[Resolvido] Notebook lento pra iniciar

Flávio Marquim · Maio 15, 2015

Bom dia

Meu notebook está lento pra iniciar. Além disso, semana passada o Firefox estava abrindo umas coisas esquisitas sozinho. Essa semana, o windows não terminou de fazer uma atualização. Tive de pressionar o botão de power por 3 segundos e depois retirar a bateria por 5 segundos aí voltou ao normal. Diante disso, creio q eu possa estar infectado.

Segue abaixo meu logo do Hijackthis:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 10:55:03, on 15/05/2015

Platform: Windows 7 SP1 (WinNT 6.00.3505)

MSIE: Internet Explorer v11.0 (11.00.9600.17801)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe

C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE

C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE

C:\Program Files (x86)\Google\Drive\googledrivesync.exe

C:\Users\Flávio\AppData\Local\Microsoft\OneDrive\OneDrive.exe

C:\PROGRA~2\GbPlugin\GbpSv.exe

C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe

C:\Program Files (x86)\Google\Drive\googledrivesync.exe

C:\ProgramData\b56dff5a-df23-4e43-acde-a4f08b8dcffb\plugins\3\plugin.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\HijackThis\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/5

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYBTU&co=BR&userid=1ced1898-290f-bda7-6356-c5be9b21597a&searchtype=ds&q={searchTerms}&installDate=30/10/2013

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYBTU&co=BR&userid=1ced1898-290f-bda7-6356-c5be9b21597a&searchtype=ds&q={searchTerms}&installDate=30/10/2013

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com.br/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYBTU&co=BR&userid=1ced1898-290f-bda7-6356-c5be9b21597a&searchtype=ds&q={searchTerms}&installDate=30/10/2013

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYBTU&co=BR&userid=1ced1898-290f-bda7-6356-c5be9b21597a&searchtype=ds&q={searchTerms}&installDate=30/10/2013

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=userinit.exe

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

O2 - BHO: IESpeakDoc - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll

O2 - BHO: Auxiliar de Conexão do Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL

O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\PROGRAM FILES (X86)\GBPLUGIN\gbieh.dll

O2 - BHO: Dragon Branch - {d640ce67-58e4-43c2-9adc-6bb959d7c606} - C:\Program Files (x86)\Dragon Branch\Extensions\d640ce67-58e4-43c2-9adc-6bb959d7c606.dll (file missing)

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

O3 - Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - (no file)

O4 - HKLM\..\Run: [Dell Registration] C:\Program Files (x86)\System Registration\prodreg.exe /boot

O4 - HKCU\..\Run: [DellSystemDetect] C:\Users\Flávio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell\Dell System Detect.appref-ms

O4 - HKCU\..\Run: [GoogleDriveSync] "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart

O4 - HKCU\..\Run: [OneDrive] "C:\Users\Flávio\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background

O4 - HKCU\..\RunOnce: [uninstall C:\Users\Flávio\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512_1\amd64] C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Flávio\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512_1\amd64"

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO LOCAL')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIÇO LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO DE REDE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIÇO DE REDE')

O4 - Startup: EvernoteClipper.lnk = C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe

O8 - Extra context menu item: Capturar esta página - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=1

O8 - Extra context menu item: Capturar favorito - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=0

O8 - Extra context menu item: Capturar imagem - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=4

O8 - Extra context menu item: Capturar seleção - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=3

O8 - Extra context menu item: Capturar URL - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=0

O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office14\EXCEL.EXE/3000

O8 - Extra context menu item: Nova nota - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\NewNote.html

O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: (no name) - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll

O9 - Extra 'Tools' menuitem: Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll

O9 - Extra button: @C:\Program Files (x86)\Evernote\Evernote\OLIEResource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\AddNote.html

O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Evernote\Evernote\OLIEResource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\AddNote.html

O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O15 - Trusted Zone: www.bancobrasil.com.br

O15 - Trusted Zone: www14.bancobrasil.com.br

O15 - Trusted Zone: www2.bancobrasil.com.br

O15 - Trusted Zone: www.bb.com.br

O15 - Trusted Zone: http://www.bb.com.br

O15 - Trusted Zone: *.dell.com

O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab

O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} (Creative Software AutoUpdate Support Package 2) - http://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab

O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O20 - Winlogon Notify: GbPluginBb - C:\Program Files (x86)\GbPlugin\gbieh.dll

O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Program Files\IDT\WDM\AESTSr64.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: Atheros Bt&Wlan Coex Agent - Atheros - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\Ath_CoexAgent.exe

O23 - Service: AtherosSvc - Atheros Commnucations - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe

O23 - Service: Serviço Área de trabalho remota do Google Chrome (chromoting) - Google Inc. - C:\Program Files (x86)\Google\Chrome Remote Desktop\42.0.2311.39\remoting_host.exe

O23 - Service: Intel® Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: Gbp Service (GbpSv) - GAS Tecnologia - C:\PROGRA~2\GbPlugin\GbpSv.exe

O23 - Service: Serviço do Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Motorola Device Manager Service (Motorola Device Manager) - Motorola Mobility LLC - C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Corel License Validation Service V2 x64, Powered by arvato (PSI_SVC_2_x64) - arvato digital services llc - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

O23 - Service: PST Service - Motorola - C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe

O23 - Service: RoxMediaDB12OEM - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe

O23 - Service: Roxio Hard Drive Watcher 12 (RoxWatch12) - Sonic Solutions - C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: ScsiAccess - Unknown owner - C:\Program Files (x86)\Photodex\ProShowProducer\ScsiAccess.exe

O23 - Service: Service Mgr DragonBranch - Unknown owner - C:\ProgramData\b56dff5a-df23-4e43-acde-a4f08b8dcffb\plugincontainer.exe

O23 - Service: SoftThinks Agent Service (SftService) - SoftThinks SAS - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE

O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: Sony PC Companion - Avanquest Software - C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\stlang64.dll,-10102 (STacSV) - IDT, Inc. - C:\Program Files\IDT\WDM\STacSV64.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: Update Mgr DragonBranch - Unknown owner - C:\Program Files (x86)\Common Files\b56dff5a-df23-4e43-acde-a4f08b8dcffb\updater.exe

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: Warsaw Technology - GAS Tecnologia LTDA - C:\Program Files\Diebold\Warsaw\core.exe

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 15225 bytes

Power Max · Maio 15, 2015

Olá Flávio.

Baixe o programa Adwcleaner clicando no link abaixo e depois clique no botão Download Now @BleepingComputer:

http://www.bleepingcomputer.com/download/adwcleaner/

Para executar corretamente o AdwCleaner é só seguir as dicas deste tutorial:

Remova adwares e toolbars maliciosas com o Adwcleaner

* Na sua próxima resposta poste o log (relatório) do Adwcleaner que estará em C:\AdwCleaner\AdwCleaner[s0].txt

Ficamos na espera.

Flávio Marquim · Maio 15, 2015

Boa tarde

Segue o log:

# AdwCleaner v4.204 - Relatório criado 15/05/2015 às 13:59:12

# Atualizado 12/05/2015 por Xplode

# Base de dados : 2015-05-12.2 [servidor]

# Sistema operacional : Windows 7 Home Basic Service Pack 1 (x64)

# Usuário : Flávio - FLÁVIO-PC

# Executando de : C:\Users\Flávio\Desktop\adwcleaner_4.204.exe

# Opção : Limpar

***** [ Serviços ] *****

[#] Serviço Excluído : Update Mgr DragonBranch

[#] Serviço Excluído : Service Mgr DragonBranch

***** [ Arquivos / Pastas ] *****

Pasta Excluído : C:\ProgramData\b56dff5a-df23-4e43-acde-a4f08b8dcffb

Pasta Excluído : C:\Program Files (x86)\Dragon Branch

Pasta Excluído : C:\Program Files (x86)\Common Files\b56dff5a-df23-4e43-acde-a4f08b8dcffb

Pasta Excluído : C:\Users\Flávio\AppData\Roaming\OpenCandy

Pasta Excluído : C:\Users\Flávio\AppData\Roaming\UpdaterEX

Arquivo Excluído : C:\Users\FLVIO~1\AppData\Local\Temp\nwhb-v9.4.15.crx

Arquivo Excluído : C:\Users\Flávio\AppData\Local\nwhb-v9.4.15.crx

Arquivo Excluído : C:\Users\Flávio\AppData\Roaming\Mozilla\Firefox\Profiles\9hxcj7r2.default\searchplugins\Web Search.xml

Arquivo Excluído : C:\Users\Flávio\AppData\Roaming\Mozilla\Firefox\Profiles\9hxcj7r2.default\user.js

***** [ Tarefas agendadas ] *****

Tarefa Apagado : UpdaterEX

***** [ Atalhos ] *****

***** [ Registro ] *****

Chave Apagado : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}

Chave Apagado : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Chave Apagado : HKLM\SOFTWARE\Classes\CLSID\{B853E835-9F24-4F4B-B55C-E554D15CCCD2}

Chave Apagado : HKLM\SOFTWARE\Classes\CLSID\{F83D1872-D9FF-47F8-B5A0-49CC51E24EE8}

Valor Apagado : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

Chave Apagado : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Valor Apagado : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

Chave Apagado : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Chave Apagado : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{49606DC7-976D-4030-A74E-9FB5C842FA68}

Chave Apagado : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}

Chave Apagado : HKCU\Software\InstallCore

Chave Apagado : HKCU\Software\UpdaterEX

Chave Apagado : HKCU\Software\AppDataLow\Software\lyrixeeker

Chave Apagado : HKLM\SOFTWARE\yuna software

Chave Apagado : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UpdaterEX

Chave Apagado : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{cfd32d46-7d3f-483f-bace-7172aec5592d}

Chave Apagado : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964

Chave Apagado : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467

***** [ Navegadores ] *****

-\\ Internet Explorer v11.0.9600.17801

Configuração Restaurado : HKCU\Software\Microsoft\Internet Explorer\Main [search Page]

Configuração Restaurado : HKCU\Software\Microsoft\Internet Explorer\Main [search Bar]

Configuração Restaurado : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]

Configuração Restaurado : HKCU\Software\Microsoft\Internet Explorer\Search [searchAssistant]

Configuração Restaurado : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]

Configuração Restaurado : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]

-\\ Mozilla Firefox v37.0.2 (x86 pt-BR)

[9hxcj7r2.default\prefs.js] - Linha Apagado : user_pref("keyword.URL", "hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYBTU&co=BR&userid=1ced1898-290f-bda7-6356-c5be9b21597a&searchtype=ds&installDate=30/10/2013&q=");

-\\ Google Chrome v42.0.2311.152

[C:\Users\Flávio\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Apagado [search Provider] : hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYBTU&co=BR&userid=1ced1898-290f-bda7-6356-c5be9b21597a&searchtype=ds&q={searchTerms}&installDate=30/10/2013

[C:\Users\Flávio\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Apagado [search Provider] : hxxp://br.ask.com/web?q={searchTerms}

[C:\Users\Flávio\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Apagado [search Provider] : hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYBTU&co=BR&userid=1ced1898-290f-bda7-6356-c5be9b21597a&searchtype=ds&q={searchTerms}&installDate=30/10/2013

[C:\Users\Flávio\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Apagado [Extension] : aoejbmmillcdifgagjpdlaamnalbielp

[C:\Users\Flávio\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Apagado [Default_Search_Provider_Data] : hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYBTU&co=BR&userid=1ced1898-290f-bda7-6356-c5be9b21597a&searchtype=ds&q={searchTerms}&installDate=30/10/2013

*************************

AdwCleaner[R0].txt - [6624 bytes] - [15/05/2015 13:57:13]

AdwCleaner[s0].txt - [5094 bytes] - [15/05/2015 13:59:12]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [5153 bytes] ##########

Power Max · Maio 15, 2015

Baixe o programa Junkware Removal Tool no link abaixo:

http://thisisudax.org/downloads/JRT.exe

Para executar corretamente o programa acima é só seguir as dicas deste tutorial:

Tutorial do Junkware Removal Tool

* Na sua próxima resposta poste o log (relatório) do Junkware Removal Tool que estará salvo em sua área de trabalho com o nome de JRT.txt

Ficamos na espera.

Flávio Marquim · Maio 16, 2015

Boa tarde

Segue o log, conforme pedido.

Fico no aguardo de novas instruções e obrigado.

Flávio

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.7.2 (05.15.2015:1)

OS: Windows 7 Home Basic x64

Ran by Fl vio on 16/05/2015 at 16:57:50,87

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Tasks

Successfully deleted: [Task] C:\Windows\system32\tasks\PCDoctorBackgroundMonitorTask

Successfully deleted: [Task] C:\Windows\tasks\PCDoctorBackgroundMonitorTask.job

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{d640ce67-58e4-43c2-9adc-6bb959d7c606}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d640ce67-58e4-43c2-9adc-6bb959d7c606}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{d640ce67-58e4-43c2-9adc-6bb959d7c606}

~~~ Files

~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Fl vio\appdata\local\{744B6AA4-A525-4643-A04F-3438207E3AF0}

Successfully deleted: [Empty Folder] C:\Users\Fl vio\appdata\local\{9A4BEE0A-D158-498C-AEE5-F4C0CDF12462}

Successfully deleted: [Empty Folder] C:\Users\Fl vio\appdata\local\{C07C8840-0BBA-4851-AFCC-0465CEB7FD85}

Successfully deleted: [Folder] C:\ProgramData\pcdr

~~~ FireFox

Emptied folder: C:\Users\Fl vio\AppData\Roaming\mozilla\firefox\profiles\9hxcj7r2.default\minidumps [15 files]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 16/05/2015 at 17:00:43,68

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Power Max · Maio 16, 2015

Desative temporariamente seu antivírus para evitar conflitos.

* Acesse este link abaixo e clique no primeiro botão da esquerda que é o botão Download Zoek.exe:

http://www.hijackthis.nl/smeenk/

Salve-o no Desktop (Área de Trabalho).

Para executá-lo corretamente siga as dicas deste tutorial:

Exclua adwares e outras ameaças de seu PC e browsers com o aplicativo Zoek

* Assim que ele concluir a limpeza dos problemas acesse o log (relatório) do Zoek que estará em C:\zoek-results.txt e copie todo seu conteúdo e poste em sua próxima resposta.

Flávio Marquim · Maio 17, 2015

Bom dia

Segue o log.

Flávio

Zoek.exe v5.0.0.0 Updated 04-May-2015

Tool run by Fl vio on 17/05/2015 at 0:20:55,86.

Microsoft Windows 7 Home Basic 6.1.7601 Service Pack 1 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\FLVIO~1\Desktop\zoek.exe [scan all users] [script inserted]

==== System Restore Info ======================

17/05/2015 00:23:16 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

#

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

#

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

# space.

#

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a '#' symbol.

#

# For example:

#

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.

127.0.0.1 localhost

::1 localhost

==== Empty Folders Check ======================

C:\PROGRA~2\MarkAny deleted successfully

C:\PROGRA~2\Samsung deleted successfully

C:\PROGRA~2\Winnydows deleted successfully

C:\PROGRA~2\Wondershare deleted successfully

C:\Users\FLVIO~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\First PDF deleted successfully

C:\Users\FLVIO~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\VobSub deleted successfully

C:\PROGRA~3\CorelDRAW Graphics Suite X7 x64 deleted successfully

C:\Windows\serviceprofiles\networkservice\AppData\\LocalLow deleted successfully

C:\Windows\serviceprofiles\Localservice\AppData\\LocalLow deleted successfully

C:\Users\FLVIO~1\AppData\Local\Samsung deleted successfully

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== FireFox Fix ======================

Deleted from C:\Users\FLVIO~1\AppData\Roaming\Mozilla\Firefox\Profiles\9hxcj7r2.default\prefs.js:

user_pref("browser.startup.homepage", "https://www.google.com.br/");

user_pref("browser.newtab.url", "about:blank");

Added to C:\Users\FLVIO~1\AppData\Roaming\Mozilla\Firefox\Profiles\9hxcj7r2.default\prefs.js:

user_pref("browser.startup.homepage", "about:home");

user_pref("browser.newtab.url", "about:newtab");

==== Deleting Files \ Folders ======================

C:\PROGRA~2\MarkAny not found

C:\PROGRA~2\Samsung not found

C:\PROGRA~2\Winnydows not found

C:\PROGRA~2\Wondershare not found

C:\PROGRA~3\CorelDRAW Graphics Suite X7 x64 not found

C:\Users\FLVIO~1\.android deleted

C:\PROGRA~2\COMMON~1\Wondershare deleted

C:\PROGRA~3\Package Cache deleted

C:\Users\FLVIO~1\AppData\Local\Wondershare deleted

C:\Windows\SysNative\config\systemprofile\Searches deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\FLVIO~1\AppData\Roaming\Mozilla\Firefox\Profiles\9hxcj7r2.default

user_pref("browser.startup.homepage", "about:home");

user_pref("browser.newtab.url", "about:newtab");

==== Firefox Extensions Registry ======================

[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]

"{87F8774F-B485-47E2-A755-A40A8A5E886C}"="C:\Users\Fl vio\AppData\Local\GAS Tecnologia\GBBD\bb\xpi" [28/03/2015 12:46]

==== Firefox Extensions ======================

ProfilePath: C:\Users\FLVIO~1\AppData\Roaming\Mozilla\Firefox\Profiles\9hxcj7r2.default

- Undetermined - C:\Users\FlÃ¡vio\AppData\Local\GAS Tecnologia\GBBD\bb\xpi

AppDir: C:\Program Files (x86)\Mozilla Firefox

- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

==== Chromium Look ======================

Google Chrome Version: 42.0.2311.152

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions

lmjegmlicamnimmfhcmpkclmigmmcbeh - No path found[]

Google Docs - FLVIO~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake

Google Drive - FLVIO~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf

YouTube - FLVIO~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo

Google Search - FLVIO~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf

Bookmark Manager - FLVIO~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik

CHROME;360;liebao - FLVIO~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\knngjajhgkigjgiblkjjfoenpkcokngl

Chrome Hotword Shared Module - FLVIO~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg

Facebook Album Photo Manager - FLVIO~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgiedegfmekolcplboelnmfoiefpcpfg

GBBD Banco do Brasil - FLVIO~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkeabchhfifpaaoefpockjhaphjmoapp

Google Wallet - FLVIO~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

Gmail - FLVIO~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

Google Slides - FLVIO~1\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek

Google Docs - FLVIO~1\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake

Google Drive - FLVIO~1\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf

YouTube - FLVIO~1\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo

Google Search - FLVIO~1\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf

Google Sheets - FLVIO~1\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap

Google Drive App Launcher - FLVIO~1\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh

Google Wallet - FLVIO~1\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

Gmail - FLVIO~1\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== Chromium Startpages ======================

C:\Users\FLVIO~1\AppData\Local\Google\Chrome\User Data\Default\Preferences

"homepage": "http://www.google.com.br/",

"startup_urls": [ "https://www.google.com.br/" ]

==== Set IE to Default ======================

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="https://www.google.com.br/"

"Search Page"="http://www.google.com"

"Search Bar"="http://www.google.com"

"Use Search Asst"="yes"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]

"Default"="http://www.google.com"

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]

"Default"="http://www.google.com"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]

"Default"="http://www.google.com"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]

"Default_Search_URL"="http://www.google.com"

"SearchAssistant"="http://www.google.com"

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"

"Search Bar"="http://go.microsoft.com/fwlink/?LinkId=54896"

"Start Page"="https://www.google.com.br/"

"Use Search Asst"="no"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl]

"(Default)"="http://search.msn.com/results.asp?q=%s"

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchUrl]

"(Default)"="http://search.msn.com/results.asp?q=%s"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]

"(Default)"="http://search.msn.com/results.asp?q=%s"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search]

"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"

"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"

==== Reset Google Chrome ======================

C:\Users\FLVIO~1\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully

C:\Users\FLVIO~1\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully

C:\Users\FLVIO~1\AppData\Local\Google\Chrome\User Data\Profile 1\Preferences was reset successfully

C:\Users\FLVIO~1\AppData\Local\Google\Chrome\User Data\Profile 1\Secure Preferences was reset successfully

C:\Users\FLVIO~1\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

C:\Users\FLVIO~1\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully

C:\Users\FLVIO~1\AppData\Local\Google\Chrome\User Data\Default\Web Data.temp was reset successfully

C:\Users\FLVIO~1\AppData\Local\Google\Chrome\User Data\Profile 1\Web Data was reset successfully

C:\Users\FLVIO~1\AppData\Local\Google\Chrome\User Data\Profile 1\Web Data-journal was reset successfully

==== shortcuts on Users Desktops ======================

C:\Users\FLVIO~1\Desktop\HiJackThis.lnk - C:\Users\Flávio\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

C:\Users\FLVIO~1\Desktop\Programas\Ares.lnk - C:\Program Files (x86)\Ares\Ares.exe

C:\Users\FLVIO~1\Desktop\Programas\Ashampoo Burning Studio 2013.lnk - C:\Program Files (x86)\Ashampoo\Ashampoo Burning Studio 2013\burningstudio2013.exe

C:\Users\FLVIO~1\Desktop\Programas\CCleaner.lnk - C:\Program Files\CCleaner\CCleaner64.exe

C:\Users\FLVIO~1\Desktop\Programas\Evernote.lnk - C:\Program Files (x86)\Evernote\Evernote\Evernote.exe

C:\Users\FLVIO~1\Desktop\Programas\First PDF.lnk - C:\Program Files (x86)\First PDF\First PDF.exe

C:\Users\FLVIO~1\Desktop\Programas\Freemake Video Converter.lnk - C:\Program Files (x86)\Freemake\Freemake Video Converter\FreemakeVideoConverter.exe

C:\Users\FLVIO~1\Desktop\Programas\JDownloader 2.lnk - C:\Users\Flávio\AppData\Local\JDownloader v2.0\JDownloader2.exe

C:\Users\FLVIO~1\Desktop\Programas\PhotoScape.lnk - C:\Program Files (x86)\PhotoScape\PhotoScape.exe

C:\Users\FLVIO~1\Desktop\Programas\Popcorn-Time.lnk - C:\Program Files (x86)\Time4Popcorn\Popcorn Time\Popcorn-Time.exe

C:\Users\FLVIO~1\Desktop\Programas\ProShow Producer.lnk - C:\Program Files (x86)\Photodex\ProShowProducer\proshow.exe

C:\Users\FLVIO~1\Desktop\Programas\Sony PC Companion 2.1.lnk - C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe

C:\Users\FLVIO~1\Desktop\Programas\Subtitle Workshop.lnk - C:\Program Files (x86)\URUSoft\Subtitle Workshop\SubtitleWorkshop.exe

C:\Users\FLVIO~1\Desktop\Programas\VLC media player.lnk - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe

C:\Users\FLVIO~1\Desktop\Programas\Corel Draw X7\Bitstream Font Navigator (64-Bit).lnk - C:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X7\FontNav64\FontNav.exe

C:\Users\FLVIO~1\Desktop\Programas\Corel Draw X7\Corel CAPTURE X7 (64-Bit).lnk - c:\Windows\Installer\{2C91CB9D-323D-43E5-A433-229B71CFB773}\NewShortcut8_65BCA6E0337A452DA55C0654EAAD7A0B.exe

C:\Users\FLVIO~1\Desktop\Programas\Corel Draw X7\Corel CONNECT X7 (64-Bit).lnk - C:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X7\Connect64\Connect.exe

C:\Users\FLVIO~1\Desktop\Programas\Corel Draw X7\Corel PHOTO-PAINT X7 (64-Bit).lnk - c:\Windows\Installer\{C922F325-DD52-4E22-B204-431A06E63E51}\NewShortcut2_EBB51BFEE10948A888CB7ADF96E8EC80.exe

C:\Users\FLVIO~1\Desktop\Programas\Corel Draw X7\CorelDRAW X7 (64-Bit).lnk - c:\Windows\Installer\{2C0DDC74-5234-43DD-BB5A-0645B8FE5289}\NewShortcut1_68427AB8B2C044C58AA777A4C3F75634.exe

C:\Users\FLVIO~1\Desktop\Programas\Google\Google Docs.lnk - C:\Program Files (x86)\Google\Drive\googledrivesync.exe --new_document

C:\Users\FLVIO~1\Desktop\Programas\Google\Google Drive.lnk - C:\Users\Flávio\Google Drive

C:\Users\FLVIO~1\Desktop\Programas\Google\Google Sheets.lnk - C:\Program Files (x86)\Google\Drive\googledrivesync.exe --new_spreadsheet

C:\Users\FLVIO~1\Desktop\Programas\Google\Google Slides.lnk - C:\Program Files (x86)\Google\Drive\googledrivesync.exe --new_presentation

==== shortcuts in Users Start Menu ======================

C:\Users\Flávio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk -

C:\Users\Flávio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis\HiJackThis.lnk -

C:\Users\Flávio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Programas RFB2015\IRPF - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País\Ajuda do IRPF2015.lnk -

C:\Users\Flávio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Programas RFB2015\IRPF - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País\Desinstalar IRPF2015.lnk -

C:\Users\Flávio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Programas RFB2015\IRPF - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País\IRPF2015 - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País.lnk -

C:\Users\Flávio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Programas RFB2015\IRPF - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País\Leia-me do IRPF2015.lnk -

C:\Users\Flávio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk -