IE poluído, log para analise.

Log para analise [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

# AdwCleaner v2.007 - Logfile created 09/04/2013 at 08:31:23
# Updated 06/11/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : f002898 - FUN0094
# Boot Mode : Normal
# Running from : C:\Documents and Settings\f002898\Desktop\AdwCleaner.exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Arquivos de programas\DealPly
Folder Deleted : C:\Documents and Settings\All Users\Dados de aplicativos\boost_interprocess
Folder Deleted : C:\Documents and Settings\f002898\Dados de aplicativos\DealPly
Folder Deleted : C:\Documents and Settings\f002898\Menu Iniciar\Programas\DealPly

***** [Registry] *****

Key Deleted : HKCU\Software\DealPly
Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Key Deleted : HKLM\Software\DealPly

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.6001.18702

Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Page] = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] --> [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

*************************

AdwCleaner[S1].txt - [2159 octets] - [07/05/2013 14:33:26]
AdwCleaner[S2].txt - [1272 octets] - [04/09/2013 08:31:23]

########## EOF - C:\AdwCleaner[S2].txt - [1332 octets] ##########


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.2 (04.29.2013:1)
OS: Microsoft Windows XP x86
Ran by f002898 on 04/09/2013 at  8:35:37,90
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{4FB8BE79-314D-864C-EB11-32353D60BB67}



~~~ Files



~~~ Folders





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 04/09/2013 at  8:40:51,09
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Bom Dia! Edvan

|- Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > ( ... by jpshortstuff )
|- Salve-o no desktop!
|- Para Windows 7,execute Kenco.exe como administrador.
|- Ps: Aparecerá uma tela preta e,à seguir,o relatório. <- Poste-o!

-/-

|- Execute este script em ZHPFix.

P2 - FPN: [HKLM] [@tools.dpliveupdate.com/DealPlyLive Update;version=3] - (.DealPly Technologies Ltd - DealPlyLive Update.) -- C:\Arquivos de programas\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll  =>PUP.DealPly
P2 - FPN: [HKLM] [@tools.dpliveupdate.com/DealPlyLive Update;version=9] - (.DealPly Technologies Ltd - DealPlyLive Update.) -- C:\Arquivos de programas\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll  =>PUP.DealPly
O2 - BHO: DealPly Shopping - {9cf699ca-2174-4ed8-bec1-ba82095edce0} . (...) -- C:\Arquivos de programas\DealPly\DealPlyIE.dll (.not file.)  =>PUP.DealPly
O23 - Service: Serviço do DealPly Live (dealplylive) (dealplylive) . (.DealPly Technologies Ltd - DealPlyLive Update.) - C:\Arquivos de programas\DealPlyLive\Update\DealPlyLive.exe  =>PUP.DealPly
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At1.job [412]
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At2.job [412]
O39 - APT:Automatic Planified Task - C:\WINDOWS\Tasks\At3.job [416]
O39 - APT:Automatic Planified Task  - C:\WINDOWS\Tasks\DealPlyLiveUpdateTaskMachineCore.job   [908]  =>PUP.DealPly
O39 - APT:Automatic Planified Task  - C:\WINDOWS\Tasks\DealPlyLiveUpdateTaskMachineUA.job   [912]  =>PUP.DealPly
[MD5.00760D169C756B9CFD6B0FAACBA862CA] [APT] [At1] (...) -- C:\DOCUME~1\f002898\DADOSD~1\DSite\UPDATE~1\UPDATE~1.exe   [95232]
[MD5.00760D169C756B9CFD6B0FAACBA862CA] [APT] [At2] (...) -- C:\DOCUME~1\f002898\DADOSD~1\DSite\UPDATE~1\UPDATE~1.exe   [95232]
[MD5.00000000000000000000000000000000] [APT] [At3] (...) -- C:\DOCUME~1\f002898\DADOSD~1\Dealply\UPDATE~1\UPDATE~1.exe (.not file.)   [0]  =>PUP.DealPly
[MD5.9FCD1448C709C227BA6A146B681CC869] [APT] [DealPlyLiveUpdateTaskMachineCore] (.DealPly Technologies Ltd.) -- C:\Arquivos de programas\DealPlyLive\Update\DealPlyLive.exe   [148000]  =>PUP.DealPly
[MD5.9FCD1448C709C227BA6A146B681CC869] [APT] [DealPlyLiveUpdateTaskMachineUA] (.DealPly Technologies Ltd.) -- C:\Arquivos de programas\DealPlyLive\Update\DealPlyLive.exe   [148000]  =>PUP.DealPly
O43 - CFD: 20/08/2013 - 11:58:11 - [3,749] ----D C:\Arquivos de programas\DealPlyLive  =>PUP.DealPly
O43 - CFD: 20/08/2013 - 11:58:08 - [0] ----D C:\Documents and Settings\f002898\Configurações locais\Dados de aplicativos\DealPlyLive  =>PUP.DealPly
O64 - Services: CurCS - 20/08/2013 - C:\Arquivos de programas\DealPlyLive\Update\DealPlyLive.exe (dealplylive)  .(.DealPly Technologies Ltd - DealPlyLive Update.) - LEGACY_DEALPLYLIVE  =>PUP.DealPly
SS - | Auto 20/08/2013 148000 |  (dealplylive) . (.DealPly Technologies Ltd.) - C:\Arquivos de programas\DealPlyLive\Update\DealPlyLive.exe  =>PUP.DealPly
SS - | Demand 20/08/2013 148000 |  (dealplylivem) . (.DealPly Technologies Ltd.) - C:\Arquivos de programas\DealPlyLive\Update\DealPlyLive.exe  =>PUP.DealPly
[HKCU\Software\DealPlyLive]  =>PUP.DealPly
[HKCU\Software\InstallCore]  =>PUP.InstallCore
[HKLM\Software\DealPlyLive]  =>PUP.DealPly
[HKLM\Software\InstallCore]  =>PUP.InstallCore
firewallraz
emptytemp
emptyclsid
ctffix

|- Poste o relatório!

Abs!

Kenco by jpshortstuff (31.12.09.1)
Log created at 10:10 on 04/09/2013 (f002898)

========== Task Unlocker ==========

========== KencoScan ==========

========== C:\WINDOWS\Tasks ==========
Adobe Flash Player Updater.job -> [10:47 13/06/2012] 902 bytes
At1.job -> [14:57 20/08/2013] 412 bytes
At2.job -> [14:57 20/08/2013] 412 bytes
At3.job -> [14:57 20/08/2013] 416 bytes
avast! Emergency Update.job -> [20:25 02/08/2012] 382 bytes
DealPlyLiveUpdateTaskMachineCore.job -> [14:58 20/08/2013] 908 bytes
DealPlyLiveUpdateTaskMachineUA.job -> [14:58 20/08/2013] 912 bytes
GoogleUpdateTaskMachineCore.job -> [10:49 24/08/2012] 1070 bytes
GoogleUpdateTaskMachineUA.job -> [10:49 24/08/2012] 1074 bytes
PandaUSBVaccine.job -> [20:31 24/01/2012] 546 bytes

-=E.O.F=-






Rapport de ZHPFix 2013.3.9.1 par Nicolas Coolman, Update du 9/03/2013
Fichier d'export Registre : 
Run by f002898 at 04/09/2013 10:11:33
High Elevated Privileges : OK
Windows XP Professional Service Pack 3 (Build 2600)

Recycle Files Deleted

========== Memory Process ==========
DELETED Memory Process: C:\DOCUME~1\f002898\DADOSD~1\DSite\UPDATE~1\UPDATE~1.exe

========== Registry Key ==========
DELETED Key: Mozilla Plugin: @tools.dpliveupdate.com/DealPlyLive Update;version=3
DELETED Key: Mozilla Plugin: @tools.dpliveupdate.com/DealPlyLive Update;version=9
DELETED Key: CLSID BHO: {9cf699ca-2174-4ed8-bec1-ba82095edce0}
DELETED  Key: CLSID: [HKLM\SOFTWARE\Classes\CLSID\{9cf699ca-2174-4ed8-bec1-ba82095edce0}]
DELETED Key: Service: dealplylive
ERROR Key: Service Legacy: LEGACY_DEALPLYLIVE
NOT FOUND Key: Service: dealplylive
DELETED Key: Service: dealplylivem
DELETED Key: HKCU\Software\DealPlyLive
DELETED Key: HKCU\Software\InstallCore
DELETED Key: HKLM\Software\DealPlyLive
DELETED Key: HKLM\Software\InstallCore
ctffixCTFMon already disabled

========== Registry Value ==========
DELETED FirewallRaz (SP) : %windir%\system32\sessmgr.exe
DELETED FirewallRaz (SP) : %windir%\Network Diagnostic\xpnetdiag.exe
DELETED FirewallRaz (DP) : %windir%\system32\sessmgr.exe
DELETED FirewallRaz (DP) : %windir%\Network Diagnostic\xpnetdiag.exe
No Value in Firewall Exception Register Key (FirewallRaz)

========== Repertory ==========
No Empty CLSID Directories

========== File ==========
DELETED File: c:\arquivos de programas\dealplylive\update\1.3.23.0\npgoogleupdate3.dll 
NOT FOUND File: c:\arquivos de programas\dealplylive\update\1.3.23.0\npgoogleupdate3.dll
NOT FOUND File: c:\arquivos de programas\dealply\dealplyie.dll
DELETED File: c:\arquivos de programas\dealplylive\update\dealplylive.exe 
DELETED File: c:\windows\tasks\at1.job 
DELETED File: c:\windows\tasks\at2.job 
DELETED File: c:\windows\tasks\at3.job 
DELETED File: c:\windows\tasks\dealplyliveupdatetaskmachinecore.job 
DELETED File: c:\windows\tasks\dealplyliveupdatetaskmachineua.job 
DELETED File*: c:\docume~1\f002898\dadosd~1\dsite\update~1\update~1.exe
NOT FOUND Folder/File: c:\docume~1\f002898\dadosd~1\dsite\update~1\update~1.exe
NOT FOUND Folder/File: c:\arquivos de programas\dealplylive\update\dealplylive.exe
NOT FOUND File: c:\arquivos de programas\dealplylive\update\dealplylive.exe
DELETED Window Temporary

========== Task ==========
DELETED Task: At1
DELETED Task: At2
DELETED Task: At3
DELETED Task: DealPlyLiveUpdateTaskMachineCore
DELETED Task: DealPlyLiveUpdateTaskMachineUA


========== Summary ==========
1 : Memory Process
13 : Registry Key
5 : Registry Value
1 : Repertory
14 : File
5 : Task


End of clean in 00mn 15s

========== Report File ==========
C:\ZHP\ZHPFix[R1].txt - 04/09/2013 10:11:35 [2823]

Bom Dia! Edvan

|- Baixe: < [Tens de ter uma conta e sessão iniciada para poderes visualizar este link] > ( ... by Smeenk )

|- Ou aqui! < [Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem][Tens de ter uma conta e sessão iniciada para poderes visualizar este link] >

|- Salve-o no desktop!
|- Desabilite seu antivírus!
|- Para Windows 7,execute zoek.exe como administrador.

hijackthis;
iedefaults;
autoclean;
emptyalltemp;

|- Copie e cole estas informações,em vermelho,no campo da ferramenta.
|- Clique "Run Script".

Zoek.exe is running now.
Do not start any browser windows, they will be closed automatically.
Please wait! This window will close when finished.
A logfile will open afterwards and can also be found on your systemdrive as zoek-results.log

|- Surgirão estas informações,pedindo-lhe que aguarde o relatório.

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Aceite e/ou confirme o reboot!

zoek.hta failed by unknown error.
Restart computer, and try again.

|- Ps: Ao obter algum erro,reinicie o PC e execute,novamente,a ferramenta.
|- Poste o relatório,que estará em C:\zoek-results.txt <<

A+

Zoek.exe Version 4.0.0.4 Updated 31-08-2013
Tool run by f002898 on 04/09/2013 at 10:20:10,76.
Microsoft Windows XP Professional 5.1.2600 Service Pack 3 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Documents and Settings\f002898\Desktop\zoek.exe [Script inserted] 

==== System Restore Info ======================

04/09/2013 10:21:29 Zoek.exe System Restore Point Created Succesfully.

==== Creating Sample_092013_1028.zip ======================
 
Copied file C:\Documents and Settings\f002898\Dados de aplicativos\unins000.exe to sample\unins000.exe
sample\unins000.exe renamed to AD6E810B9CE3D8C0C1FF0203C68C6FA6

C:\Documents and Settings\All Users\Desktop\sample_092013_1028.zip created successfully

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== Deleting Files \ Folders ======================

"C:\WINDOWS\002749_.tmp" deleted
"C:\WINDOWS\SET25.tmp" deleted
"C:\WINDOWS\SET3.tmp" deleted
"C:\WINDOWS\SET4.tmp" deleted
"C:\WINDOWS\SET8.tmp" deleted
"C:\Documents and Settings\f002898\Dados de aplicativos\unins000.exe" deleted
"C:\Documents and Settings\f002898\Dados de aplicativos\DSite" deleted
"C:\Documents and Settings\NetworkService\Dados de aplicativos\Mozilla\Firefox\Profiles\owhysr8s.default\extensions\staged" deleted

==== Firefox Extensions ======================

ProfilePath: C:\Documents and Settings\f002898\Dados de aplicativos\Mozilla\Firefox\Profiles\0gn2mabk.default
- DealPly Shopping - %ProfilePath%\extensions\{e53a26f5-7199-4a5b-86f5-d2e86854b979}

ProfilePath: C:\Documents and Settings\NetworkService\Dados de aplicativos\Mozilla\Firefox\Profiles\owhysr8s.default
- Coupons Malibu - %ProfilePath%\extensions\{8850f748-e69b-42ff-a449-7ad3cf153bcc}
- WebToSave - %ProfilePath%\extensions\{f80bc79c-ab5e-418a-a0be-3d9e66b4e976}

==== Firefox Plugins ======================

Profilepath: C:\Documents and Settings\f002898\Dados de aplicativos\Mozilla\Firefox\Profiles\0gn2mabk.default
0C8597DBC74AAF5179471BA013E3C6B4 - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll - Shockwave Flash
ABCB4A6EAB701C629378255ABCB308E5 - C:\Arquivos de programas\Java\jre7\bin\plugin2\npjp2.dll - Java(TM) Platform SE 7 U25
D7324EB1EDCB8990F8522DE0311359E9 - C:\WINDOWS\system32\npDeployJava1.dll - Java Deployment Toolkit 7.0.250.17
101700E93EB905992B518256CB441829 - C:\Arquivos de programas\Google\Update\1.3.21.153\npGoogleUpdate3.dll - Google Update
AB87EEFFD18F2BAAFC274E7075EA6C67 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll - Windows Presentation Foundation / Windows Presentation Foundation
CF4ABE599858E10EEB911E16FBCFD87D - C:\Arquivos de programas\Windows Media Player\npdrmv2.dll - Microsoft® DRM
76E34EA1089E92709C5725407B565DA1 - C:\Arquivos de programas\Windows Media Player\npdsplay.dll - Windows Media Player Plug-in Dynamic Link Library
02A4A41FAC9BF96155B3E8068D1DF4B6 - C:\Arquivos de programas\Windows Media Player\npwmsdrm.dll - Microsoft® DRM
04AF8BC83A89D9B71F7E0BCAF9FDD768 - C:\Arquivos de programas\Adobe\Reader 8.0\Reader\browser\nppdf32.dll - Adobe Acrobat
F9174E52953C2EDB35E4E634F6228F66 - C:\WINDOWS\system32\npptools.dll - Sistema operacional Microsoft® Windows®


==== Deleting Files \ Folders ======================

"C:\Documents and Settings\f002898\Dados de aplicativos\Mozilla\Firefox\Profiles\0gn2mabk.default\extensions\{e53a26f5-7199-4a5b-86f5-d2e86854b979}" deleted

==== Chrome Look ======================

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
pgacfjdigcddmmncljpflgcfpfahebkh - C:\Documents and Settings\f002898\Configurações locais\Dados de aplicativos\GAS Tecnologia\GBBD\bb\sf.crx[21/11/2012 15:32]

Docs - Administrador - Default\Extensions\aohghmighlieiainnegkcijnfilokake
DealPly Shopping - f002898 - Default\Extensions\ejnmnhkgiphcaeefbaooconkceehicfi
GBBD Banco do Brasil - f002898 - Default\Extensions\pgacfjdigcddmmncljpflgcfpfahebkh
Docs - f002951 - Default\Extensions\aohghmighlieiainnegkcijnfilokake
avast WebRep - f002951 - Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda

==== Chrome Fix ======================

C:\Documents and Settings\f002898\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\Extensions\ejnmnhkgiphcaeefbaooconkceehicfi deleted successfully
C:\Documents and Settings\f002898\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ejnmnhkgiphcaeefbaooconkceehicfi_0.localstorage deleted successfully
C:\Documents and Settings\f002898\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ejnmnhkgiphcaeefbaooconkceehicfi_0.localstorage-journal deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com.br/"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com.br/"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} @ieframe.dll,-12512  Url="http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google  Url="http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"

==== HijackThis Entries ======================

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Arquivos de programas\Alwil Software\Avast5\aswWebRepIE.dll
O2 - BHO: G-Buster Browser Defense - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\ARQUIVOS DE PROGRAMAS\GBPLUGIN\gbieh.dll
O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\Arquivos de programas\GbPlugin\gbiehcef.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Arquivos de programas\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Arquivos de programas\Alwil Software\Avast5\aswWebRepIE.dll
O4 - HKLM\..\Run: [HDAudDeck] C:\Arquivos de programas\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3Trayp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Arquivos comuns\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avast] "C:\Arquivos de programas\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportar para o Microsoft Excel - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O15 - Trusted Zone: [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O15 - Trusted Zone: www14.bancobrasil.com.br
O15 - Trusted Zone: www2.bancobrasil.com.br
O15 - Trusted Zone: [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O15 - Trusted Zone: imagem.caixa.gov.br
O15 - Trusted Zone: internetbanking.caixa.gov.br
O15 - Trusted Zone: [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - [Tens de ter uma conta e sessão iniciada para poderes visualizar este link]
O20 - Winlogon Notify:  GbPluginBb - C:\Arquivos de programas\GbPlugin\gbieh.dll
O20 - Winlogon Notify:  GbPluginCef - C:\Arquivos de programas\GbPlugin\gbiehCef.dll
O22 - SharedTaskScheduler: Pré-carregador Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Daemon de cache de categorias de componente - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Arquivos de programas\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Gbp Service (GbpSv) - GAS Tecnologia - C:\ARQUIV~1\GbPlugin\GbpSv.exe
O23 - Service: Serviço do Google Update (gupdate) (gupdate) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe
O23 - Service: Serviço do Google Update (gupdatem) (gupdatem) - Google Inc. - C:\Arquivos de programas\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Arquivos de programas\Java\jre7\bin\jqs.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Arquivos de programas\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NBService - Nero AG - C:\Arquivos de programas\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Arquivos de programas\Arquivos comuns\Ahead\Lib\NMIndexingService.exe

==== Empty IE Cache ======================

C:\Documents and Settings\e0059\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
C:\Documents and Settings\f003176\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
C:\Documents and Settings\NetworkService\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
C:\WINDOWS\system32\config\systemprofile\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
C:\Documents and Settings\f002898\Configurações locais\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot
C:\Documents and Settings\LocalService\Configurações locais\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot

==== Empty FireFox Cache ======================

C:\Documents and Settings\Administrador\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\l1kd2nzy.default\Cache emptied successfully
C:\Documents and Settings\f002898\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\0gn2mabk.default\Cache emptied successfully
C:\Documents and Settings\f002951\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\dr6x6msy.default\Cache emptied successfully
C:\Documents and Settings\f003176\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\zsz4spgk.default\Cache emptied successfully
C:\Documents and Settings\f003204\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\h4xhhmtb.default\Cache emptied successfully
C:\Documents and Settings\Fun0094\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\zi4ore10.default\Cache emptied successfully
C:\Documents and Settings\NetworkService\Configurações locais\Dados de aplicativos\Mozilla\Firefox\Profiles\owhysr8s.default\Cache emptied successfully

==== Empty Chrome Cache ======================

C:\Documents and Settings\Administrador\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\Cache emptied successfully
C:\Documents and Settings\f002898\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\Cache emptied successfully
C:\Documents and Settings\f002951\Configurações locais\Dados de aplicativos\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied
C:\DOCUME~1\f002898\CONFIG~1\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\RECYCLER successfully emptied

==== Deleting Files / Folders ======================

"C:\Documents and Settings\f002898\Configurações locais\Temporary Internet Files\Content.IE5\index.dat" not deleted
"C:\Documents and Settings\LocalService\Configurações locais\Temporary Internet Files\Content.IE5\index.dat" not deleted

==== EOF on 04/09/2013 at 10:36:18,32 ======================

Bom Dia! Edvan

|- Baixe: |[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]| ( ... de Xplode )

[Tens de ter uma conta e sessão iniciada para poderes visualizar esta imagem]

|- Estando na página,clique na seta verde para o download.
|- Salve-a em um local conveniente! ( desktop! )
|- Feche aplicativos que estejam abertos.

[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]

|- Execute-a!
|- Com as 3 checkbox marcadas!
|- Clique "Run".
|- Poste o relatório!
|- Tudo Ok?

A+

Tudo ok meu amigo. 

# DelFix v10.4 - Logfile created 04/09/2013 at 10:45:22
# Updated 19/07/2013 by Xplode
# Username : f002898 - FUN0094
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)

~ Removing disinfection tools ...

Deleted : C:\Qoobox
Deleted : C:\JRT
Deleted : C:\ZHP
Deleted : C:\Arquivos de programas\ZHPDiag
Deleted : C:\Arquivos de programas\Hijackthis
Deleted : C:\AdwCleaner[S1].txt
Deleted : C:\AdwCleaner[S2].txt
Deleted : C:\ComboFix.txt
Deleted : C:\PhysicalDisk0_MBR.bin
Deleted : C:\zoek-results.log
Deleted : C:\Documents and Settings\f002898\Desktop\AdwCleaner.exe
Deleted : C:\Documents and Settings\f002898\Desktop\AdwCleaner[S2].txt
Deleted : C:\Documents and Settings\f002898\Desktop\JRT.exe
Deleted : C:\Documents and Settings\f002898\Desktop\JRT.txt
Deleted : C:\Documents and Settings\f002898\Desktop\Kenco.exe
Deleted : C:\Documents and Settings\f002898\Desktop\Kenco.log
Deleted : C:\Documents and Settings\f002898\Desktop\ZHPDiag.txt
Deleted : C:\Documents and Settings\f002898\Desktop\ZHPDiag2.exe
Deleted : C:\Documents and Settings\f002898\Desktop\ZHPFixReport.txt
Deleted : C:\Documents and Settings\f002898\Desktop\zoek.com
Deleted : C:\Documents and Settings\f002898\Desktop\zoek.exe
Deleted : C:\Documents and Settings\f002898\Desktop\zoek.scr
Deleted : C:\Documents and Settings\f002898\Desktop\zoek.zip
Deleted : C:\Documents and Settings\All Users\Desktop\MBRCheck.lnk
Deleted : C:\Documents and Settings\All Users\Desktop\ZHPDiag.lnk
Deleted : C:\Documents and Settings\All Users\Desktop\ZHPFix.lnk
Deleted : C:\Documents and Settings\f002898\Meus documentos\Downloads\ComboFix.exe
Deleted : C:\Documents and Settings\f002898\Meus documentos\Downloads\Kenco.exe
Deleted : C:\WINDOWS\grep.exe
Deleted : C:\WINDOWS\PEV.exe
Deleted : C:\WINDOWS\NIRCMD.exe
Deleted : C:\WINDOWS\MBR.exe
Deleted : C:\WINDOWS\SED.exe
Deleted : C:\WINDOWS\SWREG.exe
Deleted : C:\WINDOWS\SWSC.exe
Deleted : C:\WINDOWS\SWXCACLS.exe
Deleted : C:\WINDOWS\Zip.exe
Deleted : HKLM\SOFTWARE\AdwCleaner
Deleted : HKLM\SOFTWARE\Swearware
Deleted : HKLM\SOFTWARE\TrendMicro\Hijackthis
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1
Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\combofix.exe

~ Cleaning system restore ...

Deleted : RP #308 [Ponto de verificação do sistema | 06/05/2013 19]
Deleted : RP #309 [Ponto de verificação do sistema | 06/07/2013 11]
Deleted : RP #310 [Ponto de verificação do sistema | 06/10/2013 11]
Deleted : RP #311 [Ponto de verificação do sistema | 06/11/2013 11]
Deleted : RP #312 [Ponto de verificação do sistema | 06/12/2013 14]
Deleted : RP #313 [Ponto de verificação do sistema | 06/13/2013 15]
Deleted : RP #314 [Ponto de verificação do sistema | 06/14/2013 16]
Deleted : RP #315 [Ponto de verificação do sistema | 06/17/2013 10]
Deleted : RP #316 [Ponto de verificação do sistema | 06/18/2013 11]
Deleted : RP #317 [Ponto de verificação do sistema | 06/19/2013 11]
Deleted : RP #318 [Ponto de verificação do sistema | 06/20/2013 13]
Deleted : RP #319 [Ponto de verificação do sistema | 06/21/2013 13]
Deleted : RP #320 [Ponto de verificação do sistema | 06/25/2013 10]
Deleted : RP #321 [Ponto de verificação do sistema | 06/26/2013 12]
Deleted : RP #322 [Ponto de verificação do sistema | 06/27/2013 14]
Deleted : RP #323 [Ponto de verificação do sistema | 06/28/2013 14]
Deleted : RP #324 [Ponto de verificação do sistema | 07/01/2013 10]
Deleted : RP #325 [Ponto de verificação do sistema | 07/02/2013 13]
Deleted : RP #326 [Ponto de verificação do sistema | 07/03/2013 15]
Deleted : RP #327 [Ponto de verificação do sistema | 07/05/2013 10]
Deleted : RP #328 [Ponto de verificação do sistema | 07/08/2013 11]
Deleted : RP #329 [Ponto de verificação do sistema | 07/09/2013 11]
Deleted : RP #330 [Ponto de verificação do sistema | 07/10/2013 11]
Deleted : RP #331 [Ponto de verificação do sistema | 07/12/2013 11]
Deleted : RP #332 [Ponto de verificação do sistema | 07/15/2013 11]
Deleted : RP #333 [Ponto de verificação do sistema | 07/16/2013 12]
Deleted : RP #334 [Ponto de verificação do sistema | 07/18/2013 18]
Deleted : RP #335 [Ponto de verificação do sistema | 07/22/2013 11]
Deleted : RP #336 [Ponto de verificação do sistema | 07/23/2013 12]
Deleted : RP #337 [Ponto de verificação do sistema | 07/24/2013 13]
Deleted : RP #338 [Ponto de verificação do sistema | 07/25/2013 13]
Deleted : RP #339 [Ponto de verificação do sistema | 07/29/2013 11]
Deleted : RP #340 [Ponto de verificação do sistema | 07/30/2013 12]
Deleted : RP #341 [Ponto de verificação do sistema | 07/31/2013 13]
Deleted : RP #342 [Ponto de verificação do sistema | 08/01/2013 13]
Deleted : RP #343 [Ponto de verificação do sistema | 08/02/2013 13]
Deleted : RP #344 [Ponto de verificação do sistema | 08/05/2013 13]
Deleted : RP #345 [Ponto de verificação do sistema | 08/06/2013 13]
Deleted : RP #346 [Ponto de verificação do sistema | 08/07/2013 14]
Deleted : RP #347 [Ponto de verificação do sistema | 08/08/2013 15]
Deleted : RP #348 [Ponto de verificação do sistema | 08/09/2013 15]
Deleted : RP #349 [Ponto de verificação do sistema | 08/12/2013 11]
Deleted : RP #350 [Instalado PlayMemories Home | 08/12/2013 17]
Deleted : RP #351 [Ponto de verificação do sistema | 08/13/2013 19]
Deleted : RP #352 [Removed Java(TM) 6 Update 20 | 08/14/2013 17]
Deleted : RP #353 [Installed Java 7 Update 25 | 08/14/2013 17]
Deleted : RP #354 [Ponto de verificação do sistema | 08/16/2013 11]
Deleted : RP #355 [Ponto de verificação do sistema | 08/19/2013 11]
Deleted : RP #356 [Ponto de verificação do sistema | 08/20/2013 12]
Deleted : RP #357 [Ponto de verificação do sistema | 08/21/2013 12]
Deleted : RP #358 [Ponto de verificação do sistema | 08/22/2013 15]
Deleted : RP #359 [Ponto de verificação do sistema | 08/23/2013 15]
Deleted : RP #360 [Ponto de verificação do sistema | 08/26/2013 17]
Deleted : RP #361 [Ponto de verificação do sistema | 08/28/2013 11]
Deleted : RP #362 [Ponto de verificação do sistema | 08/29/2013 12]
Deleted : RP #363 [Ponto de verificação do sistema | 08/30/2013 12]
Deleted : RP #364 [Ponto de verificação do sistema | 09/02/2013 11]
Deleted : RP #365 [Ponto de verificação do sistema | 09/03/2013 13]
Deleted : RP #366 [Removido PlayMemories Home | 09/04/2013 11]
Deleted : RP #367 [zoek.exe restore point | 09/04/2013 13]

New restore point created !

~ Resetting system settings ... OK

########## - EOF - ##########

CASO RESOLVIDO!

Necessitando novo auxílio para este computador,basta abrir "[Tens de ter uma conta e sessão iniciada para poderes visualizar este link]" e relatar o problema.