C:\Windows\System32\sessenv.dll [121856] O83 - Search Svchost Services: browser (browser) . (.Microsoft Corporation - DLL de Serviço Pesquisador de Computadores.) -- C:\Windows\System32\browser.dll [136192] O83 - Search Svchost Services: EapHost (EapHost) . (.Microsoft Corporation - Serviço Microsoft EAPHost.) -- C:\Windows\System32\eapsvc.dll [111104] O83 - Search Svchost Services: schedule (schedule) . (.Microsoft Corporation - Serviço Agendador de Tarefas.) -- C:\Windows\System32\schedsvc.dll [1110016] O83 - Search Svchost Services: hkmsvc (hkmsvc) . (.Microsoft Corporation - Serviço de Gerenciamento de Chaves.) -- C:\Windows\System32\kmsvc.dll [90624] O83 - Search Svchost Services: wercplsupport (wercplsupport) . (.Microsoft Corporation - Relatórios de Problemas e Soluções.) -- C:\Windows\System32\wercplsupport.dll [84480] O83 - Search Svchost Services: ProfSvc (ProfSvc) . (.Microsoft Corporation - ProfSvc.) -- C:\Windows\System32\profsvc.dll [209920] O83 - Search Svchost Services: Themes (Themes) . (.Microsoft Corporation - DLL do Serviço de Tema do Shell do Windows.) -- C:\Windows\System32\themeservice.dll [44544] O83 - Search Svchost Services: BDESVC (BDESVC) . (.Microsoft Corporation - Serviço BDE.) -- C:\Windows\System32\bdesvc.dll [100864] ~ Services: 32 Scanned in 00mn 00s ---\\ Pesquisa adicional à raiz do sistema (radicular) (SPRF) (O84) [MD5.7079F2B063D7408C4BC19C4307F9384C] [sPRF][26/11/2014] (...) -- C:\Users\Usuario\AppData\Roaming\unins000.dat [15660] [MD5.169180F02ABCECA5DE72FC5EEBC861BB] [sPRF][26/11/2014] (.No owner - Setup/Uninstall.) -- C:\Users\Usuario\AppData\Roaming\unins000.exe [730322] ~ Files: 2 Scanned in 00mn 00s ---\\ Estado general dos serviços não Microsoft (EGS) (SR=Executados, SS=Parados) SS - | Auto 09/11/2014 3488784 | (AVGIDSAgent) . (.AVG Technologies CZ, s.r.o..) - C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe SS - | Auto 03/04/2014 315008 | (SkypeUpdate) . (.Skype Technologies.) - C:\Program Files (x86)\Skype\Updater\Updater.exe SS - | Demand 13/07/2009 27136 | C:\Program Files (x86)\Windows Defender\mpsvc.dll (WinDefend) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe SR - | Auto 09/11/2014 298080 | (avgwd) . (.AVG Technologies CZ, s.r.o..) - C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe SR - | Auto 02/09/2014 558904 | (GbpSv) . (.GAS Tecnologia.) - C:\Program Files (x86)\GbPlugin\GbpSv.exe SR - | Auto 08/06/2008 877864 | (Nero BackItUp Scheduler 3) . (.Nero AG.) - C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe SR - | Demand 24/06/2008 537896 | (NMIndexingService) . (.Nero AG.) - C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe SR - | Auto 19/12/2006 81920 | (PLFlash DeviceIoControl Service) . (.Prolific Technology Inc..) - C:\Windows\SysWOW64\IoctlSvc.exe SR - | Auto 29/10/2014 1919256 | (RapportMgmtService) . (.IBM Corp..) - C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe SR - | Auto 14/12/2010 27760 | (VIAKaraokeService) . (.VIA Technologies, Inc..) - C:\Windows\System32\viakaraokesrv.exe SR - | Auto 10/07/1658 0 | (WMPNetworkSvc) . (...) - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe =>.Microsoft Corporation SR - | Auto 13/07/2009 27136 | C:\Windows\System32\wuaueng.dll (wuauserv) . (.Microsoft Corporation.) - C:\Windows\System32\svchost.exe ~ Services: Scanned in 00mn 07s ---\\ Pesquisa de infeção no Registo Mestre de Inicialização (MBR) (080) Run by Usuario at 02/12/2014 19:03:30 ~ OS 64 not supported by MBR tool ~ MBR: 0 Scanned in 00mn 00s ---\\ Pesquisa de infeção no Registo Mestre de Inicialização (MBRCheck) (080) Written by ad13, http://ad13.geekstog Run by Usuario at 02/12/2014 19:03:32 ********* Dump file Name ********* C:\PhysicalDisk0_MBR.bin ~ MBR: Scanned in 00mn 02s ---\\ Scâner Aditional (088) Database Version : 13026 - (30/11/2014) Clés trouvées (Keys found) : 2 Valeurs trouvées (Values found) : 0 Dossiers trouvés (Folders found) : 1 Fichiers trouvés (Files found) : 1 [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Run_Bobby_Browser] =>PUP.BoBrowser^ [HKLM\Software\Classes\S] =>Toolbar.Agent C:\Users\Usuario\AppData\Local\BoBrowser =>PUP.BoBrowser^ [HKCU\Software\BoBrowser] =>PUP.BoBrowser^ ~ Additionnel Scan: 198978 Items scanned in 00mn 40s ---\\ Informações complémentaires do módulos ~ http://nicolascoolman.fr/r5-internet-explorer-proxy-management-iepm/ =>.Internet Explorer, Gestão do Proxy (R5) ~ http://nicolascoolman.fr/o2-browser-helper-objects-de-navigateur/ =>.Browser Helper Objects do navegador (02) ~ http://nicolascoolman.fr/o4-applications-demarrees-par-le-registre/ =>.Aplicações iniciadas por registo & pastas (04) ~ AMI: 3 Scanned in 00mn 00s ---\\ Sumário das deteções encontradas na sua estação http://www.nicolascoolman.fr/blog/ =>PUP.BoBrowser http://www.nicolascoolman.fr/blog/ =>Toolbar.Agent ~ MSI: 2 link(s) detected in 00mn 00s End of the scan (1015 lines in 01mn 47s)(0) Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Dezembro 3, 2014 Boa Noite! Ionara > Execute este script na ferramenta ZHPFix. > Selecione e copie estas informações que estão em vermelho,para o Bloco de Notas. > Com o Bloco de Notas aberto,faça: ctrl+a >> ctrl+c ( Selecionar e Copiar ) > À seguir,minimize o Bloco de Notas. Script ZHPFix FirewallRaz EmptyPrefetch ShortcutFix EmptyTemp EmptyFlash [MD5.00000000000000000000000000000000] [APT] [Run_Bobby_Browser] (...) -- C:\Users\Usuario\AppData\Local\BoBrowser\Application\bobrowser.exe (.not file.) [0] O43 - CFD: 21/10/2014 - 19:31:20 - [0] ----D C:\Program Files (x86)\GUM8046.tmp O43 - CFD: 26/11/2014 - 20:31:20 - [0] ----D C:\ProgramData\boost_interprocess O44 - LFC:[MD5.701E1FED91369518F298AA092439ABC1] - 23/11/2014 - 13:52:24 ---A- . (...) -- C:\Windows\DirectX.log [42538] O61 - LFC: 26/11/2014 - 19:03:11 ---A- . (...) -- C:\Users\Usuario\AppData\Roaming\unins000.exe [730322] [MD5.169180F02ABCECA5DE72FC5EEBC861BB] [sPRF][26/11/2014] (.No owner - Setup/Uninstall.) -- C:\Users\Usuario\AppData\Roaming\unins000.exe [730322] [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Run_Bobby_Browser] [HKLM\Software\Classes\S] [HKCU\Software\BoBrowser] C:\Users\Usuario\AppData\Local\BoBrowser > Abra a ferramenta ZHPFix. < > > Clique IMPORTAÇÃO >> OK. > Ps: Ao clicar "OK",verifique se o campo está limpo para que receba,somente,as informações do script. > Clique "GO". > Poste o relatório! A+ Compartilhar este post Link para o post Compartilhar em outros sites
Ionara 2 Denunciar post Postado Dezembro 4, 2014 Boa noite, segue log ZHPfix... Rapport de ZHPFix 2014.10.24.12 par Nicolas Coolman, Update du 24/10/2014 Fichier d'export Registre : Run by Usuario at 03/12/2014 21:59:23 High Elevated Privileges : OK Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601) Reciclagem vazia (00mn 06s) Prefetcher vazio Reparação de atalhos do navegador ========== Chaves do Registo ========== ELIMINÉ: HKLM\Software\Classes\S ELIMINÉ: HKCU\Software\BoBrowser ========== Valores do Registo ========== Ausente Valor Perfil Padrão: FirewallRaz : Ausente Valor Perfil Domínio FirewallRaz : ELIMINÉ: FirewallRaz (Domain) : NetPres-In-TCP-NoScope ELIMINÉ: FirewallRaz (Domain) : NetPres-Out-TCP-NoScope ELIMINÉ: FirewallRaz (None) : NetPres-WSD-In-UDP ELIMINÉ: FirewallRaz (None) : NetPres-WSD-Out-UDP ELIMINÉ: FirewallRaz (Public) : NetPres-In-TCP ELIMINÉ: FirewallRaz (Public) : NetPres-Out-TCP ========== Pastas ========== ELIMINÉ Temporários windows (93) ELIMINÉ Flash Cookies (0) ELIMINÉ: C:\Program Files (x86)\GUM8046.tmp ELIMINÉ: C:\ProgramData\boost_interprocess ELIMINÉ: c:\users\usuario\appdata\local\bobrowser ========== Ficheiros ========== ELIMINÉ Temporários windows (2058) (1.033.229.267 octets) ELIMINÉ Flash Cookies (0) (0 octets) ELIMINÉ: c:\windows\directx.log ELIMINÉ: c:\users\usuario\appdata\roaming\unins000.exe ========== Tarefa planificada ========== ELIMINÉ: Run_Bobby_Browser ========== Recapitulativo ========== 2 : Chaves do Registo 8 : Valores do Registo 5 : Pastas 4 : Ficheiros 1 : Tarefa planificada End of clean in 02mn 42s ========== Caminho do ficheiro do relatório ========== C:\Users\Usuario\AppData\Roaming\ZHP\ZHPFix[R1].txt - 03/12/2014 21:59:32 [1637] Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Dezembro 4, 2014 Boa Noite! Ionara > Baixe: < > ( ... par Xplode ) > > Ou daqui: < AdwCleaner > > Ao acessar,clique em "Download Now". > > Salve-o no desktop! < > > Clique direito em adwcleaner.exe,e escolha sua execução como administrador. > Ps: Dê início ao scan,clicando em "Examinar". < > > Ao concluir,clique "Limpar" >> Ok >> Ok >> Ok. > Copie o log ou clique "Relatório". > Poste: < C:\AdwCleaner\AdwCleaner[s0].txt > A+ Compartilhar este post Link para o post Compartilhar em outros sites
Ionara 2 Denunciar post Postado Dezembro 5, 2014 Boa noite, seg log ADWCleaner... # AdwCleaner v4.104 - Relatório criado 04/12/2014 às 22:41:10 # Atualizado 05/12/2014 por Xplode # Database : 2014-12-03.1 [Live] # Sistema Operacional : Windows 7 Home Premium Service Pack 1 (64 bits) # Usuário : Usuario - USUARIO-PC # Executando de : C:\Users\Usuario\Desktop\adwcleaner_4.104.exe # Opção : Limpar ***** [ Serviços ] ***** ***** [ Arquivos / Pastas ] ***** Pasta Deletada : C:\ProgramData\baidu Pasta Deletada : C:\Users\Usuario\AppData\Roaming\baidu Pasta Deletada : C:\Users\Usuario\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl ***** [ Tarefas ] ***** ***** [ Atalhos ] ***** ***** [ Registro ] ***** Chave Deletedo : HKLM\SOFTWARE\Google\Chrome\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl Chave Deletedo : HKLM\SOFTWARE\Clara ***** [ Navegadores ] ***** -\\ Internet Explorer v8.0.7601.17514 -\\ Google Chrome v [C:\Users\Usuario\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deletedo [search Provider] : hxxp://br.ask.com/web?q={searchTerms} ************************* AdwCleaner[R0].txt - [1257 octets] - [04/12/2014 22:39:39] AdwCleaner[s0].txt - [1163 octets] - [04/12/2014 22:41:10] ########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [1223 octets] ########## Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Dezembro 5, 2014 Bom Dia! Ionara > Baixe: < > ( ... by Farbar ) > No banner àcima,é para sistemas 32bits! < Farbar Recovery Scan Tool 64-Bit > > No link àcima,é para sistemas 64bits! > Salve-o no desktop! (Área de trabalho ...) > Execute a ferramenta! Clique "Yes" >> "Scan". > Antes de clicar "Scan",verifique se as caixinhas em "Whitelist" estão assinaladas. > Em "Optional Scan",deixe marcada a checkbox "Addition.txt". > Ps: Será gerado,também,o relatório "Addition.txt" que estará disponibilizado na 1ª execução da ferramenta. > Poste os relatórios! (FRST.txt + Addition.txt) > Como o log será extenso,envie-o à > > O link ao relatório,que é este assinalado,deverá ser colado em sua resposta. > Ou clique "Copier le lien (*)" e cole o link ao seu Post. A+ Compartilhar este post Link para o post Compartilhar em outros sites
Ionara 2 Denunciar post Postado Dezembro 5, 2014 Boa noite, os navegadores travam, por que o script da página que armazena os logs faz isso, não sei como postar os relatórios de outra forma, tentei dois navegadores... então... seguem os logs :sick: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-12-2014 Ran by Usuario (administrator) on USUARIO-PC on 05-12-2014 20:40:16 Running from C:\Users\Usuario\Desktop Loaded Profile: Usuario (Available profiles: Usuario) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Português (Brasil) Internet Explorer Version 8 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe (IBM Corp.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (Nero AG) C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe (Prolific Technology Inc.) C:\Windows\SysWOW64\IoctlSvc.exe (VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe (IBM Corp.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Nero AG) C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe (GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe (Nero AG) C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe (VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [34672 2008-06-12] (Adobe Systems Incorporated) HKLM-x32\...\Run: [NBKeyScan] => C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2221352 2008-06-08] (Nero AG) HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation) HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2870896 2010-12-22] (VIA) HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3653136 2014-11-09] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\ GbPluginCef-x32: C:\Program Files (x86)\GbPlugin\gbiehCef.dll (Caixa Economica Federal) HKU\S-1-5-21-4088202244-695289871-602143169-1000\...\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1840424 2008-06-24] (Nero AG) HKU\S-1-5-21-4088202244-695289871-602143169-1000\...\Run: [Google Update] => C:\Users\Usuario\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-10-21] (Google Inc.) CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-4088202244-695289871-602143169-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com.br/?gws_rd=ssl HKU\S-1-5-21-4088202244-695289871-602143169-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/pt-br/?ocid=iehp HKU\S-1-5-21-4088202244-695289871-602143169-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x90583B5D52F9CF01 HKU\S-1-5-21-4088202244-695289871-602143169-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = pt-br StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKU\S-1-5-21-4088202244-695289871-602143169-1000 -> DefaultScope {84B1A9CC-778C-4330-9528-A09FE7B4D337} URL = http://www.google.com/search?hl=en&q={searchTerms} SearchScopes: HKU\S-1-5-21-4088202244-695289871-602143169-1000 -> {84B1A9CC-778C-4330-9528-A09FE7B4D337} URL = http://www.google.com/search?hl=en&q={searchTerms} BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540003} -> C:\Program Files (x86)\GbPlugin\gbiehcef.dll (Caixa Economica Federal) BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399003} - C:\Program Files (x86)\GbPlugin\gbiehcef.dll [1789792 2014-11-28] (Caixa Economica Federal) Tcpip\Parameters: [DhcpNameServer] 172.16.0.254 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll () FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll () FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll (Foxit Corporation) FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll (Foxit Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @raidcall.en/RCplugin -> C:\Users\Usuario\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall) FF Plugin HKU\S-1-5-21-4088202244-695289871-602143169-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Usuario\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKU\S-1-5-21-4088202244-695289871-602143169-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Usuario\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKU\S-1-5-21-4088202244-695289871-602143169-1000: gastecnologia.com.br/sf/cef -> C:\Users\Usuario\AppData\Local\GAS Tecnologia\GBBD\npsf_cef.dll (GAS Tecnologia) Chrome: ======= CHR StartupUrls: Default -> "hxxp://google.com.br/" CHR Plugin: (Shockwave Flash) - C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Users\Usuario\AppData\Local\Google\Chrome\Application\39.0.2171.71\pdf.dll () CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll () CHR Profile: C:\Users\Usuario\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Wallet) - C:\Users\Usuario\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-22] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3488784 2014-11-09] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [298080 2014-11-09] (AVG Technologies CZ, s.r.o.) R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation) R2 GbpSv; C:\Program Files (x86)\GbPlugin\gbpsv.exe [555320 2014-11-03] (GAS Tecnologia) R2 Nero BackItUp Scheduler 3; C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe [877864 2008-06-08] (Nero AG) R3 NMIndexingService; C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [537896 2008-06-24] (Nero AG) R2 PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed] R2 RapportMgmtService; C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [1919256 2014-10-29] (IBM Corp.) R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2010-12-14] (VIA Technologies, Inc.) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.) R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [263960 2014-10-29] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-18] (AVG Technologies CZ, s.r.o.) R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.) R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.) R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [124184 2014-10-05] (AVG Technologies CZ, s.r.o.) R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.) R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [274200 2014-10-10] (AVG Technologies CZ, s.r.o.) R1 mosfilterdrv; C:\Windows\System32\drivers\mosfilterdrv.sys [60728 2014-10-22] (NetFilterSDK.com) R1 pofilterdrv; C:\Windows\System32\drivers\pofilterdrv.sys [60736 2014-08-29] (NetFilterSDK.com) R1 RapportCerberus_80071; C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_80071.sys [761720 2014-11-13] () R1 RapportEI64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [445880 2014-10-29] (IBM Corp.) R0 RapportKE64; C:\Windows\System32\Drivers\RapportKE64.sys [534104 2014-10-29] (IBM Corp.) R1 RapportPG64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [557656 2014-10-29] (IBM Corp.) R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-13] (Brother Industries Ltd.) R3 Warsaw_PP; C:\Program Files (x86)\GbPlugin\wsftprp64.sys [24792 2014-09-02] (GAS Tecnologia LTDA) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-05 20:40 - 2014-12-05 20:40 - 00012657 _____ () C:\Users\Usuario\Desktop\FRST.txt 2014-12-05 20:40 - 2014-12-05 20:40 - 00000000 ____D () C:\FRST 2014-12-05 20:29 - 2014-12-05 20:31 - 02117632 _____ (Farbar) C:\Users\Usuario\Desktop\FRST64.exe 2014-12-04 22:38 - 2014-12-04 22:41 - 00000000 ____D () C:\AdwCleaner 2014-12-04 22:38 - 2014-12-04 22:38 - 00000055 _____ () C:\AdwCleanerDebug.txt 2014-12-04 22:36 - 2014-12-04 22:37 - 02153472 _____ () C:\Users\Usuario\Desktop\adwcleaner_4.104.exe 2014-12-04 22:34 - 2014-12-04 22:34 - 02153472 _____ () C:\AdwCleaner.exe 2014-12-04 21:58 - 2014-12-04 22:04 - 00000000 ____D () C:\Users\Usuario\Desktop\Camera 2014-12-03 21:59 - 2014-12-03 21:59 - 00001719 _____ () C:\Users\Usuario\Desktop\ZHPFixReport.txt 2014-12-02 19:04 - 2014-12-02 19:06 - 00086987 _____ () C:\Users\Usuario\Desktop\ZHPDiag.txt 2014-12-02 19:02 - 2014-12-02 19:02 - 00003160 _____ () C:\Windows\System32\Tasks\{4C00E39F-EC56-418C-8BED-28239473F78A} 2014-12-02 18:59 - 2014-12-02 18:59 - 00001987 _____ () C:\Users\Usuario\Desktop\ZHPFix.lnk 2014-12-02 18:59 - 2014-12-02 18:59 - 00001860 _____ () C:\Users\Usuario\Desktop\ZHPDiag.lnk 2014-12-02 18:59 - 2014-12-02 18:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP 2014-12-02 18:59 - 2014-12-02 18:59 - 00000000 ____D () C:\Program Files (x86)\ZHPDiag 2014-12-02 18:57 - 2014-12-02 18:59 - 06866303 _____ (Nicolas Coolman ) C:\ZHPDiag2.exe 2014-12-02 06:33 - 2014-12-02 06:34 - 06866303 _____ (Nicolas Coolman ) C:\Users\Usuario\Downloads\ZHPDiag2.exe 2014-12-01 22:45 - 2014-12-01 22:45 - 00002985 _____ () C:\Users\Usuario\Desktop\HiJackThis.lnk 2014-12-01 22:45 - 2014-12-01 22:45 - 00000000 ____D () C:\Users\Usuario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis 2014-11-29 23:40 - 2014-12-02 10:22 - 00000000 ____D () C:\Users\Usuario\Desktop\estudo gabi 2014-11-29 23:38 - 2014-11-30 15:06 - 00000000 ____D () C:\Users\Usuario\Desktop\estudo nara 2014-11-29 19:07 - 2014-11-29 19:07 - 00031460 _____ () C:\Users\Usuario\Downloads\Outlook.com.zip 2014-11-27 20:43 - 2014-11-27 20:43 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-11-27 06:40 - 2014-12-02 19:03 - 00000512 _____ () C:\PhysicalDisk0_MBR.bin 2014-11-27 06:39 - 2014-12-03 21:59 - 00000000 ____D () C:\Users\Usuario\AppData\Roaming\ZHP 2014-11-26 21:46 - 2014-11-26 21:46 - 00000000 ____D () C:\Program Files (x86)\Trend Micro 2014-11-26 21:44 - 2014-11-26 21:44 - 01402880 _____ () C:\Users\Usuario\Downloads\HijackThis.msi 2014-11-26 20:48 - 2014-12-05 20:01 - 00000000 ____D () C:\Users\Todos os Usuários\GbPlugin 2014-11-26 20:48 - 2014-12-05 20:01 - 00000000 ____D () C:\ProgramData\GbPlugin 2014-11-26 20:48 - 2014-12-05 20:01 - 00000000 ____D () C:\Program Files (x86)\GbPlugin 2014-11-26 20:46 - 2014-11-26 20:48 - 00001699 _____ () C:\Users\Usuario\Documents\Instalação do Módulo Adicional de Segurança CAIXA.log 2014-11-26 20:46 - 2014-11-26 20:46 - 02514272 _____ (CAIXA) C:\Users\Usuario\Documents\iGBPCEFgb.exe 2014-11-26 20:31 - 2014-11-26 20:48 - 00000000 ____D () C:\Users\Todos os Usuários\GAS Tecnologia 2014-11-26 20:31 - 2014-11-26 20:48 - 00000000 ____D () C:\ProgramData\GAS Tecnologia 2014-11-26 20:31 - 2014-11-26 20:31 - 00015660 _____ () C:\Users\Usuario\AppData\Roaming\unins000.dat 2014-11-26 20:31 - 2014-11-26 20:31 - 00000000 ____D () C:\Users\Usuario\AppData\Local\GAS Tecnologia 2014-11-26 20:30 - 2014-11-26 20:31 - 00001076 _____ () C:\Users\Usuario\Downloads\Instalação do Módulo Adicional de Segurança CAIXA.log 2014-11-26 20:26 - 2014-11-26 20:27 - 02514272 _____ (CAIXA) C:\Users\Usuario\Downloads\iGBPCEFsf.exe 2014-11-23 16:04 - 2014-11-24 22:16 - 00002297 _____ () C:\Users\Usuario\Desktop\chrome.lnk 2014-11-23 16:01 - 2014-11-23 16:01 - 00000227 _____ () C:\Users\Todos os Usuários\bc.ini 2014-11-23 16:01 - 2014-11-23 16:01 - 00000227 _____ () C:\ProgramData\bc.ini 2014-11-23 15:25 - 2014-11-24 22:15 - 00000000 ____D () C:\Users\Todos os Usuários\Baidu Security 2014-11-23 15:25 - 2014-11-24 22:15 - 00000000 ____D () C:\ProgramData\Baidu Security 2014-11-23 15:07 - 2014-11-23 16:07 - 00000000 ____D () C:\Program Files (x86)\NJax 2014-11-23 15:07 - 2014-10-22 00:54 - 00060728 _____ (NetFilterSDK.com) C:\Windows\system32\Drivers\mosfilterdrv.sys 2014-11-23 15:06 - 2014-08-29 11:13 - 00060736 _____ (NetFilterSDK.com) C:\Windows\system32\Drivers\pofilterdrv.sys 2014-11-23 14:57 - 2014-11-30 00:07 - 00000000 ____D () C:\Users\Usuario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games 2014-11-23 14:52 - 2014-11-30 00:07 - 00000000 ____D () C:\Users\Usuario\AppData\Roaming\InstallShield Installation Information 2014-11-23 14:52 - 2014-11-30 00:07 - 00000000 ____D () C:\Users\Usuario\AppData\Roaming\Firaxis Games 2014-11-23 14:52 - 2014-11-30 00:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firaxis Games 2014-11-23 14:52 - 2014-11-23 14:52 - 00001300 _____ () C:\Users\Usuario\Desktop\Launch Sid Meier's Civilization 4.lnk 2014-11-23 14:51 - 2005-05-26 15:34 - 03767504 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_26.dll 2014-11-23 14:51 - 2005-05-26 15:34 - 02297552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_26.dll 2014-11-21 17:14 - 2014-11-21 17:14 - 00000000 ____D () C:\Users\Usuário Padrão\AppData\Roaming\TuneUp Software 2014-11-21 17:14 - 2014-11-21 17:14 - 00000000 ____D () C:\Users\Default\AppData\Roaming\TuneUp Software 2014-11-21 17:14 - 2014-11-21 17:14 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\TuneUp Software 2014-11-20 12:04 - 2014-11-30 12:46 - 00000000 ____D () C:\Users\Usuario\AppData\Local\Glyph 2014-11-20 12:04 - 2014-11-30 00:07 - 00000000 ____D () C:\Users\Todos os Usuários\Glyph 2014-11-20 12:04 - 2014-11-30 00:07 - 00000000 ____D () C:\ProgramData\Glyph 2014-11-20 11:53 - 2014-11-20 11:59 - 31884400 _____ (Trion Worlds Inc.) C:\Users\Usuario\Downloads\GlyphInstall-0-120.exe 2014-11-16 21:52 - 2014-11-16 21:52 - 00000000 ____D () C:\Users\Usuario\AppData\Local\VS Revo Group 2014-11-16 21:51 - 2014-12-02 18:54 - 00001121 _____ () C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk 2014-11-16 21:51 - 2014-11-16 21:51 - 00000000 ____D () C:\Users\Todos os Usuários\VS Revo Group 2014-11-16 21:51 - 2014-11-16 21:51 - 00000000 ____D () C:\ProgramData\VS Revo Group 2014-11-16 21:51 - 2014-11-16 21:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro 2014-11-16 21:51 - 2014-11-16 21:51 - 00000000 ____D () C:\Program Files\VS Revo Group 2014-11-16 21:51 - 2009-12-30 11:21 - 00031800 _____ (VS Revo Group) C:\Windows\system32\Drivers\revoflt.sys 2014-11-16 21:49 - 2014-11-16 21:51 - 10691640 _____ (VS Revo Group ) C:\Users\Usuario\Downloads\RevoUninProSetup.exe 2014-11-16 21:34 - 2014-11-16 21:34 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-11-16 21:34 - 2014-11-16 21:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-11-13 20:22 - 2014-11-13 20:22 - 00000000 ____D () C:\Users\Usuario\Desktop\101MSDCF 2014-11-13 05:59 - 2014-11-13 05:59 - 00000000 ____D () C:\Users\Usuário Padrão\AppData\Local\Trusteer 2014-11-13 05:59 - 2014-11-13 05:59 - 00000000 ____D () C:\Users\Default\AppData\Local\Trusteer 2014-11-13 05:59 - 2014-11-13 05:59 - 00000000 ____D () C:\Users\Default User\AppData\Local\Trusteer 2014-11-12 21:14 - 2014-11-12 21:15 - 00000000 ____D () C:\Users\Usuario\AppData\Local\Microsoft Games 2014-11-12 06:48 - 2014-11-12 06:49 - 05634430 _____ () C:\Users\Usuario\Cartilha Medicamentos_2010_ANVISA pdf.pptx 2014-11-11 22:46 - 2014-11-11 22:46 - 00064692 _____ () C:\Users\Usuario\2040-9888-1-PB.html 2014-11-11 22:46 - 2014-11-11 22:46 - 00000397 _____ () C:\Users\Usuario\2040-9888-1-PB.css 2014-11-11 22:43 - 2014-11-11 22:43 - 00037446 _____ () C:\Users\Usuario\2040-9888-1-PB.pptx 2014-11-11 22:42 - 2014-11-11 22:42 - 00000000 ____D () C:\Users\Todos os Usuários\ABBYY 2014-11-11 22:42 - 2014-11-11 22:42 - 00000000 ____D () C:\ProgramData\ABBYY 2014-11-11 22:37 - 2014-11-22 18:36 - 00000000 ____D () C:\Users\Usuario\AppData\Roaming\Foxit Software 2014-11-11 22:37 - 2014-11-11 22:37 - 00001094 _____ () C:\Users\Public\Desktop\Foxit PhantomPDF.lnk 2014-11-11 22:37 - 2014-11-11 22:37 - 00000000 ____D () C:\Users\Public\Foxit Software 2014-11-11 22:37 - 2014-11-11 22:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit PhantomPDF 2014-11-11 22:36 - 2014-11-11 22:36 - 00000000 ____D () C:\Users\Todos os Usuários\Package Cache 2014-11-11 22:36 - 2014-11-11 22:36 - 00000000 ____D () C:\ProgramData\Package Cache 2014-11-11 22:36 - 2014-11-11 22:36 - 00000000 ____D () C:\Program Files (x86)\Foxit Software 2014-11-11 21:25 - 2014-11-11 22:35 - 333230080 _____ (Foxit Software Inc.) C:\Users\Usuario\FoxitPhantomPDF615_Standard_L10N.exe 2014-11-11 21:23 - 2014-11-11 21:23 - 01478144 _____ () C:\Users\Usuario\dr pedro eduardo menegasso_dispensacao de medicamentos de uso continuo.ppt 2014-11-10 07:07 - 2014-11-10 07:07 - 92658088 _____ (Oracle Corporation) C:\Users\Usuario\Downloads\jre-8u25-windows-x64.exe 2014-11-09 22:19 - 2014-11-09 22:19 - 00000510 _____ () C:\Users\Usuario\formulario visa.htm 2014-11-09 22:04 - 2014-11-11 22:46 - 00203776 ___SH () C:\Users\Usuario\Thumbs.db 2014-11-09 22:04 - 2014-11-09 22:04 - 00061862 _____ () C:\Users\Usuario\memodescritivo_comerciomedicamento.zip 2014-11-09 11:12 - 2014-11-09 11:18 - 00000000 ____D () C:\Users\Usuario\provas 2014-11-05 21:45 - 2014-11-05 21:45 - 00000000 ____D () C:\Windows\Sun 2014-11-05 21:35 - 2014-11-05 21:35 - 00046801 _____ () C:\Users\Usuario\Downloads\5.2.3790.2724 (1).zip 2014-11-05 21:33 - 2014-11-05 21:33 - 00000000 ____D () C:\Users\Usuario\Downloads\5.2.3790.2724 2014-11-05 21:27 - 2014-11-05 21:27 - 00000000 ____D () C:\Users\Todos os Usuários\Sun 2014-11-05 21:27 - 2014-11-05 21:27 - 00000000 ____D () C:\ProgramData\Sun 2014-11-05 21:26 - 2014-11-05 21:26 - 00000000 ____D () C:\Users\Todos os Usuários\Oracle 2014-11-05 21:26 - 2014-11-05 21:26 - 00000000 ____D () C:\ProgramData\Oracle 2014-11-05 21:26 - 2014-11-05 21:26 - 00000000 ____D () C:\Program Files (x86)\Java 2014-11-05 21:20 - 2014-11-05 21:20 - 00638888 _____ (Oracle Corporation) C:\Users\Usuario\Downloads\chromeinstall-8u25.exe 2014-11-05 21:12 - 2014-10-29 19:25 - 00534104 _____ (IBM Corp.) C:\Windows\system32\Drivers\RapportKE64.sys 2014-11-05 21:11 - 2014-11-13 05:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Proteção de Terminal Trusteer 2014-11-05 21:11 - 2014-11-05 21:11 - 00000000 ____D () C:\Users\Usuario\AppData\Local\Trusteer 2014-11-05 21:11 - 2014-11-05 21:11 - 00000000 ____D () C:\Program Files (x86)\Trusteer 2014-11-05 21:04 - 2014-11-05 21:04 - 00436504 _____ (IBM Corp.) C:\Users\Usuario\Downloads\RapportSetup.exe 2014-11-05 21:04 - 2014-11-05 21:04 - 00000000 ____D () C:\Users\Todos os Usuários\Trusteer 2014-11-05 21:04 - 2014-11-05 21:04 - 00000000 ____D () C:\ProgramData\Trusteer 2014-11-05 21:03 - 2014-11-10 07:07 - 00046801 _____ () C:\Users\Usuario\Downloads\5.2.3790.2724.zip 2014-11-05 21:00 - 2014-11-05 21:00 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WUDFUsbccidDriver_01_09_00.Wdf ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-05 20:32 - 2009-07-14 02:45 - 00025968 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-12-05 20:32 - 2009-07-14 02:45 - 00025968 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-12-05 20:07 - 2009-07-14 15:55 - 00657176 _____ () C:\Windows\system32\prfh0416.dat 2014-12-05 20:07 - 2009-07-14 15:55 - 00125568 _____ () C:\Windows\system32\prfc0416.dat 2014-12-05 20:07 - 2009-07-14 03:13 - 01499760 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-12-05 20:04 - 2014-10-21 16:12 - 00000000 ____D () C:\Users\Todos os Usuários\MFAData 2014-12-05 20:04 - 2014-10-21 16:12 - 00000000 ____D () C:\ProgramData\MFAData 2014-12-05 20:02 - 2011-05-16 15:57 - 00342966 _____ () C:\Windows\WindowsUpdate.log 2014-12-05 20:01 - 2011-02-07 06:30 - 00024778 _____ () C:\Windows\setupact.log 2014-12-05 20:01 - 2009-07-14 03:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-04 22:44 - 2014-10-21 19:31 - 00001086 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000UA.job 2014-12-04 22:42 - 2011-05-16 02:18 - 00009922 _____ () C:\Windows\PFRO.log 2014-12-02 19:28 - 2014-10-21 19:29 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-12-01 21:44 - 2014-10-21 19:31 - 00001034 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000Core.job 2014-12-01 18:43 - 2009-07-14 03:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD 2014-11-30 16:03 - 2009-07-14 02:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2014-11-30 00:07 - 2009-07-14 01:20 - 00000000 ____D () C:\Windows\registration 2014-11-30 00:07 - 2009-07-14 01:20 - 00000000 ____D () C:\Windows\AppCompat 2014-11-29 23:42 - 2011-05-16 17:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2014-11-29 23:13 - 2011-05-16 15:55 - 00000000 ____D () C:\Users\Usuario 2014-11-26 21:10 - 2014-10-21 16:12 - 00000000 ____D () C:\Users\Usuario\AppData\Local\Avg2015 2014-11-24 22:14 - 2011-05-16 16:09 - 00000000 ____D () C:\Program Files (x86)\WinRAR 2014-11-23 15:45 - 2009-07-14 01:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy 2014-11-23 15:45 - 2009-07-14 01:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy 2014-11-21 17:14 - 2014-10-21 16:15 - 00000983 _____ () C:\Users\Public\Desktop\AVG 2015.lnk 2014-11-21 17:14 - 2014-10-21 16:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2014-11-16 21:39 - 2014-10-21 19:31 - 00004064 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000UA 2014-11-16 21:39 - 2014-10-21 19:31 - 00003668 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000Core 2014-11-11 22:42 - 2014-10-22 21:33 - 00000000 ____D () C:\Users\Usuario\AppData\Local\Adobe 2014-11-10 11:13 - 2011-05-16 17:04 - 00000000 ____D () C:\Users\Todos os Usuários\Microsoft Help 2014-11-10 11:13 - 2011-05-16 17:04 - 00000000 ____D () C:\ProgramData\Microsoft Help Files to move or delete: ==================== C:\Users\Usuario\FoxitPhantomPDF615_Standard_L10N.exe Some content of TEMP: ==================== C:\Users\Usuario\AppData\Local\Temp\Quarantine.exe C:\Users\Usuario\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-11-26 22:16 ==================== End Of Log ============================ e o outro.... Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-12-2014 Ran by Usuario at 2014-12-05 20:40:46 Running from C:\Users\Usuario\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: AVG AntiVirus Free Edition 2015 (Disabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9} AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: AVG AntiVirus Free Edition 2015 (Disabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.9.900.117 - Adobe Systems Incorporated) Adobe Reader 9 - Português (HKLM-x32\...\{AC76BA86-7AD7-1046-7B44-A90000000001}) (Version: 9.0.0 - Adobe Systems Incorporated) AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5577 - AVG Technologies) AVG 2015 (Version: 15.0.4235 - AVG Technologies) Hidden AVG 2015 (Version: 15.0.5577 - AVG Technologies) Hidden Foxit PhantomPDF (HKLM-x32\...\{4B6D9565-5CA8-4D2C-B9F6-0A2D7F67474F}) (Version: 6.1.5.624 - Foxit Corporation) GBBD Caixa Economica Federal (HKLM-x32\...\{5d01f486-f32d-462e-8830-cc1d116e8ece}_is1) (Version: 3.11.0.1 - ) Google Chrome (HKU\S-1-5-21-4088202244-695289871-602143169-1000\...\Google Chrome) (Version: 39.0.2171.71 - Google Inc.) HiJackThis (HKLM-x32\...\{45A66726-69BC-466B-A7A4-12FCBA4883D7}) (Version: 1.0.0 - Trend Micro) Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2291 - Intel Corporation) Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation) Malwarebytes Anti-Malware versão 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation) Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.4518.1014 - Microsoft Corporation) Nero 8 Ultra Edition HD (HKLM-x32\...\{D6C9AF27-9414-46C8-B9D8-D878BA041046}) (Version: 8.3.326 - Nero AG) Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden Proteção de Terminal Trusteer (HKLM-x32\...\Rapport_msi) (Version: 3.5.1404.24 - Trusteer) Qualcomm Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.0.4.4 - Qualcomm Atheros Communications Inc.) RaidCall (HKLM-x32\...\RaidCall) (Version: 9.0.0-1.0.1930.378 - raidcall.com.br) Rapport (x32 Version: 3.5.1404.24 - Trusteer) Hidden Revo Uninstaller Pro 3.1.1 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.1 - VS Revo Group, Ltd.) Sid Meier's Civilization 4 (HKU\S-1-5-21-4088202244-695289871-602143169-1000\...\{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}) (Version: 1.00.0000 - Firaxis Games) Sid Meier's Civilization 4 (x32 Version: 1.00.0000 - Firaxis Games) Hidden Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation) Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.) VCRedistSetup (x32 Version: 1.0.0 - Nero AG) Hidden VIA Gerenciador de dispositivo de plataforma (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.34 - VIA Technologies, Inc.) Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies) Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.) XP Codec Pack (HKLM-x32\...\XP Codec Pack) (Version: - ) ZHPDiag 2014 (HKLM-x32\...\ZHPDiag_is1) (Version: 2014 - Nicolas Coolman) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-4088202244-695289871-602143169-1000_Classes\CLSID\{0783EB25-59F8-4F02-B6B0-F1D4349F0007}\InprocServer32 -> C:\Users\Usuario\AppData\Local\GAS Tecnologia\GBBD\npsf_cef_64.dll (GAS Tecnologia) CustomCLSID: HKU\S-1-5-21-4088202244-695289871-602143169-1000_Classes\CLSID\{0783EB25-59F8-4F02-B6B1-F1D4349F0007}\InprocServer32 -> C:\Users\Usuario\AppData\Local\GAS Tecnologia\GBBD\npsf_cef_64.dll (GAS Tecnologia) CustomCLSID: HKU\S-1-5-21-4088202244-695289871-602143169-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Usuario\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File CustomCLSID: HKU\S-1-5-21-4088202244-695289871-602143169-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Usuario\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll (Google Inc.) CustomCLSID: HKU\S-1-5-21-4088202244-695289871-602143169-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Usuario\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll (Google Inc.) ==================== Restore Points ========================= 12-11-2014 00:36:27 Installed Foxit PhantomPDF 13-11-2014 07:59:16 Installed Rapport 16-11-2014 23:22:09 Removed Java 8 Update 25 (64-bit) 23-11-2014 16:51:15 DirectX 9.0 instalado 23-11-2014 16:52:45 Installed Sid Meier's Civilization 4 26-11-2014 23:45:45 Installed HiJackThis 02-12-2014 00:45:20 Installed HiJackThis ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 00:34 - 2009-06-10 19:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {484631E8-4374-4C25-8BCE-34AF9464F3B4} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000UA => C:\Users\Usuario\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.) Task: {5B35888E-4FF5-4448-9961-95AE1D33152B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000Core => C:\Users\Usuario\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.) Task: {E80D6459-376F-4A79-9847-01B95C21C281} - \060184C3-9766-46a0-B258-F4518A0B2633 No Task File <==== ATTENTION Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000Core.job => C:\Users\Usuario\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000UA.job => C:\Users\Usuario\AppData\Local\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2014-10-21 12:20 - 2011-01-27 08:11 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2014-10-21 12:35 - 2010-12-22 16:28 - 00078448 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll 2014-10-21 12:35 - 2010-12-22 16:28 - 00386160 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll 2014-10-21 12:35 - 2010-12-22 16:28 - 00621168 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Skin.dll 2014-03-23 16:04 - 2014-03-23 16:04 - 00557056 _____ () C:\Program Files (x86)\Trusteer\Rapport\bin\js32.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) AlternateDataStreams: C:\Windows\System32:7421B3FA_Cef.gbp ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) ========================= Accounts: ========================== Administrador (S-1-5-21-4088202244-695289871-602143169-500 - Administrator - Disabled) Convidado (S-1-5-21-4088202244-695289871-602143169-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-4088202244-695289871-602143169-1002 - Limited - Enabled) Usuario (S-1-5-21-4088202244-695289871-602143169-1000 - Administrator - Enabled) => C:\Users\Usuario ==================== Faulty Device Manager Devices ============= Name: Adaptador de Túnel Teredo da Microsoft Description: Adaptador de Túnel Teredo da Microsoft Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: tunnel Problem: : This device cannot start. (Code10) Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device. On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard. Name: Controlador de comunicação PCI simples Description: Controlador de comunicação PCI simples Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (12/03/2014 10:29:34 PM) (Source: SideBySide) (EventID: 80) (User: ) Description: Falha na geração de contexto de ativação para "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1".Erro no arquivo de manifesto ou de diretiva "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2", na linhaC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3. Uma versão de componente exigida pelo aplicativo está em conflito com outra versão de componente já ativa. Os componentes conflitantes são:. Componente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Componente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Error: (12/03/2014 10:29:34 PM) (Source: SideBySide) (EventID: 80) (User: ) Description: Falha na geração de contexto de ativação para "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1".Erro no arquivo de manifesto ou de diretiva "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2", na linhaC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3. Uma versão de componente exigida pelo aplicativo está em conflito com outra versão de componente já ativa. Os componentes conflitantes são:. Componente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Componente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Error: (12/03/2014 10:29:34 PM) (Source: SideBySide) (EventID: 80) (User: ) Description: Falha na geração de contexto de ativação para "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Erro no arquivo de manifesto ou de diretiva "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2", na linhaC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. Uma versão de componente exigida pelo aplicativo está em conflito com outra versão de componente já ativa. Os componentes conflitantes são:. Componente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Componente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error: (12/02/2014 06:54:00 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Nome de aplicativo com falha: Explorer.EXE, versão: 6.1.7601.17514, carimbo de hora: 0x4ce7a144 Nome do módulo de falhas: SHELL32.dll, versão: 6.1.7601.17514, carimbo de hora: 0x4ce7c9a6 Código de exceção: 0xc0000005 Deslocamento com falha: 0x000000000009a749 Identificação do processo com falha: 0x540 Hora de início do aplicativo com falha: 0xExplorer.EXE0 Caminho do aplicativo com falha: Explorer.EXE1 FCaminho do módulo de falhas: Explorer.EXE2 Identificação do Relatório: Explorer.EXE3 Error: (11/30/2014 00:50:11 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Nome de aplicativo com falha: set35F4.tmp, versão: 11.0.0.28844, carimbo de hora: 0x4250bcf6 Nome do módulo de falhas: set35F4.tmp, versão: 11.0.0.28844, carimbo de hora: 0x4250bcf6 Código de exceção: 0xc0000005 Deslocamento com falha: 0x0000742e Identificação do processo com falha: 0x17c8 Hora de início do aplicativo com falha: 0xset35F4.tmp0 Caminho do aplicativo com falha: set35F4.tmp1 FCaminho do módulo de falhas: set35F4.tmp2 Identificação do Relatório: set35F4.tmp3 Error: (11/30/2014 00:49:56 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Nome de aplicativo com falha: setF8B6.tmp, versão: 11.0.0.28844, carimbo de hora: 0x4250bcf6 Nome do módulo de falhas: setF8B6.tmp, versão: 11.0.0.28844, carimbo de hora: 0x4250bcf6 Código de exceção: 0xc0000005 Deslocamento com falha: 0x0000742e Identificação do processo com falha: 0x15f4 Hora de início do aplicativo com falha: 0xsetF8B6.tmp0 Caminho do aplicativo com falha: setF8B6.tmp1 FCaminho do módulo de falhas: setF8B6.tmp2 Identificação do Relatório: setF8B6.tmp3 Error: (11/30/2014 00:46:57 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Nome de aplicativo com falha: set4272.tmp, versão: 11.0.0.28844, carimbo de hora: 0x4250bcf6 Nome do módulo de falhas: set4272.tmp, versão: 11.0.0.28844, carimbo de hora: 0x4250bcf6 Código de exceção: 0xc0000005 Deslocamento com falha: 0x0000742e Identificação do processo com falha: 0x122c Hora de início do aplicativo com falha: 0xset4272.tmp0 Caminho do aplicativo com falha: set4272.tmp1 FCaminho do módulo de falhas: set4272.tmp2 Identificação do Relatório: set4272.tmp3 Error: (11/30/2014 00:46:50 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Nome de aplicativo com falha: set22B2.tmp, versão: 11.0.0.28844, carimbo de hora: 0x4250bcf6 Nome do módulo de falhas: set22B2.tmp, versão: 11.0.0.28844, carimbo de hora: 0x4250bcf6 Código de exceção: 0xc0000005 Deslocamento com falha: 0x0000742e Identificação do processo com falha: 0x17e0 Hora de início do aplicativo com falha: 0xset22B2.tmp0 Caminho do aplicativo com falha: set22B2.tmp1 FCaminho do módulo de falhas: set22B2.tmp2 Identificação do Relatório: set22B2.tmp3 Error: (11/30/2014 08:00:20 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Nome de aplicativo com falha: GbpSv.exe, versão: 3.5.2.0, carimbo de hora: 0x53fcacd9 Nome do módulo de falhas: ntdll.dll, versão: 6.1.7601.17514, carimbo de hora: 0x4ce7ba58 Código de exceção: 0xc0000029 Deslocamento com falha: 0x000907b6 Identificação do processo com falha: 0x16c Hora de início do aplicativo com falha: 0xGbpSv.exe0 Caminho do aplicativo com falha: GbpSv.exe1 FCaminho do módulo de falhas: GbpSv.exe2 Identificação do Relatório: GbpSv.exe3 Error: (11/30/2014 08:00:14 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Nome de aplicativo com falha: GbpSv.exe, versão: 3.5.2.0, carimbo de hora: 0x53fcacd9 Nome do módulo de falhas: unknown, versão: 0.0.0.0, carimbo de hora: 0x00000000 Código de exceção: 0xc0000005 Deslocamento com falha: 0x01fdfdb5 Identificação do processo com falha: 0x16c Hora de início do aplicativo com falha: 0xGbpSv.exe0 Caminho do aplicativo com falha: GbpSv.exe1 FCaminho do módulo de falhas: GbpSv.exe2 Identificação do Relatório: GbpSv.exe3 System errors: ============= Error: (12/03/2014 09:52:27 PM) (Source: EventLog) (EventID: 6008) (User: ) Description: O desligamento anterior do sistema em 21:39:08 às 02/12/2014 não era esperado. Error: (12/02/2014 09:34:30 PM) (Source: EventLog) (EventID: 6008) (User: ) Description: O desligamento anterior do sistema em 21:19:50 às 02/12/2014 não era esperado. Error: (12/02/2014 08:44:13 PM) (Source: EventLog) (EventID: 6008) (User: ) Description: O desligamento anterior do sistema em 20:22:00 às 02/12/2014 não era esperado. Error: (12/02/2014 07:28:09 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: O serviço Serviço da Lista de Redes depende do serviço Reconhecimento de Locais de Rede, mas não foi possível iniciá-lo devido ao seguinte erro: %%1068 Error: (12/02/2014 07:28:09 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: O serviço Serviço da Lista de Redes depende do serviço Reconhecimento de Locais de Rede, mas não foi possível iniciá-lo devido ao seguinte erro: %%1068 Error: (12/02/2014 07:28:09 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: O serviço Serviço da Lista de Redes depende do serviço Reconhecimento de Locais de Rede, mas não foi possível iniciá-lo devido ao seguinte erro: %%1068 Error: (12/02/2014 07:28:09 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: O serviço Serviço da Lista de Redes depende do serviço Reconhecimento de Locais de Rede, mas não foi possível iniciá-lo devido ao seguinte erro: %%1068 Error: (12/02/2014 07:28:09 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: O serviço Serviço da Lista de Redes depende do serviço Reconhecimento de Locais de Rede, mas não foi possível iniciá-lo devido ao seguinte erro: %%1068 Error: (12/02/2014 07:28:09 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: O serviço Serviço da Lista de Redes depende do serviço Reconhecimento de Locais de Rede, mas não foi possível iniciá-lo devido ao seguinte erro: %%1068 Error: (12/02/2014 07:28:09 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: O serviço Serviço da Lista de Redes depende do serviço Reconhecimento de Locais de Rede, mas não foi possível iniciá-lo devido ao seguinte erro: %%1068 Microsoft Office Sessions: ========================= Error: (11/29/2014 10:28:13 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 4725 seconds with 2820 seconds of active time. This session ended with a crash. ==================== Memory info =========================== Processor: Intel® Core i5-2300 CPU @ 2.80GHz Percentage of memory in use: 20% Total physical RAM: 8098.91 MB Available physical RAM: 6474.01 MB Total Pagefile: 16196.02 MB Available Pagefile: 14531.1 MB Total Virtual: 8192 MB Available Virtual: 8191.81 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:244.04 GB) (Free:203.79 GB) NTFS Drive d: () (Fixed) (Total:221.62 GB) (Free:221.51 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 86B57702) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=244 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=221.6 GB) - (Type=07 NTFS) ==================== End Of Log ============================ Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Dezembro 6, 2014 Bom Dia! Ionara > Copie estas informações que estão em vermelho,para o Bloco de Notas. > Salve-a com o nome fixlist. << Texto! > Salve-a no desktop! ( Área de trabalho ... ) /!\ C:\Users\Usuario\Desktop /!\ start CloseProcesses: HKU\S-1-5-21-4088202244-695289871-602143169-1000\...\Run: [Google Update] => C:\Users\Usuario\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-10-21] (Google Inc.) CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION 2014-12-04 22:38 - 2014-12-04 22:41 - 00000000 ____D () C:\AdwCleaner 2014-12-04 22:38 - 2014-12-04 22:38 - 00000055 _____ () C:\AdwCleanerDebug.txt 2014-12-04 22:36 - 2014-12-04 22:37 - 02153472 _____ () C:\Users\Usuario\Desktop\adwcleaner_4.104.exe 2014-12-04 22:34 - 2014-12-04 22:34 - 02153472 _____ () C:\AdwCleaner.exe 2014-12-03 21:59 - 2014-12-03 21:59 - 00001719 _____ () C:\Users\Usuario\Desktop\ZHPFixReport.txt 2014-12-02 19:04 - 2014-12-02 19:06 - 00086987 _____ () C:\Users\Usuario\Desktop\ZHPDiag.txt 2014-12-02 19:02 - 2014-12-02 19:02 - 00003160 _____ () C:\Windows\System32\Tasks\{4C00E39F-EC56-418C-8BED-28239473F78A} 2014-12-02 18:59 - 2014-12-02 18:59 - 00001987 _____ () C:\Users\Usuario\Desktop\ZHPFix.lnk 2014-12-02 18:59 - 2014-12-02 18:59 - 00001860 _____ () C:\Users\Usuario\Desktop\ZHPDiag.lnk 2014-12-02 18:59 - 2014-12-02 18:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP 2014-12-02 18:59 - 2014-12-02 18:59 - 00000000 ____D () C:\Program Files (x86)\ZHPDiag 2014-12-02 18:57 - 2014-12-02 18:59 - 06866303 _____ (Nicolas Coolman ) C:\ZHPDiag2.exe 2014-12-02 06:33 - 2014-12-02 06:34 - 06866303 _____ (Nicolas Coolman ) C:\Users\Usuario\Downloads\ZHPDiag2.exe 2014-12-01 22:45 - 2014-12-01 22:45 - 00002985 _____ () C:\Users\Usuario\Desktop\HiJackThis.lnk 2014-12-01 22:45 - 2014-12-01 22:45 - 00000000 ____D () C:\Users\Usuario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis 2014-11-27 20:43 - 2014-11-27 20:43 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-11-27 06:40 - 2014-12-02 19:03 - 00000512 _____ () C:\PhysicalDisk0_MBR.bin 2014-11-27 06:39 - 2014-12-03 21:59 - 00000000 ____D () C:\Users\Usuario\AppData\Roaming\ZHP 2014-11-26 21:46 - 2014-11-26 21:46 - 00000000 ____D () C:\Program Files (x86)\Trend Micro 2014-11-26 21:44 - 2014-11-26 21:44 - 01402880 _____ () C:\Users\Usuario\Downloads\HijackThis.msi 2014-11-23 15:25 - 2014-11-24 22:15 - 00000000 ____D () C:\Users\Todos os Usuários\Baidu Security 2014-11-23 15:25 - 2014-11-24 22:15 - 00000000 ____D () C:\ProgramData\Baidu Security 2014-11-23 14:57 - 2014-11-30 00:07 - 00000000 ____D () C:\Users\Usuario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games 2014-11-23 14:52 - 2014-11-30 00:07 - 00000000 ____D () C:\Users\Usuario\AppData\Roaming\Firaxis Games 2014-11-23 14:52 - 2014-11-30 00:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firaxis Games 2014-11-21 17:14 - 2014-11-21 17:14 - 00000000 ____D () C:\Users\Usuário Padrão\AppData\Roaming\TuneUp Software 2014-11-21 17:14 - 2014-11-21 17:14 - 00000000 ____D () C:\Users\Default\AppData\Roaming\TuneUp Software 2014-11-21 17:14 - 2014-11-21 17:14 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\TuneUp Software 2014-11-12 21:14 - 2014-11-12 21:15 - 00000000 ____D () C:\Users\Usuario\AppData\Local\Microsoft Games 2014-12-05 20:02 - 2011-05-16 15:57 - 00342966 _____ () C:\Windows\WindowsUpdate.log 2014-12-05 20:01 - 2011-02-07 06:30 - 00024778 _____ () C:\Windows\setupact.log 2014-12-04 22:42 - 2011-05-16 02:18 - 00009922 _____ () C:\Windows\PFRO.log 2014-12-02 19:28 - 2014-10-21 19:29 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys Task File <==== ATTENTION C:\Users\Usuario\FoxitPhantomPDF615_Standard_L10N.exe C:\Users\Usuario\AppData\Local\Temp\Quarantine.exe C:\Users\Usuario\AppData\Local\Temp\sqlite3.dll emptytemp: end > Execute FRST/FRST64 >> Clique "Fix" << Aguarde! > Na mensagem,clique Executar. > Poste o relatório! (Fixlog.txt) A+ Compartilhar este post Link para o post Compartilhar em outros sites
Ionara 2 Denunciar post Postado Dezembro 7, 2014 Boa noite, segue log... Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 06-12-2014 02 Ran by Usuario at 2014-12-06 23:24:30 Run:1 Running from C:\Users\Usuario\Desktop Loaded Profile: Usuario (Available profiles: Usuario) Boot Mode: Normal ============================================== Content of fixlist: ***************** start CloseProcesses: HKU\S-1-5-21-4088202244-695289871-602143169-1000\...\Run: [Google Update] => C:\Users\Usuario\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-10-21] (Google Inc.) CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION 2014-12-04 22:38 - 2014-12-04 22:41 - 00000000 ____D () C:\AdwCleaner 2014-12-04 22:38 - 2014-12-04 22:38 - 00000055 _____ () C:\AdwCleanerDebug.txt 2014-12-04 22:36 - 2014-12-04 22:37 - 02153472 _____ () C:\Users\Usuario\Desktop\adwcleaner_4.104.exe 2014-12-04 22:34 - 2014-12-04 22:34 - 02153472 _____ () C:\AdwCleaner.exe 2014-12-03 21:59 - 2014-12-03 21:59 - 00001719 _____ () C:\Users\Usuario\Desktop\ZHPFixReport.txt 2014-12-02 19:04 - 2014-12-02 19:06 - 00086987 _____ () C:\Users\Usuario\Desktop\ZHPDiag.txt 2014-12-02 19:02 - 2014-12-02 19:02 - 00003160 _____ () C:\Windows\System32\Tasks\{4C00E39F-EC56-418C-8BED-28239473F78A} 2014-12-02 18:59 - 2014-12-02 18:59 - 00001987 _____ () C:\Users\Usuario\Desktop\ZHPFix.lnk 2014-12-02 18:59 - 2014-12-02 18:59 - 00001860 _____ () C:\Users\Usuario\Desktop\ZHPDiag.lnk 2014-12-02 18:59 - 2014-12-02 18:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP 2014-12-02 18:59 - 2014-12-02 18:59 - 00000000 ____D () C:\Program Files (x86)\ZHPDiag 2014-12-02 18:57 - 2014-12-02 18:59 - 06866303 _____ (Nicolas Coolman ) C:\ZHPDiag2.exe 2014-12-02 06:33 - 2014-12-02 06:34 - 06866303 _____ (Nicolas Coolman ) C:\Users\Usuario\Downloads\ZHPDiag2.exe 2014-12-01 22:45 - 2014-12-01 22:45 - 00002985 _____ () C:\Users\Usuario\Desktop\HiJackThis.lnk 2014-12-01 22:45 - 2014-12-01 22:45 - 00000000 ____D () C:\Users\Usuario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis 2014-11-27 20:43 - 2014-11-27 20:43 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-11-27 06:40 - 2014-12-02 19:03 - 00000512 _____ () C:\PhysicalDisk0_MBR.bin 2014-11-27 06:39 - 2014-12-03 21:59 - 00000000 ____D () C:\Users\Usuario\AppData\Roaming\ZHP 2014-11-26 21:46 - 2014-11-26 21:46 - 00000000 ____D () C:\Program Files (x86)\Trend Micro 2014-11-26 21:44 - 2014-11-26 21:44 - 01402880 _____ () C:\Users\Usuario\Downloads\HijackThis.msi 2014-11-23 15:25 - 2014-11-24 22:15 - 00000000 ____D () C:\Users\Todos os Usuários\Baidu Security 2014-11-23 15:25 - 2014-11-24 22:15 - 00000000 ____D () C:\ProgramData\Baidu Security 2014-11-23 14:57 - 2014-11-30 00:07 - 00000000 ____D () C:\Users\Usuario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games 2014-11-23 14:52 - 2014-11-30 00:07 - 00000000 ____D () C:\Users\Usuario\AppData\Roaming\Firaxis Games 2014-11-23 14:52 - 2014-11-30 00:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firaxis Games 2014-11-21 17:14 - 2014-11-21 17:14 - 00000000 ____D () C:\Users\Usuário Padrão\AppData\Roaming\TuneUp Software 2014-11-21 17:14 - 2014-11-21 17:14 - 00000000 ____D () C:\Users\Default\AppData\Roaming\TuneUp Software 2014-11-21 17:14 - 2014-11-21 17:14 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\TuneUp Software 2014-11-12 21:14 - 2014-11-12 21:15 - 00000000 ____D () C:\Users\Usuario\AppData\Local\Microsoft Games 2014-12-05 20:02 - 2011-05-16 15:57 - 00342966 _____ () C:\Windows\WindowsUpdate.log 2014-12-05 20:01 - 2011-02-07 06:30 - 00024778 _____ () C:\Windows\setupact.log 2014-12-04 22:42 - 2011-05-16 02:18 - 00009922 _____ () C:\Windows\PFRO.log 2014-12-02 19:28 - 2014-10-21 19:29 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys Task File <==== ATTENTION C:\Users\Usuario\FoxitPhantomPDF615_Standard_L10N.exe C:\Users\Usuario\AppData\Local\Temp\Quarantine.exe C:\Users\Usuario\AppData\Local\Temp\sqlite3.dll emptytemp: end ***************** Processes closed successfully. HKU\S-1-5-21-4088202244-695289871-602143169-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Google Update => value deleted successfully. "HKLM\SOFTWARE\Policies\Google" => Key deleted successfully. C:\AdwCleaner => Moved successfully. C:\AdwCleanerDebug.txt => Moved successfully. C:\Users\Usuario\Desktop\adwcleaner_4.104.exe => Moved successfully. C:\AdwCleaner.exe => Moved successfully. C:\Users\Usuario\Desktop\ZHPFixReport.txt => Moved successfully. C:\Users\Usuario\Desktop\ZHPDiag.txt => Moved successfully. C:\Windows\System32\Tasks\{4C00E39F-EC56-418C-8BED-28239473F78A} => Moved successfully. C:\Users\Usuario\Desktop\ZHPFix.lnk => Moved successfully. C:\Users\Usuario\Desktop\ZHPDiag.lnk => Moved successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP => Moved successfully. C:\Program Files (x86)\ZHPDiag => Moved successfully. C:\ZHPDiag2.exe => Moved successfully. C:\Users\Usuario\Downloads\ZHPDiag2.exe => Moved successfully. C:\Users\Usuario\Desktop\HiJackThis.lnk => Moved successfully. C:\Users\Usuario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis => Moved successfully. C:\Program Files (x86)\ESET => Moved successfully. C:\PhysicalDisk0_MBR.bin => Moved successfully. C:\Users\Usuario\AppData\Roaming\ZHP => Moved successfully. C:\Program Files (x86)\Trend Micro => Moved successfully. C:\Users\Usuario\Downloads\HijackThis.msi => Moved successfully. C:\Users\Todos os Usuários\Baidu Security => Moved successfully. "C:\ProgramData\Baidu Security" => File/Directory not found. C:\Users\Usuario\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games => Moved successfully. C:\Users\Usuario\AppData\Roaming\Firaxis Games => Moved successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firaxis Games => Moved successfully. C:\Users\Usuário Padrão\AppData\Roaming\TuneUp Software => Moved successfully. "C:\Users\Default\AppData\Roaming\TuneUp Software" => File/Directory not found. "C:\Users\Default User\AppData\Roaming\TuneUp Software" => File/Directory not found. C:\Users\Usuario\AppData\Local\Microsoft Games => Moved successfully. Could not move "C:\Windows\WindowsUpdate.log" => Scheduled to move on reboot. C:\Windows\setupact.log => Moved successfully. C:\Windows\PFRO.log => Moved successfully. C:\Windows\system32\Drivers\MBAMSwissArmy.sys => Moved successfully. Task File <==== ATTENTION => Error: No automatic fix found for this entry. C:\Users\Usuario\FoxitPhantomPDF615_Standard_L10N.exe => Moved successfully. C:\Users\Usuario\AppData\Local\Temp\Quarantine.exe => Moved successfully. C:\Users\Usuario\AppData\Local\Temp\sqlite3.dll => Moved successfully. EmptyTemp: => Removed 174.8 MB temporary data. => Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-12-06 23:26:04)<= C:\Windows\WindowsUpdate.log => Is moved successfully. ==== End of Fixlog ==== Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Dezembro 7, 2014 Bom Dia! Ionara > Baixe: < AdsFix > ( ... de g3n-h@chm@n ) > Estando na página,clique: > Salve-o no desktop! ( Shortcut_Module.exe ) > Desabilite seu antivírus e execute a ferramenta. > Clique em Nettoyer e aguarde a conclusão! > Ps: Encontrando dificuldades em iniciar a ferramenta,vá em Options e clique WMI. > Ps: Caso apareça a mensagem "Supprimer le proxy",pode confirmar se não o utiliza. > Confirme,também,o reboot! > Poste o relatório! ( C:\AdsFix_data_hora.txt ) A+ Compartilhar este post Link para o post Compartilhar em outros sites
Ionara 2 Denunciar post Postado Dezembro 8, 2014 Segue log... ¤¤¤¤¤¤¤¤¤¤ | AdsFix | g3n-h@ckm@n | 07.12.2014.3 ¤¤¤¤¤ Vista | 7 | 8 | 8.1 - 32/64 bits ¤¤¤¤¤ - Start 23:06:42 - 07/12/2014 Atualizado : 07/12/2014 | 22.10 Por g3n-h@ckm@n™ Contact : http://www.sosvirus.net Assistance : http://www.sosvirus.net/forum-virus-securite.html Feedbacks : http://www.sosvirus.net/feedbacks-t75915.html Facebook : https://www.facebook.com/AdsFix Boot: Normal boot [usuario (Administrator)] - [uSUARIO-PC] - (Brasil [0416]) SID = S-1-5-21-4088202244-695289871-602143169-1000 || [5573756172696f205e5e] PC : MEGAWARE - MW-H61H2-M2 - To be filled by O.E.M. Bios : American Megatrends Inc. - 05/16/2011 Sistema : Windows 7 Home Premium (64 bits) HomePremium Service Pack 1 Memória RAM = Total (MB) : 8293 | Livre (MB) : 6581 Pagefile = Total (MB) : 16585 | Livre (MB) : 14806 Virtual = Total (MB) : 4194 | Livre (MB) : 4012 Registro protegido, restabelecer : : C:\AdsFix\Save\Registry [07.12.2014 @ 23_06_40] (Clique em Opções & Restabeleça o registro) A Restauração de arquivos apagou por engano : Clique em Opções & Restabeleça Arquivos, Selecione um item >> "restaurar" ¤¤¤¤¤¤¤¤¤¤ | Windows atualizado Nenhuma atualização descoberta !!! ¤¤¤¤¤¤¤¤¤¤ | Navegadores IE : 8.0.7601.17514 (© Microsoft Corporation. Todos os direitos reservados.) ¤¤¤¤¤¤¤¤¤¤ | Security (atcav : 0) AM : Malwarebytes' Anti-Malware (1.0.1.711) [] FW : WMI : OK WU: Windows Update Service [Auto(2)] = Ordem AS: Windows Defender [Manual(3)] = Ordem FW: Windows FireWall Service [Auto(2)] = Ordem ¤¤¤¤¤¤¤¤¤¤ | FlashPlayer Plugin : 11.9.900.117 ¤¤¤¤¤¤¤¤¤¤ | Processos mortos 1580 | [Owner : SISTEMA |Parent : 860] - (.Microsoft Corporation - Aplicativo de subsistema de spooler.) - (6.1.7601.17514) = C:\Windows\System32\spoolsv.exe 1768 | [Owner : SISTEMA |Parent : 860] - (.AVG Technologies CZ, s.r.o. - AVG Watchdog Service.) - (15.0.0.5577) = C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe 1788 | [Owner : SISTEMA |Parent : 860] - (.Microsoft Corporation - Updates Skype Click to Call.) - (7.3.16540.9015) = C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe 1852 | [Owner : SERVIÇO DE REDE |Parent : 860] - (.Microsoft Corporation - Phone Number Recognition (PNR) module.) - (7.3.16540.9015) = C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe 2040 | [Owner : SISTEMA |Parent : 860] - (.Nero AG - Nero BackItUp.) - (3.5.3.0) = C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe 1092 | [Owner : Usuario |Parent : 1860] - (.Microsoft Corporation - Windows Explorer.) - (6.1.7601.17514) = C:\Windows\explorer.exe 1640 | [Owner : SISTEMA |Parent : 860] - (.Prolific Technology Inc. - PLFlash DeviceIoControl Service.) - (1.6.0.0) = C:\Windows\SysWOW64\IoctlSvc.exe 2100 | [Owner : SISTEMA |Parent : 860] - (.VIA Technologies, Inc. - Service binary.) - (0.1.0.0) = C:\Windows\System32\ViakaraokeSrv.exe 2528 | [Owner : Usuario |Parent : 1092] - (.Intel Corporation - hkcmd Module.) - (8.15.10.2291) = C:\Windows\System32\hkcmd.exe 2572 | [Owner : Usuario |Parent : 1092] - (.Intel Corporation - persistence Module.) - (8.15.10.2291) = C:\Windows\System32\igfxpers.exe 2640 | [Owner : Usuario |Parent : 1092] - (.Nero AG - Nero Home.) - (3.3.8.0) = C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexStoreSvr.exe 3332 | [Owner : SISTEMA |Parent : 860] - (.Nero AG - Nero Home.) - (3.3.8.0) = C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe 3580 | [Owner : Usuario |Parent : 2792] - (.VIA - VIA HD Audio CPL.) - (9.1.0.32) = C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe 3592 | [Owner : Usuario |Parent : 2792] - (.AVG Technologies CZ, s.r.o. - AVG User Interface.) - (15.0.0.5577) = C:\Program Files (x86)\AVG\AVG2015\avgui.exe 3600 | [Owner : Usuario |Parent : 2792] - (.Oracle Corporation - Java Update Scheduler.) - (2.8.25.18) = C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 3708 | [Owner : SISTEMA |Parent : 860] - (.Microsoft Corporation - Indexador do Microsoft Windows Search.) - (7.0.7600.16385) = C:\Windows\System32\SearchIndexer.exe 3916 | [Owner : Usuario |Parent : 3592] - (.Microsoft Corporation - Carregador CTF.) - (6.1.7600.16385) = C:\Windows\SysWOW64\ctfmon.exe 3120 | [Owner : SERVIÇO DE REDE |Parent : 860] - (.Microsoft Corporation - Serviço de Compartilhamento de Rede do Windows Media Player.) - (12.0.7601.17514) = C:\Program Files\Windows Media Player\wmpnetwk.exe 4608 | [Owner : SISTEMA |Parent : 860] - (.AVG Technologies CZ, s.r.o. - AVG Watchdog Service.) - (15.0.0.5577) = C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe ¤¤¤¤¤¤¤¤¤¤ | Tasks ¤¤¤¤¤¤¤¤¤¤ | Serviços ¤¤¤¤¤¤¤¤¤¤ | AppCertDlls | AppInit_DLLs ¤¤¤¤¤¤¤¤¤¤ | Hosts Hosts : Ok ¤¤¤¤¤¤¤¤¤¤ | SafeBoot ¤¤¤¤¤¤¤¤¤¤ | Winsock ¤¤¤¤¤¤¤¤¤¤ | DNS ¤¤¤¤¤¤¤¤¤¤ | Registro Apagado prosperamente : HKLM\SOFTWARE\Classes\Interface\{34B8AC23-8193-4A70-AD2B-1C255CF9F083} : INMBTVWizardCallback Apagado prosperamente : HKLM\SOFTWARE\Classes\Interface\{4716DA0D-72D4-424C-ACF3-57A08BE0EBB7} : INMBTVWizardHandle Apagado prosperamente : HKLM\SOFTWARE\Classes\Interface\{89A3A2ED-0546-4C60-8159-2D917245BCB3} : IBrowserSecurityManager Apagado prosperamente : HKLM64\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} : alot.dll (String) Apagado prosperamente : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} (CLSID) ¤¤¤¤¤¤¤¤¤¤ | Arquivos Apagado prosperamente : C:\Users\Usuario\AppData\Roaming\unins000.dat (.-.) ¤¤¤¤¤¤¤¤¤¤ | .LNK ¤¤¤¤¤¤¤¤¤¤ | Extensão desconhecida abrindo ¤¤¤¤¤¤¤¤¤¤ | Proxy ¤¤¤¤¤¤¤¤¤¤ | Internet Explorer Consertado : [HKLM64\SOFTWARE\Microsoft\Internet Explorer\Main]~[search Bar] : -> https://www.google.com/ Consertado : [HKLM64\SOFTWARE\Microsoft\Internet Explorer\Main]~[start Default_Page_URL] : -> https://www.google.com/ Consertado : [HKLM64\SOFTWARE\Microsoft\Internet Explorer\Main]~[Local Page] : C:\Windows\System32\blank.htm -> C:\Windows\SysWOW64\blank.htm Consertado : [HKLM64\SOFTWARE\Microsoft\Internet Explorer\SearchURL]~[Default] : -> https://www.google.com/ Consertado : [HKLM64\SOFTWARE\Microsoft\Internet Explorer\Main]~[CustomizeSearch] : -> https://www.google.com/ Consertado : [HKLM64\SOFTWARE\Microsoft\Internet Explorer\Main]~[searchMigratedDefaultName] : -> google.com Consertado : [HKLM64\SOFTWARE\Microsoft\Internet Explorer\Main]~[searchMigratedDefaultURL] : -> https://www.google.com/ Consertado : [HKLM64\SOFTWARE\Microsoft\Internet Explorer\Search]~[searchAssistant] : -> https://www.google.com/ Consertado : [HKLM64\SOFTWARE\Microsoft\Internet Explorer\Search]~[search Bar] : -> https://www.google.com/ Consertado : [HKLM64\SOFTWARE\Microsoft\Internet Explorer\Search]~[start Page] : -> https://www.google.com/ Consertado : [HKLM64\SOFTWARE\Microsoft\Internet Explorer\Search]~[start Default_Page_URL] : -> https://www.google.com/ Consertado : [HKLM64\SOFTWARE\Microsoft\Internet Explorer\Search]~[Local Page] : -> C:\Windows\SysWOW64\blank.htm Consertado : [HKLM64\SOFTWARE\Microsoft\Internet Explorer\Search]~[search Page] : -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch Consertado : [HKLM64\SOFTWARE\Microsoft\Internet Explorer\Search]~[Default_Search_URL] : -> http://go.microsoft.com/fwlink/?LinkId=54896 Consertado : [HKLM64\SOFTWARE\Microsoft\Internet Explorer\Search]~[Default_Page_URL] : -> http://go.microsoft.com/fwlink/?LinkId=69157 Consertado : [HKLM64\SOFTWARE\Microsoft\Internet Explorer\Search]~[CustomizeSearch] : -> https://www.google.com/ Consertado : [HKLM64\SOFTWARE\Microsoft\Internet Explorer\Search]~[searchMigratedDefaultName] : -> google.com Consertado : [HKLM64\SOFTWARE\Microsoft\Internet Explorer\Search]~[searchMigratedDefaultURL] : -> https://www.google.com/ Consertado : [HKLM64\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]~[Tabs] : res://ieframe.dll/tabswelcome.htm -> https://www.google.com/ Consertado : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]~[search Bar] : -> https://www.google.com/ Consertado : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]~[start Default_Page_URL] : -> https://www.google.com/ Consertado : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchURL]~[Default] : -> https://www.google.com/ Consertado : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]~[CustomizeSearch] : -> https://www.google.com/ Consertado : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]~[searchMigratedDefaultName] : -> google.com Consertado : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main]~[searchMigratedDefaultURL] : -> https://www.google.com/ Consertado : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search]~[searchAssistant] : -> https://www.google.com/ Consertado : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search]~[search Bar] : -> https://www.google.com/ Consertado : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search]~[start Page] : -> https://www.google.com/ Consertado : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search]~[start Default_Page_URL] : -> https://www.google.com/ Consertado : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search]~[Local Page] : -> C:\Windows\SysWOW64\blank.htm Consertado : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search]~[search Page] : -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch Consertado : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search]~[Default_Search_URL] : -> http://go.microsoft.com/fwlink/?LinkId=54896 Consertado : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search]~[Default_Page_URL] : -> http://go.microsoft.com/fwlink/?LinkId=69157 Consertado : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search]~[CustomizeSearch] : -> https://www.google.com/ Consertado : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search]~[searchMigratedDefaultName] : -> google.com Consertado : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search]~[searchMigratedDefaultURL] : -> https://www.google.com/ Consertado : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]~[Tabs] : res://ieframe.dll/tabswelcome.htm -> https://www.google.com/ Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\Main]~[search Bar] : -> https://www.google.com/ Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\Main]~[start Default_Page_URL] : -> https://www.google.com/ Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\Main]~[Local Page] : C:\Windows\system32\blank.htm -> C:\Windows\SysWOW64\blank.htm Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\Main]~[Default_Search_URL] : -> http://go.microsoft.com/fwlink/?LinkId=54896 Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\Main]~[Default_Page_URL] : -> http://go.microsoft.com/fwlink/?LinkId=69157 Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\SearchURL]~[Default] : -> https://www.google.com/ Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\Main]~[CustomizeSearch] : -> https://www.google.com/ Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\Main]~[searchMigratedDefaultName] : -> google.com Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\Main]~[searchMigratedDefaultURL] : -> https://www.google.com/ Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\Search]~[searchAssistant] : -> https://www.google.com/ Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\Search]~[search Bar] : -> https://www.google.com/ Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\Search]~[start Page] : -> https://www.google.com/ Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\Search]~[start Default_Page_URL] : -> https://www.google.com/ Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\Search]~[Local Page] : -> C:\Windows\SysWOW64\blank.htm Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\Search]~[search Page] : -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\Search]~[Default_Search_URL] : -> http://go.microsoft.com/fwlink/?LinkId=54896 Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\Search]~[Default_Page_URL] : -> http://go.microsoft.com/fwlink/?LinkId=69157 Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\Search]~[CustomizeSearch] : -> https://www.google.com/ Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\Search]~[searchMigratedDefaultName] : -> google.com Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\Search]~[searchMigratedDefaultURL] : -> https://www.google.com/ Consertado : [HKU\S-1-5-21-4088202244-695289871-602143169-1000\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]~[Tabs] : -> https://www.google.com/ ¤¤¤¤¤¤¤¤¤¤ | Google Chrome Apagado prosperamente : C:\Users\Usuario\AppData\Local\Google\Chrome\User Data\Default\Web Data (.-.) Reponha para zerar prosperamente : SearchURL Apagado prosperamente : C:\Users\Usuario\AppData\Local\Google\Chrome\User Data\Default\Preferences (.-.) Impossível reajuste : Preferences C:\Users\Usuario\AppData\Local\Google\Chrome\User Data\Default\extensions\nmmhkkegccagdldgiimedpiccmgmieda = : Google & co - Google & co - 203784468217.apps.googleusercontent.com - https://clients2.google.com/service/update2/crx ¤¤¤¤¤¤¤¤¤¤ | Chromium ¤¤¤¤¤¤¤¤¤¤ | Comodo Dragon ¤¤¤¤¤¤¤¤¤¤ | Firefox ¤¤¤¤¤¤¤¤¤¤ | SeaMonkey ¤¤¤¤¤¤¤¤¤¤ | Pale moon ¤¤¤¤¤¤¤¤¤¤ | Opera ¤¤¤¤¤¤¤¤¤¤ | Spark ¤¤¤¤¤¤¤¤¤¤ | StartMenuInternet ¤¤¤¤¤¤¤¤¤¤ | Javascript ¤¤¤¤¤¤¤¤¤¤ | Firewall ¤¤¤¤¤¤¤¤¤¤ | Arquivos temporários [All Users] Arquivos temporários Apagado : 0 Ko [Default] Arquivos temporários Apagado : 0 Ko [Default User] Arquivos temporários Apagado : 0 Ko [Public] Arquivos temporários Apagado : 0 Ko [Todos os Usuários] Arquivos temporários Apagado : 0 Ko [usuario] Arquivos temporários Apagado : 0 Ko [usuário Padrão] Arquivos temporários Apagado : 0 Ko [C:\Windows\Temp] Arquivos temporários Apagado : 0 Ko [C:\Temp] Arquivos temporários Apagado : 0 Ko Outros relatórios C:\AdsFix_07_12_2014_23_04_54.txt[1438 o] ¤¤¤¤¤¤¤¤¤¤ | Listing ¤¤¤¤¤¤¤¤¤¤ | C:\Program Files (x86) [16/05/2011 16:26:29] - |D| - C:\Program Files (x86)\Adobe [21/10/2014 16:14:43] - |D| - C:\Program Files (x86)\AVG [14/07/2009 01:20:08] - |D| - C:\Program Files (x86)\Common Files [14/07/2009 02:54:24] - |ASH| - C:\Program Files (x86)\desktop.ini [11/11/2014 22:36:55] - |D| - C:\Program Files (x86)\Foxit Software [26/11/2014 20:48:03] - |D| - C:\Program Files (x86)\GbPlugin [21/10/2014 12:34:55] - |HD| - C:\Program Files (x86)\InstallShield Installation Information [21/10/2014 12:28:32] - |D| - C:\Program Files (x86)\Intel [14/07/2009 01:20:08] - |D| - C:\Program Files (x86)\Internet Explorer [05/11/2014 21:26:41] - |D| - C:\Program Files (x86)\Java [21/10/2014 19:29:46] - |D| - C:\Program Files (x86)\Malwarebytes Anti-Malware [16/05/2011 17:04:29] - |D| - C:\Program Files (x86)\Microsoft Office [16/05/2011 17:06:12] - |D| - C:\Program Files (x86)\Microsoft Visual Studio [16/05/2011 17:04:52] - |D| - C:\Program Files (x86)\Microsoft Visual Studio 8 [16/05/2011 17:06:25] - |D| - C:\Program Files (x86)\Microsoft Works [16/05/2011 17:06:04] - |D| - C:\Program Files (x86)\Microsoft.NET [14/07/2009 03:32:38] - |D| - C:\Program Files (x86)\MSBuild [16/05/2011 16:37:08] - |D| - C:\Program Files (x86)\Nero [23/11/2014 15:07:08] - |D| - C:\Program Files (x86)\NJax [21/10/2014 20:48:45] - |D| - C:\Program Files (x86)\RaidCall.BR [14/07/2009 03:32:38] - |D| - C:\Program Files (x86)\Reference Assemblies [21/10/2014 16:12:03] - |RD| - C:\Program Files (x86)\Skype [05/11/2014 21:11:52] - |D| - C:\Program Files (x86)\Trusteer [14/07/2009 02:57:06] - |HD| - C:\Program Files (x86)\Uninstall Information [21/10/2014 12:35:25] - |D| - C:\Program Files (x86)\VIA [14/07/2009 03:32:38] - |D| - C:\Program Files (x86)\Windows Defender [14/07/2009 01:20:08] - |D| - C:\Program Files (x86)\Windows Mail [14/07/2009 03:32:38] - |D| - C:\Program Files (x86)\Windows Media Player [14/07/2009 01:20:08] - |D| - C:\Program Files (x86)\Windows NT [14/07/2009 03:32:38] - |D| - C:\Program Files (x86)\Windows Photo Viewer [14/07/2009 03:32:38] - |D| - C:\Program Files (x86)\Windows Portable Devices [14/07/2009 03:32:38] - |D| - C:\Program Files (x86)\Windows Sidebar [16/05/2011 16:09:28] - |D| - C:\Program Files (x86)\WinRAR [16/05/2011 16:09:40] - |D| - C:\Program Files (x86)\XP Codec Pack ¤¤¤¤¤¤¤¤¤¤ | C:\Program Files [16/05/2011 15:53:12] - |SHD| - C:\Program Files\Arquivos Comuns [14/07/2009 01:20:08] - |D| - C:\Program Files\Common Files [14/07/2009 02:54:24] - |ASH| - C:\Program Files\desktop.ini [14/07/2009 03:32:38] - |D| - C:\Program Files\DVD Maker [14/07/2009 01:20:08] - |D| - C:\Program Files\Internet Explorer [14/07/2009 03:32:38] - |D| - C:\Program Files\Microsoft Games [16/05/2011 17:04:55] - |D| - C:\Program Files\Microsoft Office [14/07/2009 03:32:38] - |D| - C:\Program Files\MSBuild [14/07/2009 03:32:38] - |D| - C:\Program Files\Reference Assemblies [14/07/2009 03:09:26] - |HD| - C:\Program Files\Uninstall Information [16/11/2014 21:51:56] - |D| - C:\Program Files\VS Revo Group [14/07/2009 03:32:38] - |D| - C:\Program Files\Windows Defender [05/02/2011 12:41:56] - |D| - C:\Program Files\Windows Journal [14/07/2009 01:20:08] - |D| - C:\Program Files\Windows Mail [14/07/2009 03:32:38] - |D| - C:\Program Files\Windows Media Player [14/07/2009 01:20:08] - |D| - C:\Program Files\Windows NT [14/07/2009 03:32:38] - |D| - C:\Program Files\Windows Photo Viewer [14/07/2009 03:32:38] - |D| - C:\Program Files\Windows Portable Devices [14/07/2009 03:32:38] - |D| - C:\Program Files\Windows Sidebar ¤¤¤¤¤¤¤¤¤¤ | C:\Program Files (x86)\Common Files [16/05/2011 16:26:29] - |D| - C:\Program Files (x86)\Common Files\Adobe [16/05/2011 17:06:12] - |D| - C:\Program Files (x86)\Common Files\DESIGNER [21/10/2014 12:35:14] - |D| - C:\Program Files (x86)\Common Files\InstallShield [21/10/2014 12:39:06] - |D| - C:\Program Files (x86)\Common Files\Intel [16/11/2014 21:34:27] - |D| - C:\Program Files (x86)\Common Files\Java [14/07/2009 01:20:08] - |D| - C:\Program Files (x86)\Common Files\microsoft shared [16/05/2011 16:37:08] - |D| - C:\Program Files (x86)\Common Files\Nero [14/07/2009 01:20:08] - |D| - C:\Program Files (x86)\Common Files\Services [21/10/2014 16:12:03] - |D| - C:\Program Files (x86)\Common Files\Skype [14/07/2009 01:20:08] - |D| - C:\Program Files (x86)\Common Files\SpeechEngines [14/07/2009 01:20:08] - |D| - C:\Program Files (x86)\Common Files\System ¤¤¤¤¤¤¤¤¤¤ | C:\Program Files\Common Files [21/10/2014 12:39:06] - |D| - C:\Program Files\Common Files\Intel [14/07/2009 01:20:08] - |D| - C:\Program Files\Common Files\Microsoft Shared [14/07/2009 01:20:08] - |D| - C:\Program Files\Common Files\Services [16/05/2011 15:53:12] - |SHD| - C:\Program Files\Common Files\Sistema [14/07/2009 01:20:08] - |D| - C:\Program Files\Common Files\SpeechEngines [14/07/2009 01:20:08] - |D| - C:\Program Files\Common Files\System ¤¤¤¤¤¤¤¤¤¤ | C:\Users\Usuario\AppData\Roaming [22/10/2014 21:33:01] - |D| - C:\Users\Usuario\AppData\Roaming\Adobe [21/10/2014 16:15:53] - |D| - C:\Users\Usuario\AppData\Roaming\AVG2015 [11/11/2014 22:37:42] - |D| - C:\Users\Usuario\AppData\Roaming\Foxit Software [16/05/2011 15:55:38] - |D| - C:\Users\Usuario\AppData\Roaming\Identities [23/11/2014 14:52:55] - |D| - C:\Users\Usuario\AppData\Roaming\InstallShield Installation Information [16/05/2011 15:55:24] - |D| - C:\Users\Usuario\AppData\Roaming\Media Center Programs [16/05/2011 15:55:24] - |SD| - C:\Users\Usuario\AppData\Roaming\Microsoft [21/10/2014 20:49:06] - |D| - C:\Users\Usuario\AppData\Roaming\raidcall [21/10/2014 16:12:06] - |D| - C:\Users\Usuario\AppData\Roaming\Skype [21/10/2014 16:15:09] - |D| - C:\Users\Usuario\AppData\Roaming\TuneUp Software [21/10/2014 12:20:31] - |D| - C:\Users\Usuario\AppData\Roaming\WinRAR ¤¤¤¤¤¤¤¤¤¤ | C:\Users\Usuario\AppData\Local [22/10/2014 21:33:01] - |D| - C:\Users\Usuario\AppData\Local\Adobe [16/05/2011 17:03:36] - |D| - C:\Users\Usuario\AppData\Local\Ahead [21/10/2014 16:12:09] - |D| - C:\Users\Usuario\AppData\Local\Avg2015 [16/05/2011 15:55:25] - |SHD| - C:\Users\Usuario\AppData\Local\Dados de aplicativos [26/11/2014 20:31:20] - |D| - C:\Users\Usuario\AppData\Local\GAS Tecnologia [21/10/2014 16:07:09] - |A| - C:\Users\Usuario\AppData\Local\GDIPFONTCACHEV1.DAT [20/11/2014 12:04:47] - |D| - C:\Users\Usuario\AppData\Local\Glyph [16/05/2011 16:09:13] - |D| - C:\Users\Usuario\AppData\Local\Google [16/05/2011 15:55:25] - |SHD| - C:\Users\Usuario\AppData\Local\Histórico [03/12/2014 22:46:07] - |AH| - C:\Users\Usuario\AppData\Local\IconCache.db [21/10/2014 16:12:09] - |D| - C:\Users\Usuario\AppData\Local\MFAData [16/05/2011 15:55:24] - |D| - C:\Users\Usuario\AppData\Local\Microsoft [07/12/2014 22:40:07] - |D| - C:\Users\Usuario\AppData\Local\Microsoft Games [16/05/2011 17:04:30] - |D| - C:\Users\Usuario\AppData\Local\Microsoft Help [21/10/2014 19:29:26] - |D| - C:\Users\Usuario\AppData\Local\Programs [21/10/2014 16:12:13] - |D| - C:\Users\Usuario\AppData\Local\Skype [16/05/2011 15:55:24] - |D| - C:\Users\Usuario\AppData\Local\Temp [16/05/2011 15:55:25] - |SHD| - C:\Users\Usuario\AppData\Local\Temporary Internet Files [05/11/2014 21:11:53] - |D| - C:\Users\Usuario\AppData\Local\Trusteer [16/05/2011 15:55:35] - |D| - C:\Users\Usuario\AppData\Local\VirtualStore [16/11/2014 21:52:02] - |D| - C:\Users\Usuario\AppData\Local\VS Revo Group ¤¤¤¤¤¤¤¤¤¤ | C:\ProgramData [11/11/2014 22:42:46] - |D| - C:\ProgramData\ABBYY [16/05/2011 16:26:29] - |D| - C:\ProgramData\Adobe [14/07/2009 03:08:56] - |SHD| - C:\ProgramData\Application Data [21/10/2014 16:14:57] - |D| - C:\ProgramData\AVG2015 [23/11/2014 16:01:18] - |A| - C:\ProgramData\bc.ini [21/10/2014 16:12:09] - |HD| - C:\ProgramData\Common Files [16/05/2011 15:53:11] - |SHD| - C:\ProgramData\Dados de aplicativos [14/07/2009 03:08:56] - |SHD| - C:\ProgramData\Desktop [16/05/2011 15:53:11] - |SHD| - C:\ProgramData\Documentos [14/07/2009 03:08:56] - |SHD| - C:\ProgramData\Documents [14/07/2009 03:08:56] - |SHD| - C:\ProgramData\Favorites [16/05/2011 15:53:11] - |SHD| - C:\ProgramData\Favoritos [26/11/2014 20:31:20] - |D| - C:\ProgramData\GAS Tecnologia [26/11/2014 20:48:03] - |D| - C:\ProgramData\GbPlugin [20/11/2014 12:04:47] - |D| - C:\ProgramData\Glyph [21/10/2014 19:29:46] - |D| - C:\ProgramData\Malwarebytes [16/05/2011 15:53:11] - |SHD| - C:\ProgramData\Menu Iniciar [21/10/2014 16:12:09] - |D| - C:\ProgramData\MFAData [14/07/2009 01:20:08] - |SD| - C:\ProgramData\Microsoft [16/05/2011 17:04:29] - |D| - C:\ProgramData\Microsoft Help [16/05/2011 15:53:11] - |SHD| - C:\ProgramData\Modelos [16/05/2011 16:37:08] - |D| - C:\ProgramData\Nero [05/11/2014 21:26:43] - |D| - C:\ProgramData\Oracle [11/11/2014 22:36:09] - |D| - C:\ProgramData\Package Cache [21/10/2014 16:12:00] - |D| - C:\ProgramData\Skype [14/07/2009 03:08:56] - |SHD| - C:\ProgramData\Start Menu [05/11/2014 21:27:05] - |D| - C:\ProgramData\Sun [14/07/2009 03:08:56] - |SHD| - C:\ProgramData\Templates [05/11/2014 21:04:45] - |D| - C:\ProgramData\Trusteer [16/11/2014 21:51:58] - |D| - C:\ProgramData\VS Revo Group ¤¤¤¤¤¤¤¤¤¤ | C:\Windows\Tasks [21/10/2014 19:31:17] - |A| - C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000Core.job [21/10/2014 19:31:18] - |A| - C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4088202244-695289871-602143169-1000UA.job [14/07/2009 03:08:49] - |AH| - C:\Windows\Tasks\SA.DAT [14/07/2009 03:08:49] - |A| - C:\Windows\Tasks\SCHEDLGU.TXT ¤¤¤¤¤¤¤¤¤¤ | C:\Windows\System32\Tasks [14/07/2009 01:20:14] - |D| - C:\Windows\System32\Tasks\Microsoft Analisados : 114292 | Modificados : 58 | Infetado : 9 ¤¤¤¤¤¤¤¤¤¤ |EOF| ¤¤¤¤¤¤¤¤¤¤ | 02:43:48 | [25 Ko] Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Dezembro 8, 2014 /!\ Bom Dia! Ionara /!\ > Caso não haja mais problemas,remova as ferramentas que foram utilizadas na desinfecção! > Baixe: < > ( ... de Xplode ) > Estando na página,clique em Download Now. > Salve-a em um local conveniente! ( desktop! ) > Feche aplicativos que estejam abertos. > Remover ferramentas de desinfecção > Criar backup do registro > Limpar pontos da restauração do sistema > Com estas caixinhas marcadas,clique Executar! > Reinicie o computador ao concluir! > Tudo Ok? A+ Compartilhar este post Link para o post Compartilhar em outros sites
Ionara 2 Denunciar post Postado Dezembro 8, 2014 Boa tarde, tudo Ok! Obrigada! Compartilhar este post Link para o post Compartilhar em outros sites
DigRam 144 Denunciar post Postado Dezembro 8, 2014 PROBLEMA RESOLVIDO Caso o autor necessite que o tópico seja reaberto basta enviar uma Mensagem Privada para um Moderador com um link para o tópico. Compartilhar este post Link para o post Compartilhar em outros sites
