boot muito lento.

# AdwCleaner v3.014 - Relatório criado 09/12/2013 às 09:52:16
# Atualizado 01/12/2013 por Xplode
# Sistema Operacional : Windows 7 Home Premium Service Pack 1 (64 bits)
# Usuário : walber - HP
# Executando de : C:\Users\walber\Desktop\adwcleaner.exe
# Opção : Limpar

***** [ Serviços ] *****

[#] Serviço Deletada : dealplylive
[#] Serviço Deletada : dealplylivem
[#] Serviço Deletada : Update BuzzSearch
[#] Serviço Deletada : Util BuzzSearch

***** [ Arquivos / Pastas ] *****

Pasta Deletada : C:\ProgramData\baidu
Pasta Deletada : C:\ProgramData\boost_interprocess
[!] Pasta Deletada : C:\ProgramData\DealPlyLive
Pasta Deletada : C:\Program Files (x86)\BuzzSearch
Pasta Deletada : C:\Program Files (x86)\DealPly
[!] Pasta Deletada : C:\Program Files (x86)\DealPlyLive
Pasta Deletada : C:\Program Files (x86)\NCH Software
Pasta Deletada : C:\Program Files (x86)\Softonic
Pasta Deletada : C:\Users\walber\AppData\Local\DealPlyLive
Pasta Deletada : C:\Users\walber\AppData\Local\FilesFrog Update Checker
Pasta Deletada : C:\Users\walber\AppData\Local\lollipop
Pasta Deletada : C:\Users\walber\AppData\Local\Pokki
Pasta Deletada : C:\Users\walber\AppData\Local\Temp\Iminent
Pasta Deletada : C:\Users\walber\AppData\LocalLow\Softonic
Pasta Deletada : C:\Users\walber\AppData\Roaming\baidu
Pasta Deletada : C:\Users\walber\AppData\Roaming\DealPly
Pasta Deletada : C:\Users\walber\AppData\Roaming\NCH Software
Pasta Deletada : C:\Users\walber\AppData\Roaming\OpenCandy
Pasta Deletada : C:\Users\walber\AppData\Roaming\Softonic
Pasta Deletada : C:\Users\walber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DealPly
Pasta Deletada : C:\Users\walber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FilesFrog Update Checker
Pasta Deletada : C:\Users\walber\AppData\Roaming\Mozilla\Firefox\Profiles\s9mgw4oz.default\Extensions\{906000A4-88D9-4D52-B209-7A772970D91F}
Pasta Deletada : C:\Users\walber\AppData\Local\Google\Chrome\User Data\Default\Extensions\elchiiiejkobdbblfejjkbphbddgmljf
Pasta Deletada : C:\Users\walber\AppData\Local\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf
Arquivo Deletada : C:\Users\walber\AppData\Roaming\Mozilla\Firefox\Profiles\s9mgw4oz.default\searchplugins\softonic.xml
Arquivo Deletada : C:\Users\walber\AppData\Roaming\Mozilla\Firefox\Profiles\s9mgw4oz.default\user.js
Arquivo Deletada : C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job
Arquivo Deletada : C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineCore
Arquivo Deletada : C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
Arquivo Deletada : C:\Windows\System32\Tasks\DealPlyLiveUpdateTaskMachineUA

***** [ Atalhos ] *****


***** [ Registro ] *****

Valor Deletedo : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]
Chave Deletedo : HKLM\SOFTWARE\Google\Chrome\Extensions\elchiiiejkobdbblfejjkbphbddgmljf
Chave Deletedo : HKCU\Software\Classes\pokki
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\dealplylive.exe
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL
Chave Deletedo : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickCtrl.9
Chave Deletedo : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickProcessLauncherMachine
Chave Deletedo : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickProcessLauncherMachine.1.0
Chave Deletedo : HKLM\SOFTWARE\Classes\DealPlyLive.Update3WebControl.3
Chave Deletedo : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoCreateAsync
Chave Deletedo : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoCreateAsync.1.0
Chave Deletedo : HKLM\SOFTWARE\Classes\dealplyliveupdate.coreclass
Chave Deletedo : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreClass.1
Chave Deletedo : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreMachineClass
Chave Deletedo : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreMachineClass.1
Chave Deletedo : HKLM\SOFTWARE\Classes\dealplyliveupdate.credentialdialogmachine
Chave Deletedo : HKLM\SOFTWARE\Classes\dealplyliveupdate.credentialdialogmachine.1.0
Chave Deletedo : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclassmachine
Chave Deletedo : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachine.1.0
Chave Deletedo : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclassmachinefallback
Chave Deletedo : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclassmachinefallback.1.0
Chave Deletedo : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassSvc
Chave Deletedo : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclasssvc.1.0
Chave Deletedo : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.ProcessLauncher
Chave Deletedo : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.ProcessLauncher.1.0
Chave Deletedo : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService
Chave Deletedo : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService.1.0
Chave Deletedo : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachine
Chave Deletedo : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachine.1.0
Chave Deletedo : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachinefallback
Chave Deletedo : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachinefallback.1.0
Chave Deletedo : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3websvc
Chave Deletedo : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3websvc.1.0
Chave Deletedo : HKLM\SOFTWARE\Classes\escort.escortIEPane
Chave Deletedo : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Chave Deletedo : HKLM\SOFTWARE\Classes\S
Chave Deletedo : HKLM\SOFTWARE\Classes\Softonic.dskBnd
Chave Deletedo : HKLM\SOFTWARE\Classes\Softonic.dskBnd.1
Chave Deletedo : HKLM\SOFTWARE\Classes\Softonic.SoftonicHlpr
Chave Deletedo : HKLM\SOFTWARE\Classes\Softonic.SoftonicHlpr.1
Chave Deletedo : HKLM\SOFTWARE\Classes\SoftonicApp.appCore
Chave Deletedo : HKLM\SOFTWARE\Classes\SoftonicApp.appCore.1
Chave Deletedo : HKLM\SOFTWARE\Classes\srv.SoftonicSrvc
Chave Deletedo : HKLM\SOFTWARE\Classes\srv.SoftonicSrvc.1
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dealplylive.exe
Chave Deletedo : HKLM\SOFTWARE\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=3
Chave Deletedo : HKLM\SOFTWARE\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=9
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{80FABB17-63AF-4655-9F07-B6509EE37AF2}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{B15F118E-AF21-45E8-A809-29FDD7362565}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\{F48FC5B2-094A-44C7-B48C-289738C9582D}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{0D89DE71-3D99-4288-84DC-F18F1047A7D8}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{1E0C9B2A-6447-452C-B012-2314A0C29412}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{34A8CEB6-89BB-49F1-B5E4-0D0D6C21F3B1}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{3A4DBD3A-98CC-41CE-AD21-352D42B6F754}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{44B50C01-4993-48E2-ADEE-D812BAE2E9A2}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{4F8A50F6-69DE-4BE3-A33A-A1079B9AC0DB}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{501CB57A-D4E2-4855-96AD-EDB0A9083395}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{5CF5A690-C8F4-488E-9D20-F21AEF602D41}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{6FF2C4DD-77A4-4BB5-BA4C-B42DEFBF9137}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{80FABB17-63AF-4655-9F07-B6509EE37AF2}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{83ABA270-8390-4CA6-AE48-FC089F55629E}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{8B218A5F-1A3D-4347-94EF-A79575EB8094}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{9BDB5E09-4BBA-4422-8C2B-529B281C32B8}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{A3E2F089-DDBB-4CBF-B06C-5D44DA316ED3}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{A5679AB0-C59E-49E7-83C4-5289F844A6E0}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{AE48ED75-5A56-4C5F-BBCE-6F1AC3875F66}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{C536F080-57B7-46D6-8894-C647553F2889}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{CA0167C2-6295-41B8-9BDA-704B2F5E4CD9}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{CA5D945F-E738-4D0B-A0B5-25AC51C64659}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{F48FC5B2-094A-44C7-B48C-289738C9582D}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{F7698761-4ABA-45C2-A5BB-D2163922C725}
Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID\{FFCC53E6-2655-47FC-A89B-54E8D7F305D1}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{D0EC4142-5808-41D2-A4DC-6081CF1A9693}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}
Chave Deletedo : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib\{11D9E165-B8C1-4734-A56C-BC4FCACA966B}
Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib\{396ECD31-EDF7-489F-BDA1-83DBA4C36E81}
Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib\{B15F118E-AF21-45E8-A809-29FDD7362565}
Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CF5A690-C8F4-488E-9D20-F21AEF602D41}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE48ED75-5A56-4C5F-BBCE-6F1AC3875F66}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5CF5A690-C8F4-488E-9D20-F21AEF602D41}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE48ED75-5A56-4C5F-BBCE-6F1AC3875F66}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5CF5A690-C8F4-488E-9D20-F21AEF602D41}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE48ED75-5A56-4C5F-BBCE-6F1AC3875F66}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9CF034EA-7B46-48D3-8895-8A14B32AE445}
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C536F080-57B7-46D6-8894-C647553F2889}
Valor Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{5018CFD2-804D-4C99-9F81-25EAEA2769DE}]
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\CLSID\{A75BE48D-BF58-4A8B-B96C-F9A09DFB9844}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{D0EC4142-5808-41D2-A4DC-6081CF1A9693}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}
Chave Deletedo : [x64] HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Chave Deletedo : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Chave Deletedo : HKCU\Software\BuzzSearch
Chave Deletedo : HKCU\Software\DealPly
Chave Deletedo : HKCU\Software\DealPlyLive
Chave Deletedo : HKCU\Software\InstallCore
Chave Deletedo : HKCU\Software\lollipop
Chave Deletedo : HKCU\Software\NCH Software
Chave Deletedo : HKCU\Software\Softonic
Chave Deletedo : HKCU\Software\Somoto
Chave Deletedo : HKCU\Software\UpdaterEX
Chave Deletedo : HKLM\Software\BuzzSearch
Chave Deletedo : HKLM\Software\DealPly
Chave Deletedo : HKLM\Software\DealPlyLive
Chave Deletedo : HKLM\Software\DeviceVM
Chave Deletedo : HKLM\Software\Iminent
Chave Deletedo : HKLM\Software\NCH Software
Chave Deletedo : HKLM\Software\Softonic
Chave Deletedo : HKLM\Software\Uniblue
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FilesFrog Update Checker
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Iminent
Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Softonic
Chave Deletedo : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BuzzSearch
Chave Deletedo : HKLM\Software\Classes\Installer\Products\9EC6D81181F59F2459A84176A626F9ED

***** [ Navegadores ] *****

-\\ Internet Explorer v11.0.9600.16428

Configurações Restauradas : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Configurações Restauradas : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs]

-\\ Mozilla Firefox v25.0.1 (pt-BR)

[ Arquivo : C:\Users\walber\AppData\Roaming\Mozilla\Firefox\Profiles\s9mgw4oz.default\prefs.js ]

Linha deletada : user_pref("extensions.Softonic.admin", false);
Linha deletada : user_pref("extensions.Softonic.aflt", "OC");
Linha deletada : user_pref("extensions.Softonic.appId", "{7ABBFE1C-E485-44AA-8F36-353751B4124D}");
Linha deletada : user_pref("extensions.Softonic.autoRvrt", "false");
Linha deletada : user_pref("extensions.Softonic.dfltLng", "");
Linha deletada : user_pref("extensions.Softonic.dfltSrch", true);
Linha deletada : user_pref("extensions.Softonic.dnsErr", true);
Linha deletada : user_pref("extensions.Softonic.excTlbr", false);
Linha deletada : user_pref("extensions.Softonic.ffxUnstlRst", false);
Linha deletada : user_pref("extensions.Softonic.hmpg", true);
Linha deletada : user_pref("extensions.Softonic.hmpgUrl", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=13&cc=&mi=405a2036000000000000f07bcb9547c8");
Linha deletada : user_pref("extensions.Softonic.id", "405a2036000000000000f07bcb9547c8");
Linha deletada : user_pref("extensions.Softonic.instlDay", "16043");
Linha deletada : user_pref("extensions.Softonic.instlRef", "MOY00621");
Linha deletada : user_pref("extensions.Softonic.newTab", true);
Linha deletada : user_pref("extensions.Softonic.newTabUrl", "hxxp://search.softonic.com/MOY00621/tb_v1/?SearchSource=15&cc=&mi=405a2036000000000000f07bcb9547c8");
Linha deletada : user_pref("extensions.Softonic.prdct", "Softonic");
Linha deletada : user_pref("extensions.Softonic.prtnrId", "softonic");
Linha deletada : user_pref("extensions.Softonic.rvrt", "false");
Linha deletada : user_pref("extensions.Softonic.smplGrp", "none");
Linha deletada : user_pref("extensions.Softonic.srchPrvdr", "Search the web (Softonic)");
Linha deletada : user_pref("extensions.Softonic.tlbrId", "opencandy2013");
Linha deletada : user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=1&cc=&mi=405a2036000000000000f07bcb9547c8&q=");
Linha deletada : user_pref("extensions.Softonic.vrsn", "1.8.21.14");
Linha deletada : user_pref("extensions.Softonic.vrsnTs", "1.8.21.1423:46:47");
Linha deletada : user_pref("extensions.Softonic.vrsni", "1.8.21.14");

-\\ Google Chrome v31.0.1650.63

[ Arquivo : C:\Users\walber\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deletedo : urls_to_restore_on_startup

*************************

AdwCleaner[R0].txt - [22608 octets] - [09/12/2013 09:49:26]
AdwCleaner[S0].txt - [21337 octets] - [09/12/2013 09:52:16]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [21398 octets] ##########

Log ZHPDiag [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Home Premium x64
Ran by walber on 09/12/2013 at 10:21:13,11
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\baidu
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\baidu
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\dealplylive
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{1AD8031B-2597-45F3-990E-8BC8CE14AB13}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"



~~~ FireFox

Successfully deleted: [Folder] C:\Users\walber\AppData\Roaming\mozilla\firefox\profiles\s9mgw4oz.default\extensions\staged
Successfully deleted the following from C:\Users\walber\AppData\Roaming\mozilla\firefox\profiles\s9mgw4oz.default\prefs.js

user_pref("extensions.firefox@mybuzzsearch.com.install-event-fired", true);
Emptied folder: C:\Users\walber\AppData\Roaming\mozilla\firefox\profiles\s9mgw4oz.default\minidumps [9 files]



~~~ Chrome

Successfully deleted: [Folder] C:\Users\walber\appdata\local\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09/12/2013 at 10:37:22,25
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Bom Dia! Edvan

|- Execute este script na ferramenta ZHPFix.

script zhpfix
C:\Users\walber\AppData\Local\Google\Chrome\User Data\Default\Extensions\jjkpdhdihflbbjmlnnbphkcohajpekje   =>Adware.AddLyrics^
C:\Users\walber\AppData\Local\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf   =>PUP.DealPly^
C:\Program Files (x86)\Baidu Security   =>Adware.BDSearch^
C:\ProgramData\Baidu Security   =>Adware.BDSearch^
C:\Users\walber\AppData\Roaming\Baidu Security   =>Adware.BDSearch^
C:\ProgramData\FileSplitUpLoad.dll   =>Adware.BDSearch^
C:\Users\walber\AppData\Local\Temp\1_Offer_6.exe   =>Adware.PlusHD^
C:\Users\walber\AppData\Local\Temp\Baidu_Secure_SystemUp_3.7.1.41942.exe   =>Adware.BDSearch^
C:\Users\walber\AppData\Local\Temp\BeamriseSetup.exe   =>Hijacker.Beamrise^
C:\Users\walber\AppData\Local\Temp\FLVPlayerSetup.exe   =>Adware.MegaSearch^
C:\Users\walber\AppData\Local\Temp\PC_Faster_Setup_Mini_B25_S.exe   =>Adware.BDSearch^
C:\Users\walber\AppData\Local\Temp\UpdateCheckerSetup.exe   =>Adware.MegaSearch^
[HKCU\Software\Baidu Security] =>Adware.BDSearch
[HKLM\Software\Wow6432Node\Baidu Security] =>Adware.BDSearch
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] NoActiveDesktopChanges: Modified
[HKCU\Software\Baidu Security]   =>Adware.BDSearch^
[HKLM\Software\Wow6432Node\Baidu Security]   =>Adware.BDSearch^
[HKLM\Software\Google\Chrome\Extensions\jjkpdhdihflbbjmlnnbphkcohajpekje]   =>Adware.AddLyrics^
[HKLM\Software\Google\Chrome\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf]   =>PUP.DealPly^
[HKLM\Software\Classes\Installer\Products\9EC6D81181F59F2459A84176A626F9ED]   =>Adware.IMBooster
[HKLM\Software\Wow6432Node\Classes\Installer\Products\9EC6D81181F59F2459A84176A626F9ED]   =>Adware.IMBooster
[MD5.00000000000000000000000000000000] [APT] [SomotoUpdateCheckerAutoStart] (...) -- C:\Users\walber\AppData\Local\FilesFrog Update Checker\update_checker.exe (.not file.)   [0]  =>Adware.MegaSearch
[MD5.23B961E1466AD64AA615761B303EA475] [SPRF][22/10/2013] (.Baidu, Inc. - Baidu Antivirus FileSplitUpLoad Library.) -- C:\ProgramData\FileSplitUpLoad.dll   [170344]  =>Adware.BDSearch
[MD5.C0033AE3B1FC4148A6759DA4F8A1356A] [SPRF][01/12/2013] (...) -- C:\Users\walber\AppData\Local\Temp\1_Offer_10.exe   [10381]
[MD5.078082E5E92D17591F49E344919CA71F] [SPRF][01/12/2013] (.Plus-HD - Plus-HD.) -- C:\Users\walber\AppData\Local\Temp\1_Offer_6.exe   [5228097]  =>Adware.PlusHD
[MD5.66C59A018E191D71F1AFF7D64EC9DD5A] [SPRF][07/12/2013] (.Baidu, Inc. - PC Faster Setup.) -- C:\Users\walber\AppData\Local\Temp\Baidu_Secure_SystemUp_3.7.1.41942.exe   [10485488]  =>Adware.BDSearch
[MD5.26F0BF722C99A7F06EC277C577F5C0CE] [SPRF][07/12/2013] (.Beamrise - Beamrise bootstrapper.) -- C:\Users\walber\AppData\Local\Temp\BeamriseSetup.exe   [918856]  =>Hijacker.Beamrise
[MD5.E5C6D4490EE574FDF795470F1428E26C] [SPRF][27/11/2013] (.@ - setup file.) -- C:\Users\walber\AppData\Local\Temp\DownloadManager.exe   [1338136]
[MD5.2D10A980CC1539C4CA29387E82267B4D] [SPRF][07/12/2013] (.Somoto Ltd. - FLV Player.) -- C:\Users\walber\AppData\Local\Temp\FLVPlayerSetup.exe   [279752]  =>Adware.MegaSearch
[MD5.9047C955DBB78A08942BE8B1A3D232AD] [SPRF][07/12/2013] (.Baidu Inc. - Baidu PC Faster MiniSetup.) -- C:\Users\walber\AppData\Local\Temp\PC_Faster_Setup_Mini_B25_S.exe   [1440168]  =>Adware.BDSearch
[MD5.28FC891FBC5BBBB31667417AB87D8D17] [SPRF][01/12/2013] (...) -- C:\Users\walber\AppData\Local\Temp\Quarantine.exe   [355227]
[MD5.EF7D1863F4980AB0C8BDA142FEE67F92] [SPRF][07/12/2013] (.Somoto Ltd. - FilesFrog Update Checker.) -- C:\Users\walber\AppData\Local\Temp\UpdateCheckerSetup.exe   [200072]  =>Adware.MegaSearch
G2 - GCE: Preference [User Data\Default] [jjkpdhdihflbbjmlnnbphkcohajpekje] LyricsBuddy-2 v.1.25.17, (Désactivé) =>Adware.AddLyrics
G2 - GCE: Preference [User Data\Default] [mphpbdjcljebbcnfopfngmfdackbbdgf] DealPly  Shopping v.3.5.0.0 (Activé) =>PUP.DealPly
O4 - GS\Desktop [Public]: Google Chrome.lnk . (.Google Inc. - Google Chrome.)  -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Hijacker.Browsers
O4 - GS\TaskBar [walber]: Google Chrome.lnk . (.Google Inc. - Google Chrome.)  -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Hijacker.Browsers
O4 - GS\TaskBar [walber]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.)  -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Hijacker.Browsers
O41 - Driver:  (Bfilter) . (.Baidu, Inc. - Baidu Antivirus Minifilter Driver.) - C:\Windows\system32\drivers\Bfilter.sys =>Adware.BDSearch
O41 - Driver:  (Bfmon) . (.Baidu, Inc. - Baidu FS Monitor Driver.) - C:\Windows\system32\drivers\Bfmon.sys =>Adware.BDSearch
O41 - Driver:  (Bprotect) . (.Baidu, Inc. - Baidu Antivirus Selfprotect Driver.) - C:\Windows\system32\drivers\Bprotect.sys =>Adware.BDSearch
O43 - CFD: 06/12/2013 - 20:56:09 - [1,487] ----D C:\Program Files (x86)\Baidu Security =>Adware.BDSearch
O43 - CFD: 30/11/2013 - 11:07:20 - [79,297] ----D C:\ProgramData\Baidu Security =>Adware.BDSearch
O43 - CFD: 09/12/2013 - 12:09:57 - [0,063] ----D C:\ProgramData\boost_interprocess
O43 - CFD: 30/11/2013 - 11:07:30 - [2,773] ----D C:\Users\walber\AppData\Roaming\Baidu Security =>Adware.BDSearch
O44 - LFC:[MD5.13A2519AA829149C5092527D8229DDF6] - 06/12/2013 - 19:57:55 ---A- . (.Baidu, Inc. - Baidu Antivirus Minifilter Driver.) -- C:\Windows\System32\Drivers\Bfilter.sys   [50496]  =>Adware.BDSearch
O44 - LFC:[MD5.E39E7AD46221F2490E4D59BF0679B7EE] - 06/12/2013 - 19:58:04 ---A- . (.Baidu, Inc. - Baidu FS Monitor Driver.) -- C:\Windows\System32\Drivers\Bfmon.sys   [32576]  =>Adware.BDSearch
O44 - LFC:[MD5.D15D4484B415FDD45087D46162BD3B82] - 06/12/2013 - 19:58:19 ---A- . (.Baidu, Inc. - Baidu Antivirus Selfprotect Driver.) -- C:\Windows\System32\Drivers\Bprotect.sys   [106624]  =>Adware.BDSearch
O58 - SDL:[MD5.13A2519AA829149C5092527D8229DDF6] - 12/08/2013 - 16:17:22 ---A- . (.Baidu, Inc. - Baidu Antivirus Minifilter Driver.) -- C:\Windows\System32\Drivers\Bfilter.sys   [50496]  =>Adware.BDSearch
O58 - SDL:[MD5.E39E7AD46221F2490E4D59BF0679B7EE] - 12/08/2013 - 16:17:22 ---A- . (.Baidu, Inc. - Baidu FS Monitor Driver.) -- C:\Windows\System32\Drivers\Bfmon.sys   [32576]  =>Adware.BDSearch
O58 - SDL:[MD5.D15D4484B415FDD45087D46162BD3B82] - 20/08/2013 - 03:10:52 ---A- . (.Baidu, Inc. - Baidu Antivirus Selfprotect Driver.) -- C:\Windows\System32\Drivers\Bprotect.sys   [106624]  =>Adware.BDSearch
O64 - Services: CurCS - 12/08/2013 - C:\Windows\system32\drivers\Bfilter.sys (Bfilter)  .(.Baidu, Inc. - Baidu Antivirus Minifilter Driver.) - LEGACY_BFILTER =>Adware.BDSearch
O64 - Services: CurCS - 12/08/2013 - C:\Windows\system32\drivers\Bfmon.sys (Bfmon)  .(.Baidu, Inc. - Baidu FS Monitor Driver.) - LEGACY_BFMON =>Adware.BDSearch
O64 - Services: CurCS - 20/08/2013 - C:\Windows\system32\drivers\Bprotect.sys (Bprotect)  .(.Baidu, Inc. - Baidu Antivirus Selfprotect Driver.) - LEGACY_BPROTECT =>Adware.BDSearch
O68 - StartMenuInternet: <Beamrise.3KK7JGLNHEIKO6L6XKX63LZWRY> <Beamrise>[HKLM\..\Shell\open\Command] (...) -- C:\Users\walber\AppData\Local\Beamrise\Application\beamrise.exe (.not file.) =>Hijacker.Beamrise
emptytemp
firewallraz
emptyclsid

|- Poste o relatório!

Abs!

Novo Log [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

a maquina passou um tempo em uso com o usuário, por isso vou postar um log novo.


Rapport de ZHPFix 2013.12.6.4 par Nicolas Coolman, Update du 06/12/2013
Fichier d'export Registre :
Run by walber at 16/12/2013 09:37:01
High Elevated Privileges : OK
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)

Reciclagem vazia (00mn 03s)

========== Modulos memória ==========
ELIMINÉ: Memory Module: C:\ProgramData\FileSplitUpLoad.dll

========== Estado dos serviços ==========
BFILTER Parado
BFMON Parado
BPROTECT Parado

========== Chaves do Registo ==========
ELIMINÉ: HKCU\Software\Baidu Security
ELIMINÉ: HKLM\Software\Wow6432Node\Baidu Security
ELIMINÉ:³ HKLM\Software\Classes\Installer\Products\9EC6D81181F59F2459A84176A626F9ED
ELIMINÉ:³ HKLM\Software\Wow6432Node\Classes\Installer\Products\9EC6D81181F59F2459A84176A626F9ED
ELIMINÉ Driver Key: Bfilter
ELIMINÉ Driver Key: Bfmon
ELIMINÉ Driver Key: Bprotect

========== Valores do Registo ==========
Ausente Valor Perfil Padrão: FirewallRaz :
Ausente Valor Perfil Domínio FirewallRaz :

========== Elementos dos dados do Registo ==========
SUBSTITUI Value NoActiveDesktopChanges :   Good (0) - Bad (1)
ELIMINÉ: StartMenuInternet: C:\Users\walber\AppData\Local\Beamrise\Application\beamrise.exe

========== Pastas ==========
Nenhuma pasta CLSID local utilizador vazia

========== Ficheiros ==========
ELIMINÉ: c:\users\walber\appdata\local\google\chrome\user data\default\preferences
ELIMINÉ: c:\users\public\desktop\google chrome.lnk (http://br.hao123.com)
CRIADO: C:\Users\Public\Desktop\Google Chrome.lnk
ELIMINÉ: c:\users\walber\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk (http://br.hao123.com)
CRIADO: C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
ELIMINÉ: c:\users\walber\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\mozilla firefox.lnk (http://br.hao123.com)
CRIADO: C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk
ELIMINA REINICIAR: c:\windows\system32\drivers\bfilter.sys
ELIMINA REINICIAR: c:\windows\system32\drivers\bfmon.sys
ELIMINA REINICIAR: c:\windows\system32\drivers\bprotect.sys
ELIMINÉ Temporários windows (24) (15.831.129 octets)

========== Tarefa planificada ==========
ELIMINÉ: SomotoUpdateCheckerAutoStart


========== Recapitulativo ==========
1 : Modulos memória
7 : Chaves do Registo
2 : Valores do Registo
2 : Elementos dos dados do Registo
1 : Pastas
11 : Ficheiros
3 : Estado dos serviços
1 : Tarefa planificada


End of clean in 00mn 18s

========== Caminho do ficheiro do relatório ==========
C:\Users\walber\AppData\Roaming\ZHP\ZHPFix[R1].txt - 16/12/2013 09:37:05 [2692]

Boa Tarde! Edvan

|- Execute este script na ferramenta ZHPFix.

script zhpfix
O3 - Toolbar: (no name) [64Bits] - [HKLM]{318A227B-5E9F-45bd-8999-7F8F10CA4CF5} Chave orfã
O4 - GS\Desktop [Public]: Mozilla Firefox.lnk . (.Mozilla Corporation - Firefox.)  -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] =>Hijacker.Browsers
O43 - CFD: 16/12/2013 - 09:37:25 - [0,063] ----D C:\ProgramData\boost_interprocess
O44 - LFC:[MD5.13A2519AA829149C5092527D8229DDF6] - 06/12/2013 - 19:57:55 ---A- . (.Baidu, Inc. - Baidu Antivirus Minifilter Driver.) -- C:\Windows\System32\Drivers\Bfilter.sys   [50496]  =>Adware.BDSearch
O44 - LFC:[MD5.E39E7AD46221F2490E4D59BF0679B7EE] - 06/12/2013 - 19:58:04 ---A- . (.Baidu, Inc. - Baidu FS Monitor Driver.) -- C:\Windows\System32\Drivers\Bfmon.sys   [32576]  =>Adware.BDSearch
O44 - LFC:[MD5.D15D4484B415FDD45087D46162BD3B82] - 06/12/2013 - 19:58:19 ---A- . (.Baidu, Inc. - Baidu Antivirus Selfprotect Driver.) -- C:\Windows\System32\Drivers\Bprotect.sys   [106624]  =>Adware.BDSearch
[HKCU\Software\Somoto]   =>Adware.MegaSearch
[HKLM\Software\Classes\Installer\Products\9EC6D81181F59F2459A84176A626F9ED]   =>Adware.IMBooster
[HKLM\Software\Wow6432Node\Classes\Installer\Products\9EC6D81181F59F2459A84176A626F9ED]   =>Adware.IMBooster
emptytemp
emptyflash

|- Poste o relatório!

Abs!

Rapport de ZHPFix 2013.12.6.4 par Nicolas Coolman, Update du 06/12/2013
Fichier d'export Registre :
Run by walber at 16/12/2013 12:33:52
High Elevated Privileges : OK
Windows 7 Home Premium Edition, 64-bit Service Pack 1 (Build 7601)

Reciclagem vazia (00mn 01s)

========== Chaves do Registo ==========
ELIMINÉ: [HKLM\SOFTWARE\Classes\CLSID\{318A227B-5E9F-45bd-8999-7F8F10CA4CF5}]
ELIMINÉ: HKCU\Software\Somoto
ELIMINÉ:³ HKLM\Software\Classes\Installer\Products\9EC6D81181F59F2459A84176A626F9ED
ELIMINÉ:³ HKLM\Software\Wow6432Node\Classes\Installer\Products\9EC6D81181F59F2459A84176A626F9ED

========== Valores do Registo ==========
ELIMINÉ: Toolbar: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5}

========== Pastas ==========
ELIMINÉ: C:\ProgramData\boost_interprocess
ELIMINÉ Temporários windows (10)
ELIMINÉ Flash Cookies (0)

========== Ficheiros ==========
ELIMINÉ: c:\users\public\desktop\mozilla firefox.lnk (http://br.hao123.com)
CRIADO: C:\Users\Public\Desktop\Mozilla Firefox.lnk
ELIMINA REINICIAR: c:\windows\system32\drivers\bfilter.sys
ELIMINA REINICIAR: c:\windows\system32\drivers\bfmon.sys
ELIMINA REINICIAR: c:\windows\system32\drivers\bprotect.sys
ELIMINÉ Temporários windows ( (1.283.988 octets)
ELIMINÉ Flash Cookies (0) (0 octets)


========== Recapitulativo ==========
4 : Chaves do Registo
1 : Valores do Registo
3 : Pastas
7 : Ficheiros


End of clean in 00mn 05s

========== Caminho do ficheiro do relatório ==========
C:\Users\walber\AppData\Roaming\ZHP\ZHPFix[R1].txt - 16/12/2013 08:37:05 [2773]
C:\Users\walber\AppData\Roaming\ZHP\ZHPFix[R2].txt - 16/12/2013 12:33:53 [1564]

Boa Tarde! Edvan

|- Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > ( ... by Smeenk )

|- Ou aqui! < [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem][Tens de ter uma conta e sessão iniciada para poderes visualizar este link] >

|- Salve-o e descompacte-o para o desktop!
|- Estarão disponíveis: zoek.com, zoek.scr, zoek.pif e zoek.exe
|- Desabilite seu antivírus!
|- Para Windows 7,execute zoek.exe como administrador.

hijackthis;
iedefaults;
chromelook;
autoclean; 
emptyalltemp; 

|- Copie e cole estas informações,em vermelho,no campo da ferramenta.
|- Clique "Run Script". 

Zoek.exe is running now. 
Do not start any browser windows, they will be closed automatically. 
Please wait! This window will close when finished. 
A logfile will open afterwards and can also be found on your systemdrive as zoek-results.log

|- Surgirão estas informações,pedindo-lhe que aguarde o surgimento do relatório.
|- Ps: Essas informações,podem permanecer estáticas na tela por 20 minutos ou mais.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Aceite e/ou confirme o reboot!

zoek.hta failed by unknown error.
Restart computer, and try again.

|- Ps: Ao obter algum erro,reinicie o PC e execute,novamente,a ferramenta.
|- Poste o relatório,que estará em C:\zoek-results.txt << 

Abs!

Zoek.exe v5.0.0.0 Updated 16-December-2013
Tool run by walber on 16/12/2013 at 12:50:34,72.
Microsoft Windows 7 Home Premium  6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\walber\Desktop\zoek\zoek.com [Scan all users] [Script inserted]

==== System Restore Info ======================

16/12/2013 12:52:31 Zoek.exe System Restore Point Created Succesfully.

==== Creating Sample_122013_1307.zip ======================
 
Copied file C:\Users\walber\AppData\Roaming\unins000.exe to sample\unins000.exe
sample\unins000.exe renamed to AD6E810B9CE3D8C0C1FF0203C68C6FA6

C:\Users\Public\Desktop\sample_122013_1307.zip created successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1630071058-2599205304-2412354637-1000\Software\Microsoft\Internet Explorer\SearchScopes\{86c83f9e-48a4-4cd2-a763-64fea5df35f7} deleted successfully

==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

ProfilePath: C:\Users\walber\AppData\Roaming\Mozilla\Firefox\Profiles\s9mgw4oz.default

user.js not found
---- Lines search.com modified from prefs.js ----

user_pref("extensions.installCache", "[{\"name\":\"winreg-app-global\",\"addons\":{\"otis@digitalpersona.com\":{\"descriptor\":\"C:\\\\Program Files (
---- Lines a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652 removed from prefs.js ----
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.active", true);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.addressbar", "NA");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.addressbarenhanced", "");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.asyncdb_dbWasSet", true);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.asyncdb_dbWasSet_FF25_FIX", true);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.asyncinternaldb_dbWasSet", true);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.asyncinternaldb_dbWasSet_FF25_FIX", true);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.backgroundver", 1);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.certdomaininstaller", "");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.changeprevious", false);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.cookie.InstallationTime.expiration", "Fri Feb 01
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.cookie.InstallationTime.value", "1383878021");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.domain", "");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.enablesearch", false);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.homepage", "");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.iframe", false);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.InstallationThankYouPage", false);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.InstallationTime", 1383878021);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.internaldb._country_code_.expiration", "Fri Feb
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.internaldb._country_code_.value", "%22BR%22");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.internaldb.installer.expiration", "Fri Feb 01 20
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.internaldb.installer.value", "%7B%22InstallerIde
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.internaldb.InstallerIdentifiers.expiration", "Fr
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.internaldb.InstallerIdentifiers.value", "%7B%22i
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.internaldb.Resources_appVer.expiration", "Fri Fe
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.internaldb.Resources_appVer.value", "21");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.internaldb.Resources_lastVersion.expiration", "F
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.internaldb.Resources_lastVersion.value", "1");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.internaldb.Resources_meta.expiration", "Fri Feb
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.internaldb.Resources_meta.value", "%7B%7D");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.internaldb.Resources_nextCheck.expiration", "Fri
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.internaldb.Resources_nextCheck.value", "true");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.internaldb.Resources_queue.expiration", "Fri Feb
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.internaldb.Resources_queue.value", "%7B%7D");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.internaldb.Resources_remote_resources.expiration
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.internaldb.Resources_remote_resources.value", "%
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.lastDailyReport", "1383917913219");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.lastUpdate", "1383917918077");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.manifesturl", "");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.newtab", "");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.opensearch", "");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.pluginsurl", "https://w9u6a2p6.ssl.hwcdn.net/plu
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.pluginsversion", 16);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.searchstatus", 0);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.setnewtab", false);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.thankyou", "");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.updateinterval", 360);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.42652.ver", 21);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.apps", "42652");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.bic", "142358ed09aca6a340bcb5dc92160399");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.cid", 42652);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.firstrun", false);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.hadappinstalled", true);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.installationdate", 1383878021);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.modetype", "production");
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.reportInstall", true);
user_pref("extensions.a8a70177719b647a8b4d87c3dc13bc21e9ee87924f3ee404d87282e14a85e873bcom42652.statsDailyCounter", 2);
---- FireFox user.js and prefs.js backups ----

prefs_122013_1308_.backup

==== Deleting Files \ Folders ======================

C:\Users\walber\.android deleted
C:\ProgramData\boost_interprocess deleted
C:\Users\walber\AppData\Local\FilesFrog Update Checker deleted
C:\Users\walber\AppData\Local\Mobogenie deleted
C:\Users\walber\AppData\Local\cache deleted
C:\Users\wangjihua\AppData\Local\Mobogenie deleted
C:\Users\walber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mobogenie deleted
C:\Users\walber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FilesFrog Update Checker deleted
C:\windows\SysNative\tasks\Baidu PC Faster Update deleted
C:\Users\wangjihua deleted
C:\Windows\Syswow64\InstallUtil.InstallLog deleted
C:\Users\walber\Documents\Mobogenie deleted
C:\Users\walber\AppData\Roaming\unins000.exe deleted
"C:\Users\walber\AppData\Roaming\Mozilla\Firefox\Profiles\s9mgw4oz.default\extensions\firefox@mybuzzsearch.com.xpi" deleted
"C:\Users\walber\daemonprocess.txt" deleted
"C:\PROGRA~2\Mobogenie\DaemonProcess.exe" deleted
"C:\PROGRA~2\Mobogenie\libeay32.dll" deleted
"C:\PROGRA~2\Mobogenie\mgusb.exe" deleted
"C:\PROGRA~2\Mobogenie\msvcp100.dll" deleted
"C:\PROGRA~2\Mobogenie\msvcr100.dll" deleted
"C:\PROGRA~2\Mobogenie\QtCore4.dll" deleted
"C:\PROGRA~2\Mobogenie\QtGui4.dll" deleted
"C:\PROGRA~2\Mobogenie\QtNetwork4.dll" deleted
"C:\PROGRA~2\Mobogenie\QtSql4.dll" deleted
"C:\PROGRA~2\Mobogenie\QtWebKit4.dll" deleted
"C:\PROGRA~2\Mobogenie\ssleay32.dll" deleted
"C:\PROGRA~2\Mobogenie" deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"wrc@avast.com"="C:\Program Files\AVAST Software\Avast\WebRep\FF" [16/12/2013 09:50]
[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]
"{87F8774F-B485-47E2-A755-A40A8A5E886C}"="C:\Users\walber\AppData\Local\GAS Tecnologia\GBBD\bb\xpi" [20/11/2013 23:18]

==== Firefox Extensions ======================

ProfilePath: C:\Users\walber\AppData\Roaming\Mozilla\Firefox\Profiles\s9mgw4oz.default
- NetVideoHunter - %ProfilePath%\extensions\netvideohunter@netvideohunter.com

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\walber\AppData\Roaming\Mozilla\Firefox\Profiles\s9mgw4oz.default
F891089A6AB9E12FEDEBCC5EC0F40D66    - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll -    Shockwave Flash
402F73996235A5ED472D3B31C4FD4BC5    - C:\Users\walber\AppData\Local\GAS Tecnologia\GBBD\npsf_bb.dll -    Módulo de Proteção - Banco do Brasil
EC401349BFA64BD6232C746046AEC0B5    - C:\Users\walber\AppData\Roaming\Mozilla\plugins\npoctoshape.dll -    Octoshape Streaming Services
F92FC494F7E9760802180B5493DD4F90    - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll -    Shockwave for Director / Shockwave for Director
CC918D6A687C517BA3D17A9CCF4B3CEC    - C:\Users\walber\AppData\Local\GAS Tecnologia\GBBD\npsf_bb_64.dll -    Módulo de Proteção - Banco do Brasil


==== Chrome Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
jhjjdgbhohaallcimgcmakfiobacimkm - C:\Program Files (x86)\BuzzSearch\jhjjdgbhohaallcimgcmakfiobacimkm.crx[]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
pgacfjdigcddmmncljpflgcfpfahebkh - C:\Users\walber\AppData\Local\GAS Tecnologia\GBBD\bb\sf.crx[17/10/2013 19:54]

Google Docs - walber - Default\Extensions\aohghmighlieiainnegkcijnfilokake
Google Drive - walber - Default\Extensions\apdfllckaahabafndbhieahigkjlhalf
YouTube - walber - Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Google Search - walber - Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
GBBD Banco do Brasil - walber - Default\Extensions\pgacfjdigcddmmncljpflgcfpfahebkh
Gmail - walber - Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia
Google Docs - C:\Windows\sysWoW64\config\systemprofile - Default\Extensions\aohghmighlieiainnegkcijnfilokake
Google Drive - C:\Windows\sysWoW64\config\systemprofile - Default\Extensions\apdfllckaahabafndbhieahigkjlhalf
YouTube - C:\Windows\sysWoW64\config\systemprofile - Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Google Search - C:\Windows\sysWoW64\config\systemprofile - Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
Google Wallet - C:\Windows\sysWoW64\config\systemprofile - Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
Gmail - C:\Windows\sysWoW64\config\systemprofile - Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== Chrome Fix ======================

C:\Users\walber\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jhjjdgbhohaallcimgcmakfiobacimkm deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.baixaki.com.br/portal/?utm_source=core&utm_medium=ppi&utm_campaign=portal"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.baixaki.com.br/portal/?utm_source=core&utm_medium=ppi&utm_campaign=portal"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="http://www.google.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="http://www.google.com"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{86c83f9e-48a4-4cd2-a763-64fea5df35f7}"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{86c83f9e-48a4-4cd2-a763-64fea5df35f7}] not found

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google  Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"
{EE0498B6-87BC-4A19-B79A-A0A9E5A62521} Bing  Url="http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox"

==== shortcuts on Users Desktops ======================

C:\Users\Convidado\Desktop\CAT 4.0.lnk - C:\CAT40\sp2tccli.exe
C:\Users\Convidado\Desktop\DVD Shrink 3.2.lnk - C:\Program Files (x86)\DVD Shrink\DVD Shrink 3.2.exe
C:\Users\walber\Desktop\Any Video Converter.lnk - C:\Program Files (x86)\AnvSoft\Any Video Converter\VideoConverter.exe
C:\Users\walber\Desktop\Auslogics Disk Defrag.lnk - C:\Program Files (x86)\Auslogics\Auslogics Disk Defrag\DiskDefrag.exe
C:\Users\walber\Desktop\Bluetooth File Transfer Wizard.lnk - C:\Windows\System32\fsquirt.exe
C:\Users\walber\Desktop\Calculator.lnk - C:\Windows\system32\calc.exe
C:\Users\walber\Desktop\CAT 4.0.lnk - C:\CAT40\sp2tccli.exe
C:\Users\walber\Desktop\DVD Shrink 3.2.lnk - C:\Program Files (x86)\DVD Shrink\DVD Shrink 3.2.exe
C:\Users\walber\Desktop\Format Factory.lnk - C:\Program Files (x86)\FreeTime\FormatFactory\FormatFactory.exe
C:\Users\walber\Desktop\Free Audio Editor.lnk - C:\Program Files (x86)\Free Audio Editor\FreeAudioEditor.exe
C:\Users\walber\Desktop\Internet Explore.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\walber\Desktop\MaxPayne2 - Atalho.lnk - C:\MaxPayne2\MaxPayne2.exe
C:\Users\walber\Desktop\Microsoft Office Excel 2007.lnk - C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
C:\Users\walber\Desktop\Microsoft Office PowerPoint 2007.lnk - C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
C:\Users\walber\Desktop\Microsoft Office Word 2007.lnk - C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
C:\Users\walber\Desktop\ZHPDiag.lnk - C:\Program Files (x86)\ZHPDiag\ZHPhep.exe
C:\Users\walber\Desktop\ZHPFix.lnk - C:\Program Files (x86)\ZHPDiag\ZHPFix\ZHPhep.exe

==== shortcuts on All Users Desktop ======================

C:\Users\Public\Desktop\Adobe Reader 9.lnk - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
C:\Users\Public\Desktop\Adobe Reader XI.lnk - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
C:\Users\Public\Desktop\AutoCAD 2013 – Português – Brasil (Brazilian Portuguese).lnk - 
C:\Users\Public\Desktop\avast Free Antivirus.lnk - 
C:\Users\Public\Desktop\CCleaner.lnk - C:\Program Files\CCleaner\CCleaner64.exe
C:\Users\Public\Desktop\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Public\Desktop\Google Earth.lnk - C:\Program Files (x86)\Google\Google Earth\client\googleearth.exe
C:\Users\Public\Desktop\HP Support Assistant.lnk - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
C:\Users\Public\Desktop\Inventor Fusion 2013.lnk - C:\Program Files (x86)\Autodesk\Inventor Fusion 2013\Inventor Fusion.exe
C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\Users\Public\Desktop\MassTube.lnk - C:\Program Files (x86)\MassTube\MassTube.exe
C:\Users\Public\Desktop\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Public\Desktop\MV RegClean 6.0.lnk - C:\Program Files (x86)\Marcos Velasco Security\MV RegClean 6.0\MVREGCLEAN.EXE
C:\Users\Public\Desktop\Nero Home.lnk - C:\Program Files (x86)\Nero\Nero8\Nero Home\NeroHome.exe -ScParameter=65 
C:\Users\Public\Desktop\Nero StartSmart.lnk - C:\Program Files (x86)\Nero\Nero8\Nero StartSmart\NeroStartSmart.exe -ScParameter=65 
C:\Users\Public\Desktop\Samsung Kies.lnk - C:\Program Files (x86)\Samsung\Kies\KiesAgent.exe
C:\Users\Public\Desktop\TeamViewer 8.lnk - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe

==== shortcuts in Users Start Menu ======================

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk - C:\Program Files (x86)\Microsoft SkyDrive\SkyDriveSetup.exe
C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk - C:\Program Files (x86)\Microsoft SkyDrive\SkyDriveSetup.exe
C:\Users\walber\AppData\Roaming\Microsoft\Windows\Start Menu\Free Audio Editor.lnk - C:\Program Files (x86)\Free Audio Editor\FreeAudioEditor.exe
C:\Users\walber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\walber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk - C:\Users\walber\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
C:\Users\walber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe  -extoff
C:\Users\walber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory\FormatFactory.lnk - C:\Program Files (x86)\FreeTime\FormatFactory\FormatFactory.exe
C:\Users\walber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory\Help.lnk - C:\Program Files (x86)\FreeTime\FormatFactory\FormatFactory.exe /help
C:\Users\walber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory\Uninstall.lnk - C:\Program Files (x86)\FreeTime\FormatFactory\uninst.exe
C:\Users\USURIO~1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk - C:\Program Files (x86)\Microsoft SkyDrive\SkyDriveSetup.exe

==== shortcuts in All Users Start Menu ======================

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk - C:\Windows\Installer\{AC76BA86-7AD7-1046-7B44-AB0000000001}\SC_Reader.ico
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast\avast Free Antivirus.lnk - 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\CCleaner.lnk - C:\Program Files\CCleaner\CCleaner64.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner\Uninstall CCleaner.lnk - C:\Program Files\CCleaner\uninst.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVD Shrink\DVD Shrink 3.2.lnk - C:\Program Files (x86)\DVD Shrink\DVD Shrink 3.2.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVD Shrink\DVD Shrink Information.lnk - C:\Program Files (x86)\DVD Shrink\Web\DVD Shrink.htm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVD Shrink\Uninstall DVD Shrink.lnk - C:\Program Files (x86)\DVD Shrink\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Audio Editor\Free Audio Editor.lnk - C:\Program Files (x86)\Free Audio Editor\FreeAudioEditor.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Audio Editor\Uninstall.lnk - C:\Program Files (x86)\Free Audio Editor\unins000.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\About Java.lnk - C:\Program Files (x86)\Java\jre7\bin\javacpl.exe -tab about
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Check For Updates.lnk - C:\Program Files (x86)\Java\jre7\bin\javacpl.exe -tab update
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Configure Java.lnk - C:\Program Files (x86)\Java\jre7\bin\javacpl.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.lnk - 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.lnk - 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit\Reference Documentation.lnk - 
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP\ZHPDiag.lnk - C:\Program Files (x86)\ZHPDiag\ZHPhep.exe
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP\ZHPFix.lnk - C:\Program Files (x86)\ZHPDiag\ZHPFix\ZHPhep.exe

==== shortcuts in Quick Launch ======================

C:\Users\Convidado\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Convidado\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk - 
C:\Users\Convidado\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk - 
C:\Users\Convidado\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\HP MediaSmart.lnk - C:\Program Files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
C:\Users\Convidado\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\HPAdvisor.lnk - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW,SYSTRAY
C:\Users\Convidado\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\Convidado\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk - C:\Windows\explorer.exe
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk - 
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk - 
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk - 
C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk - 
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Free Audio Editor.lnk - C:\Program Files (x86)\Free Audio Editor\FreeAudioEditor.exe
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\MassTube.lnk - C:\Program Files (x86)\MassTube\MassTube.exe
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook.lnk - C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE  /recycle
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Nero Home.lnk - C:\Program Files (x86)\Nero\Nero8\Nero Home\NeroHome.exe -ScParameter=65 
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart.lnk - C:\Program Files (x86)\Nero\Nero8\Nero StartSmart\NeroStartSmart.exe -ScParameter=65 
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Samsung Kies (Lite).lnk - C:\Program Files (x86)\Samsung\Kies\KiesAgent.exe /lite
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Samsung Kies.lnk - C:\Program Files (x86)\Samsung\Kies\KiesAgent.exe
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk - 
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk - 
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\7e4dca80246863e3\pinned.lnk - C:\Windows\system32\control.exe
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Microsoft Office Outlook 2007.lnk - C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Snipping Tool.lnk - 
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\HP MediaSmart.lnk - C:\Program Files (x86)\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\HPAdvisor.lnk - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW,SYSTRAY
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Office PowerPoint 2007.lnk - C:\Windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk - C:\Windows\explorer.exe
C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk - 
C:\Users\USURIO~1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk - 

==== shortcuts After Repair ======================

C:\Users\walber\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\jhjjdgbhohaallcimgcmakfiobacimkm deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FilesFrog Update Checker deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Mobogenie deleted successfully

==== HijackThis Entries ======================

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: DigitalPersona Personal Extension - {395610AE-C624-4f58-B89E-23733EA00F9A} - C:\Program Files (x86)\DigitalPersona\Bin\DpOtsPluginIe8.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Auxiliar de Conexão do Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\PROGRAM FILES (X86)\GBPLUGIN\gbieh.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O2 - BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll
O3 - Toolbar: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [WirelessAssistant] C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [HPCam_Menu] "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\Hewlett-Packard\Media\Webcam" UpdateWithCreateOnce "Software\Hewlett-Packard\Media\Webcam"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [DpAgent] C:\Program Files (x86)\DigitalPersona\Bin\dpagent.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [mobilegeni daemon] C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\RunOnce: [AvgUninstallURL] cmd.exe /c start [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
O4 - HKCU\..\Run: [KiesPreload] C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIÇO DE REDE')
O8 - Extra context menu item: E&xportar para o Microsoft Excel - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O8 - Extra context menu item: Free YouTube Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
O9 - Extra button: Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Enviar para o OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - Trusted Zone: [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O15 - Trusted Zone: www14.bancobrasil.com.br
O15 - Trusted Zone: www2.bancobrasil.com.br
O15 - Trusted Zone: [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O16 - DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} (WRC Class) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O20 - Winlogon Notify:  GbPluginBb - C:\Program Files (x86)\GbPlugin\gbieh.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_14e7194c26fb7998\AESTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Autodesk Content Service - Autodesk, Inc. - C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: @C:\Program Files (x86)\DigitalPersona\Bin\DpHostW.exe,-128 (DpHost) - DigitalPersona, Inc. - C:\Program Files (x86)\DigitalPersona\Bin\DpHostW.exe
O23 - Service: DeviceVM Meta Data Export Service (DvmMDES) - DeviceVM, Inc. - C:\SPLASH.SYS\config\DVMExportService.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service 64 - Flexera Software, Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
O23 - Service: Gbp Service (GbpSv) - GAS Tecnologia - C:\PROGRA~2\GbPlugin\GbpSv.exe
O23 - Service: Serviço do Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: HP Support Assistant Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: HP Service (hpsrv) - Unknown owner - C:\Windows\system32\Hpservice.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ieetwcollectorres.dll,-1000 (IEEtwCollectorService) - Unknown owner - C:\Windows\system32\IEEtwCollector.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_14e7194c26fb7998\STacSV64.exe
O23 - Service: TeamViewer 8 (TeamViewer8) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: Validity Fingerprint Service (vfsFPService) - Validity Sensors, Inc. - C:\Windows\system32\vfsFPService.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

==== Empty IE Cache ======================

C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Convidado\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Convidado\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\walber\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\walber\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\walber\AppData\Local\Mozilla\Firefox\Profiles\s9mgw4oz.default\Cache emptied successfully

==== Empty Chrome Cache ======================

C:\Users\walber\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
C:\Windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== Empty Temp Folders ======================

C:\Users\Convidado\AppData\Local\Temp emptied successfully
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\USURIO~1\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Users\walber\AppData\Local\Temp  will be emptied at reboot
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\walber\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 16/12/2013 at 15:06:02,66 ======================

Boa Noite! Edvan

|- Seus logs estão limpos!

-/-

|- Baixe: |[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]| ( ... de Xplode )

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Estando na página,clique na seta verde para o download. 
|- Salve-a em um local conveniente! ( desktop! )
|- Feche aplicativos que estejam abertos.

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

|- Execute-a!
|- Com as duas checkbox marcadas! 
|- Clique "Run".
|- Tudo Ok?

-/-

|- Caso queira otimize o PC com o JetClean + JetBoost.
|- Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > ( ... by BlueSprig.com )

< [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > << Leia aqui!

|- Salve-o em Arquivos de programas. ( jetclean-setup.exe )

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] 

|- Instale o software e na guia "1-Click",escolha a opção "Registry Clean".
|- Vá em "Scan Now" e escolha: Shut down PC after Repair

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

|- Ou escolhendo a opção "Scan & Repair",sem o reboot do PC.

< [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] >

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link] 

|- À seguir,tente melhorar a performance com o JetBoost.

Abs!

passei ontem mesmo, está tudo ok agora.
Obrigado por mais essa!

# DelFix v10.6 - Logfile created 16/12/2013 at 18:33:50
# Updated 11/11/2013 by Xplode
# Username : walber - HP
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

~ Removing disinfection tools ...

Deleted : C:\AdwCleaner
Deleted : C:\Users\walber\AppData\Roaming\ZHP
Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP
Deleted : C:\Program Files (x86)\ZHPDiag
Deleted : C:\Program Files (x86)\Hijackthis
Deleted : C:\PhysicalDisk0_MBR.bin
Deleted : C:\zoek-results.log
Deleted : C:\Users\walber\Desktop\adwcleaner.exe
Deleted : C:\Users\walber\Desktop\ZHPDiag.lnk
Deleted : C:\Users\walber\Desktop\ZHPDiag.txt
Deleted : C:\Users\walber\Desktop\ZHPFix.lnk
Deleted : C:\Users\walber\Desktop\ZHPFixReport.txt
Deleted : C:\Users\walber\Desktop\zoek.rar
Deleted : C:\Users\walber\Downloads\adwcleaner.exe
Deleted : HKLM\SOFTWARE\AdwCleaner
Deleted : HKLM\SOFTWARE\TrendMicro\Hijackthis
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1

~ Cleaning system restore ...

Deleted : RP #313 [Windows Update | 12/09/2013 02]
Deleted : RP #314 [Windows Update | 12/09/2013 14]
Deleted : RP #315 [Windows Update | 12/10/2013 09]
Deleted : RP #316 [Windows Update | 12/10/2013 10]
Deleted : RP #317 [Windows Update | 12/12/2013 01]
Deleted : RP #318 [Windows Update | 12/15/2013 22]
Deleted : RP #319 [Windows Update | 12/16/2013 02]
Deleted : RP #320 [avast! antivirus system restore point | 12/16/2013 11]
Deleted : RP #321 [zoek.exe restore point | 12/16/2013 14]

New restore point created !

~ Resetting system settings ... OK

########## - EOF - ##########

CASO RESOLVIDO!

Necessitando novo auxílio para este computador,basta abrir "[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]" e relatar o problema.