Virus?!

O relatorio do MalwareBytes.

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org

Versão da base de dados: v2014.03.02.11

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 11.0.9600.16518

Nanda :: NANDA-PC [administrador]

03-03-2014 01:05:38

MBAM-log-2014-03-03 (07-24-26).txt

Tipo de pesquisa: Completa (C:|)

Opções de pesquisa activadas: Memoria | Arranque | Registo | Sistema de Ficheiros | Heurísticos/Extra | Heurísticos/Shuriken | PPI | MPI

Opções de pesquisa desactivadas: P2P

Objectos verificados: 737220

Tempo decorrido: 5 hora(s), 36 minuto(s), 46 segundo(s)

Processos de memória Detectados: 0

(Nenhum item malicioso detectado)

Módulos de Memória Detectados: 0

(Nenhum item malicioso detectado)

Chaves do Registo Detectadas: 0

(Nenhum item malicioso detectado)

Valores do Registo Detectados: 0

(Nenhum item malicioso detectado)

Itens de dados do Registo Detectados: 0

(Nenhum item malicioso detectado)

Pastas Detectadas: 0

(Nenhum item malicioso detectado)

Ficheiros Detectados: 6

C:\AdwCleaner\Quarantine\C\Program Files\Conduit\Community Alerts\Alert.dll.vir (PUP.Optional.Conduit) -> Nenhuma acção tomada.

C:\AdwCleaner\Quarantine\C\Users\Nanda\AppData\LocalLow\uTorrentBar_PT\hk64tbuTo2.dll.vir (PUP.Optional.Conduit) -> Nenhuma acção tomada.

C:\AdwCleaner\Quarantine\C\Users\Nanda\AppData\LocalLow\uTorrentBar_PT\hktbuTo2.dll.vir (PUP.Optional.Conduit) -> Nenhuma acção tomada.

C:\AdwCleaner\Quarantine\C\Users\Nanda\AppData\LocalLow\uTorrentBar_PT\ldrtbuTo2.dll.vir (PUP.Optional.Conduit) -> Nenhuma acção tomada.

C:\AdwCleaner\Quarantine\C\Users\Nanda\AppData\LocalLow\uTorrentBar_PT\tbuTo2.dll.vir (PUP.Optional.Conduit) -> Nenhuma acção tomada.

C:\Users\Nanda\AppData\Local\Google\Chrome\User Data\Default\File System\006\t\00\00000000 (PUP.Optional.OneClickDownloader.A) -> Nenhuma acção tomada.

(fim)

No relatório do Malwarebytes está constando: Nenhuma ação tomada. Selecione todos os problemas que ele encontrou e clique em Remover selecionados.

_________________________________________________________

*  Depois disto vá no menu: Iniciar> Todos os programas > ZHP > Abra o ZHPDiag> Clique em Pesquisar> Clique OK e, ao concluir, poste o relatório ZHPDiag.txt aqui em seu tópico para podermos analisar

boas amigo voces nao estalou um adblock no crome porque ele esta a associado ao crome

https://chrome.google.com/webstore/detail/adblock/gighmmpiobklfepjocnamgkkbiglidom

tente desinstalar no crome extençao  adblok no painel control do crome ou do firefox e o que penço e uma extençao ,mas nao quer dizer que e virus,

faça uma varredura com este programa http://pt.malwarebytes.org/

o relatiorio do Zhpdiag

~ Relatório do ZHPDiag v2014.3.2.6 - Nicolas Coolman  (03-03-2014)

~ Iniciado por Nanda (03-03-2014 17:44:29)

~ Endereço do Website :  http://nicolascoolman.webs.com

~ Fóruns de suporte gratuito para desinfecção : http://nicolascoolman.webs.com/apps/links/

~ Tradução pelo utilizador

~ Estatuto da versão : 

~  Lista Branca : Ativado pelo programa

~ Elevação dos Privilégios : OK

~ Controle de Conta de Utilizador : Deactivate by program

---\ Navegadores Internet

MSIE: Internet Explorer v11.0.9600.16518

GCIE: Google Chrome v33.0.1750.117 (Defaut)

---\ Informações sobre os produtos Windows

~ Langage: Portugais

Windows 7 Professional, 32-bit Service Pack 1 (Build 7601)

Windows Server License Manager Script : OK

Software Protection Service (Protection logicielle) : OK

Windows Automatic Updates : OK

Windows Activation Technologies : OK

---\ Softwares de proteçao do sistema

Malwarebytes Anti-Malware versão 1.75.0.1300

Microsoft Security Client PT-BR Language Pack v2.1.1116.0

Windows Defender W7

---\ Softwares d'optimização do sistema

---\ Softwares de partilha do PeerToPeer (P2P)

Pando Media Booster v2.6.0.7

µTorrent v3.1.3 =>P2P.µTorrent

---\ Monitoramento dos softwares

Adobe Flash Player 11 Plugin

Adobe Reader X

Java 7 Update 51

---\ Informações sobre o sistema

~ Processor: x86 Family 6 Model 15 Stepping 13, GenuineIntel

~ Operating System: 32 Bits

Boot mode: Normal (Normal boot)

Total RAM: 2046 MB (38% free)

System Restore: Activé (Enable)

System drive C: has 51 GB (17%) free of 288 GB

---\ Modo de conexão ao sistema

~ Computer Name: NANDA-PC

~ User Name: Nanda

~ All Users Names: Nanda, HomeGroupUser$, Convidado, ASPNET, Administrador, 

~ Unselected Option: 045,061,O62,065,066,080,O82,089

Logged in as Administrator

---\ As variáveis de ambiente

~ System Unit : C:\

~ %AppZHP% : C:\Users\Nanda\AppData\Roaming\ZHP\

~ %AppData% : C:\Users\Nanda\AppData\Roaming\

~ %Desktop% : C:\Users\Nanda\Desktop\

~ %Favorites% : C:\Users\Nanda\Favorites\

~ %LocalAppData% : C:\Users\Nanda\AppData\Local\

~ %StartMenu% : C:\Users\Nanda\AppData\Roaming\Microsoft\Windows\Start Menu\

~ %Windir% : C:\Windows\

~ %System% : C:\Windows\System32\

---\ Enumeração das unidades dos discos

C: Hard drive, Flash drive, Thumb drive (Free 51 Go of 288 Go)

D: CD-ROM drive (Not Inserted)

---\ Estado do Centro de Segurança do Windows

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced] Start_ShowMyGames: Modified

~ Security Center: 45 Legitimates Filtered in 00mn 00s

---\ Pesquisa particular de ficheiros genéricos

[MD5.8B88EBBB05A0E56B7DCC708498C02B3E] - (.Microsoft Corporation - Explorador do Windows.) (.25-02-2011 - 05:30:54.) -- C:\Windows\Explorer.exe [2616320]

[MD5.B5C5DCAD3899512020D135600129D665] - (.Microsoft Corporation - Aplicação de Arranque do Windows.) (.14-07-2009 - 01:14:45.) -- C:\Windows\System32\Wininit.exe [96256]

[MD5.9C89246184979A070B0C6CCF61C68136] - (.Microsoft Corporation - Extensões da Internet para Win32.) (.06-02-2014 - 08:41:35.) -- C:\Windows\System32\wininet.dll [1820160]

[MD5.6D13E1406F50C66E2A95D97F22C47560] - (.Microsoft Corporation - Aplicação de início de sessão do Windows.) (.20-11-2010 - 12:17:54.) -- C:\Windows\System32\Winlogon.exe [286720]

[MD5.E3AE23569749DE12D45BA3B489A036AE] - (.Microsoft Corporation - Biblioteca de Licenciamento de Software.) (.20-11-2010 - 12:21:24.) -- C:\Windows\System32\sppcomapi.dll [193536]

[MD5.F81BB7E487EDCEAB630A7EE66CF23913] - (.Microsoft Corporation - Ancillary Function Driver for WinSock.) (.14-09-2013 - 00:48:58.) -- C:\Windows\system32\Drivers\AFD.sys [338944]

[MD5.338C86357871C167A96AB976519BF59E] - (.Microsoft Corporation - ATAPI IDE Miniport Driver.) (.14-07-2009 - 01:26:15.) -- C:\Windows\system32\Drivers\atapi.sys [21584]

[MD5.77EA11B065E0A8AB902D78145CA51E10] - (.Microsoft Corporation - CD-ROM File System Driver.) (.13-07-2009 - 23:11:15.) -- C:\Windows\system32\Drivers\Cdfs.sys [70656]

[MD5.BE167ED0FDB9C1FA1133953C18D5A6C9] - (.Microsoft Corporation - SCSI CD-ROM Driver.) (.20-11-2010 - 08:38:10.) -- C:\Windows\system32\Drivers\Cdrom.sys [108544]

[MD5.F024449C97EC1E464AAFFDA18593DB88] - (.Microsoft Corporation - DFS Namespace Client Driver.) (.20-11-2010 - 08:42:32.) -- C:\Windows\system32\Drivers\DfsC.sys [78336]

[MD5.9036377B8A6C15DC2EEC53E489D159B5] - (.Microsoft Corporation - High Definition Audio Bus Driver.) (.20-11-2010 - 09:59:29.) -- C:\Windows\system32\Drivers\HDAudBus.sys [108544]

[MD5.F151F0BDC47F4A28B1B20A0818EA36D6] - (.Microsoft Corporation - Controlador de porta i8042.) (.13-07-2009 - 23:11:24.) -- C:\Windows\system32\Drivers\i8042prt.sys [80896]

[MD5.A5FA468D67ABCDAA36264E463A7BB0CD] - (.Microsoft Corporation - IP Network Address Translator.) (.13-07-2009 - 23:54:29.) -- C:\Windows\system32\Drivers\IpNat.sys [101888]

[MD5.5D16C921E3671636C0EBA3BBAAC5FD25] - (.Microsoft Corporation - Windows NT SMB Minirdr.) (.27-04-2011 - 02:17:22.) -- C:\Windows\system32\Drivers\MRxSmb.sys [123904]

[MD5.280122DDCF04B378EDD1AD54D71C1E54] - (.Microsoft Corporation - MBT Transport driver.) (.20-11-2010 - 08:39:44.) -- C:\Windows\system32\Drivers\netBT.sys [187904]

[MD5.5E43D2B0EE64123D4880DFA6626DEFDE] - (.Microsoft Corporation - Controlador de Sistema de Ficheiros NT.) (.12-04-2013 - 13:45:29.) -- C:\Windows\system32\Drivers\ntfs.sys [1211752]

[MD5.2EA877ED5DD9713C5AC74E8EA7348D14] - (.Microsoft Corporation - Controlador de porta paralela.) (.13-07-2009 - 23:45:35.) -- C:\Windows\system32\Drivers\Parport.sys [79360]

[MD5.D9F91EAFEC2815365CBE6D167E4E332A] - (.Microsoft Corporation - RAS L2TP mini-port/call-manager driver.) (.13-07-2009 - 23:54:34.) -- C:\Windows\system32\Drivers\Rasl2tp.sys [78848]

[MD5.B973FCFC50DC1434E1970A146F7E3885] - (.Microsoft Corporation - Microsoft RDP Device redirector.) (.20-11-2010 - 10:24:46.) -- C:\Windows\system32\Drivers\rdpdr.sys [133632]

[MD5.3E21C083B8A01CB70BA1F09303010FCE] - (.Microsoft Corporation - SMB Transport driver.) (.13-07-2009 - 23:53:41.) -- C:\Windows\system32\Drivers\smb.sys [71168]

[MD5.B459575348C20E8121D6039DA063C704] - (.Microsoft Corporation - TDI Translation Driver.) (.20-11-2010 - 08:39:17.) -- C:\Windows\system32\Drivers\tdx.sys [74752]

[MD5.F497F67932C6FA693D7DE2780631CFE7] - (.Microsoft Corporation - Controlador de cópia sombra do volume.) (.20-11-2010 - 12:30:16.) -- C:\Windows\system32\Drivers\volsnap.sys [245632]

~ Generic Processes:  Scanned in 00mn 01s

---\ Estatuto dos ficheiros ocultos (Oculto/Total)

~ Mes images (My Pictures) : 2/27

~ Mes musiques (My Musics) : 1/35

~ Mes Favoris (My Favorites) : 1/8

~ Mes Documents (My Documents) : 2/52087

~ Mon Bureau (My Desktop) : 2/149159

~ Menu demarrer (Programs) : 1/111

~ Hidden Files:  Scanned in 06mn 54s

---\ Processos lançados

[MD5.4B9949208944C50B1A16FD1F05ED0A04] - (.Advanced Micro Devices Inc. - Catalyst Control Center: Monitoring program.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe   [299008] [PID.2020]

[MD5.E774F875819DEE4A312A921A88F779FE] - (.Microsoft Corporation - IPoint.exe.) -- C:\Program Files\Microsoft IntelliPoint\ipoint.exe   [1821576] [PID.320]

[MD5.DE7F11C59789AD6616F2381BBC48A97F] - (.Valve Corporation - Steam Client Bootstrapper.) -- C:\Program Files\Steam\Steam.exe   [1821888] [PID.2092]

[MD5.CB3638541DCAC86EE17FA8258202E20E] - (.Oracle Corporation - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre7\bin\javaw.exe   [175016] [PID.2192]

[MD5.42E59AED70580B4AB64CF5CB96ABBAB9] - (.TuneUp Software - TuneUp Utilities.) -- C:\Program Files\TuneUp Utilities 2013\TuneUpUtilitiesApp32.exe   [1869152] [PID.2852]

[MD5.1184C3DD9A5D7088246E974DC252FDAF] - (...) -- C:\Users\Nanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1636746858.exe   [3049962] [PID.2992]

[MD5.A9950F1C63BA70151803C6F24CEE23F3] - (.ATI Technologies Inc. - Catalyst Control Center: Host application.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe   [299008] [PID.3156]

[MD5.E7B4B0C13B2CA32A106B6AD6C5526631] - (...) -- C:\Users\Nanda\AppData\Local\Temp\IntelDev.exe   [2741208] [PID.3512]

[MD5.1184C3DD9A5D7088246E974DC252FDAF] - (...) -- C:\Users\Nanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026459690.exe   [3049962] [PID.3648]

[MD5.5B6E8E09BE6401A7E022F52FDFCB2FF8] - (.Oracle Corporation - Java(TM) Update Scheduler.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe   [254336] [PID.3264]

[MD5.DD84B26FFC01B871657EF645014AB8F5] - (.Microsoft Corporation - Notepad.) -- C:\Users\Nanda\AppData\Roaming\Adlock.exe   [2435072] [PID.6068]

[MD5.6E6656C6618C4B0B000267D9AF9EF743] - (.Google Inc. - Google Chrome.) -- C:\Users\Nanda\AppData\Local\Google\Chrome\Application\chrome.exe   [859464] [PID.1808]

[MD5.66EA3B698F9A7EA2DBF0E4B246B6C958] - (.Nicolas Coolman - ZHPDiag.) -- C:\Program Files\ZHPDiag\ZHPDiag.exe   [8349696] [PID.2280]

~ Processes Running:  Scanned in 00mn 02s

---\ Google Chrome, Arranque,Pesquisa,Extensões (G0,G1,G2)

C:\Users\Nanda\AppData\Local\Google\Chrome\User Data\Default\Preferences

G2 - GCE: Preference [User Data\Default] [ahfgeienlihckogmohjhadlkjgocpleb] Loja v.0.2 (Activé)

G2 - GCE: Preference [User Data\Default] [neajdppkdcdipfabeoofebfddakdcjhd] Google Network Speech v.1.0 (Activé)

G2 - GCE: Preference [User Data\Default] [nkeimhogjdpnpccoofpliimaahmaaome] Hangout Services v.1.0 (Activé)

~ Google Browser: 15 Legitimates Filtered in 00mn 03s

---\ Mozilla Firefox, Plugins,Arranque,Pesquisa,Extensões (P2,M0,M1,M2,M3)

C:\Users\Nanda\AppData\Roaming\Mozilla\Firefox\Profiles\0\prefs.js

C:\Users\Nanda\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js

P2 - FPN: [HKCU] [@lightspark.github.com/Lightspark;version=1] - (.No owner - Flash.) -- C:\Program Files\Lightspark 0.5.3-git\nplightsparkplugin.dll

~ Firefox Browser: 13 Legitimates Filtered in 00mn 00s

---\ Internet Explorer, Arranque, Pesquisa, URLSearchHook( gancho de URL), Phishing (R0,R1,R3,R4)

R3 - URLSearchHook: Ashampoo_BR Toolbar - {e7cb019e-bf3b-4c48-9673-48c323b18e31} . (.Pando Networks - Pando Web Plugin.) (No version) -- (.not file.)

R3 - URLSearchHook: Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} . (.Pando Networks - Pando Web Plugin.) (No version) -- (.not file.)

~ IE Browser: 16 Legitimates Filtered in 00mn 00s

---\ Internet Explorer, Gestão do Proxy (R5)

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = no key

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyEnable = 0

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,EnableHttp1_1 = 1

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigProxy = wininet.dll

~ Proxy management:  Scanned in 00mn 00s

---\ Análise das linhas F0, F1, F2, F3 - Ficheiros ini, Carregamento Automático de programas

F2 - REG:system.ini: USERINIT=C:\Windows\system32\userinit.exe,

F2 - REG:system.ini: Shell=C:\Windows\explorer.exe

F2 - REG:system.ini: VMApplet=C:\Windows\System32\SystemPropertiesPerformance.exe

~ Keys:  Scanned in 00mn 00s

---\ Redireção do ficheiro Hosts (01)

~ Le fichier hosts est sain (The hosts file is clean).

~ Hosts File:  Scanned in 00mn 00s

~ Nombre de lignes (Lines number): 23

---\ Browser Helper Objects do navegador (02)

O2 - BHO: Ashampoo_BR Toolbar - {e7cb019e-bf3b-4c48-9673-48c323b18e31} . (...) -- C:\Users\Nanda\AppData\LocalLow\CT2481031\ldrtbAsha.dll

~ BHO: 8 Legitimates Filtered in 00mn 00s

---\ Barras do Internet Explorer (03))

O3 - Toolbar: Ashampoo_BR Toolbar - [HKLM]{e7cb019e-bf3b-4c48-9673-48c323b18e31} . (...) -- C:\Users\Nanda\AppData\LocalLow\CT2481031\ldrtbAsha.dll

O3 - Toolbar\WebBrowser: (no name) - [HKCU]{E7CB019E-BF3B-4C48-9673-48C323B18E31} Chave orfã

~ Toolbar:  Scanned in 00mn 00s

---\ Outras conexões do utilizador (04)

O4 - GS\Desktop [Public]: YTD Video Downloader.lnk . (.GreenTree Applications SRL - YTD Video Downloader.)  -- C:\Program Files\YTD YouTube Downloader & Converter\ytd.exe =>PUP.Dealio

O4 - GS\QuickLaunch [Nanda]: BitTorrent.lnk . (.BitTorrent Inc. - BitTorrent.)  -- C:\Program Files\BitTorrent\BitTorrent.exe =>P2P.BitTorrent

O4 - GS\QuickLaunch [Nanda]: Launch Internet Explorer Browser.lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files\Internet Explorer\iexplore.exe 

O4 - GS\QuickLaunch [Nanda]: Xilisoft PDF to PowerPoint Converter.lnk . (...)  -- C:\Program Files\Xilisoft\PDF to PowerPoint Converter\pdf2ppt.exe

O4 - GS\QuickLaunch [Nanda]: µTorrent.lnk . (.BitTorrent Inc. - µTorrent.)  -- C:\Program Files\uTorrent\uTorrent.exe =>P2P.BitTorrent

O4 - GS\TaskBar [Nanda]: BitLord.lnk . (...)  -- C:\Program Files\BitLord 2\Bitlord files\bitlord.exe (.not file.) =>Adware.WhenUSave

O4 - GS\TaskBar [Nanda]: Google Chrome.lnk . (.Google Inc. - Google Chrome.)  -- C:\Users\Nanda\AppData\Local\Google\Chrome\Application\chrome.exe 

O4 - GS\Program [Nanda]: Cubby.lnk . (.LogMeIn, Inc. - Cubby.)  -- C:\Users\Nanda\AppData\Roaming\cubby\cubby.exe 

O4 - GS\Program [Nanda]: Internet Explorer.lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files\Internet Explorer\iexplore.exe 

O4 - GS\SystemTools [Nanda]: Internet Explorer (No Add-ons).lnk . (.Microsoft Corporation - Internet Explorer.)  -- C:\Program Files\Internet Explorer\iexplore.exe 

O4 - GS\Desktop [Nanda]: FalloutLauncher - Atalho.lnk . (.Bethesda Softworks - Fallout 3 Launcher.)  -- C:\Program Files\Bethesda Softworks\Fallout 3\FalloutLauncher.exe 

O4 - GS\Desktop [Nanda]: Format Factory.lnk . (.Free Time - FormatFactory.)  -- C:\Program Files\FreeTime\FormatFactory\FormatFactory.exe 

O4 - GS\Desktop [Nanda]: System Shock 2.lnk . (.Looking Glass Studios - System Shock 2.)  -- C:\Games\Sshock2\shock2.exe 

O4 - GS\Desktop [Nanda]: TESV - Atalho.lnk . (.Bethesda Softworks - Skyrim.)  -- C:\Program Files\The Elder Scrolls V Skyrim\TESV.exe 

~ Global Startup: 65 Legitimates Filtered in 00mn 02s

---\ Aplicações iniciadas por registo & pastas (04)

O4 - HKLM..\Run: [MSC] . (.Microsoft Corporation - Microsoft Security Client User Interface.) -- c:\Program Files\Microsoft Security Client\msseces.exe 

O4 - HKLM..\Run: [Adobe] C:\ProgramData\Adobe\50E60B.vbe (.not file.) 

O4 - HKLM..\Run: [StartCCC] . (.Advanced Micro Devices, Inc. - Catalyst® Control Center Launcher.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe  =>.Advanced Micro Devices, Inc

O4 - HKLM..\Run: [AMD AVT] . (.Microsoft Corporation - Processador de comandos do Windows.) -- C:\Windows\System32\Cmd.exe 

O4 - HKLM..\Run: [IntelliPoint] . (.Microsoft Corporation - IPoint.exe.) -- c:\Program Files\Microsoft IntelliPoint\ipoint.exe 

O4 - HKCU..\Run: [Steam] . (.Valve Corporation - Steam Client Bootstrapper.) -- C:\Program Files\Steam\steam.exe 

O4 - HKCU..\Run: [Microsoft Interface Controller] . (.No owner - Microsoft Controller.) -- C:\GPU_UPDATE\MSController.exe 

O4 - HKCU..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files\DAEMON Tools Lite\DTLite.exe  =>.DT Soft Ltd

O4 - HKCU..\Run: [jawaw] . (.Oracle Corporation - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre7\bin\javaw.exe 

O4 - HKUS\S-1-5-19..\Run: [Sidebar] . (.Microsoft Corporation - Miniaplicações de Ambiente de Trabalho do W.) -- C:\Program Files\Windows Sidebar\Sidebar.exe 

O4 - HKUS\S-1-5-20..\Run: [Sidebar] . (.Microsoft Corporation - Miniaplicações de Ambiente de Trabalho do W.) -- C:\Program Files\Windows Sidebar\Sidebar.exe 

O4 - HKUS.DEFAULT..\RunOnce: [SPReview] . (.Microsoft Corporation - SP Reviewer.) -- C:\Windows\System32\SPReview\SPReview.exe  =>.Microsoft Corporation

O4 - HKUS\S-1-5-18..\RunOnce: [SPReview] . (.Microsoft Corporation - SP Reviewer.) -- C:\Windows\System32\SPReview\SPReview.exe  =>.Microsoft Corporation

O4 - HKUS\S-1-5-19..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe  =>.Microsoft Corporation

O4 - HKUS\S-1-5-20..\RunOnce: [mctadmin] . (.Microsoft Corporation - MCTAdmin.) -- C:\Windows\System32\mctadmin.exe  =>.Microsoft Corporation

O4 - HKUS\S-1-5-21-3983158026-637607574-1965650666-1001..\Run: [Steam] . (.Valve Corporation - Steam Client Bootstrapper.) -- C:\Program Files\Steam\steam.exe 

O4 - HKUS\S-1-5-21-3983158026-637607574-1965650666-1001..\Run: [Microsoft Interface Controller] . (.No owner - Microsoft Controller.) -- C:\GPU_UPDATE\MSController.exe 

O4 - HKUS\S-1-5-21-3983158026-637607574-1965650666-1001..\Run: [DAEMON Tools Lite] . (.Disc Soft Ltd - DAEMON Tools Lite.) -- C:\Program Files\DAEMON Tools Lite\DTLite.exe  =>.DT Soft Ltd

O4 - HKUS\S-1-5-21-3983158026-637607574-1965650666-1001..\Run: [jawaw] . (.Oracle Corporation - Java(TM) Platform SE binary.) -- C:\Program Files\Java\jre7\bin\javaw.exe 

~ Application:  Scanned in 00mn 00s

---\ Boutões da barra de ferramentas principal do Internet Explorer (09)

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} . (...) -- C:\Program Files\Microsoft Office\Office12\REFBARH.ICO

~ IE Extra Buttons:  Scanned in 00mn 00s

---\ Alteração Dominio/Clientes DNS (017)

O17 - HKLM\System\CCS\Services\Tcpip..{DE0EF1BE-2845-405A-A52A-BF53F04EA5B1}: NameServer = 192.168.1.254,192.168.1.254

O17 - HKLM\System\CS1\Services\Tcpip..{DE0EF1BE-2845-405A-A52A-BF53F04EA5B1}: NameServer = 192.168.1.254,192.168.1.254

O17 - HKLM\System\CS2\Services\Tcpip..{DE0EF1BE-2845-405A-A52A-BF53F04EA5B1}: NameServer = 192.168.1.254,192.168.1.254

~ Domain:  Scanned in 00mn 00s

---\ Protocolo adicional (018)

O18 - Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} . (.Microsoft Corporation - Photo Gallery Album Download Protocol Handl.) -- C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll  =>.Microsoft Corporation

O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} . (.Microsoft Corporation - Microsoft Office XML MIME Filter.) -- C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.dll  =>.Microsoft Corporation

~ Protocole Additionnel:  Scanned in 00mn 00s

---\ Tarefas planificadas automaticamente (039)

[MD5.00000000000000000000000000000000] [APT] [Express Files Updater] (...) -- C:\Program Files\ExpressFiles\EFupdater.exe (.not file.)   [0]  =>Adware.ExpressFiles

[MD5.00000000000000000000000000000000] [APT] [{17BC20FF-4EBB-4315-88B4-2D4A6FC49896}] (...) -- C:\Program Files\THQ\Titan Quest\Titan Quest.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{2BE90E49-C2B5-4D03-B7B0-8F02DE4AF4B1}] (...) -- F:\Setup.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{2CD2DFC4-28B1-4147-9AE9-A5100CB3A996}] (...) -- C:\Users\Nanda\Desktop\CS\ZBot - CS Online.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{46C28C51-AAAF-47EE-84A5-94D899E5EA8A}] (...) -- C:\Program Files\THQ\Titan Quest\Titan Quest.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{46E5696B-4D94-4D1E-96EE-A43CA2B7C24A}] (...) -- E:\INSTALL.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{6C7C9F4A-CDBD-46E4-A5DA-743C0F367474}] (...) -- C:\Users\Nanda\Desktop\Spore\setup.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{740D1ED0-478E-4CE4-9D0C-A1C8B8ECA25F}] (...) -- C:\Users\Nanda\Desktop\Counter-Strike 1.6.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{75CC13E5-1FBB-46F5-81BF-AFC18FA59BAD}] (...) -- C:\Users\Nanda\Desktop\Games\C.S\Counter-Strike 1.6.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{762FFBF5-A747-4C12-AA84-B46D85B5EFC3}] (...) -- C:\Program Files\THQ\Titan Quest\Titan Quest.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{8104133F-D067-435D-BB68-CD6606DF5183}] (...) -- E:\Setup.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{81AAEED0-AAFB-4B21-B3E7-4EC91487BF07}] (...) -- C:\Users\Nanda\Desktop\planetary annihilation\Planetary Annihilation\PA.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{84803AD6-5450-4107-9E72-95BA3B3F3C97}] (...) -- E:\GDFTHR_inst.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{84DD3A10-59E8-452C-897C-C92E2198117C}] (...) -- C:\Users\Nanda\Desktop\Games\LOL\Yume Nikki 0.10 English v3.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{9029AB71-DE85-4DA9-BCD9-5DFD29A0FEB2}] (...) -- C:\Users\Nanda\Desktop\Nova pasta (2)\Ryona Rpg\RPG Maker 2000 107E\RPG-Maker-2000-107E.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{9327C333-A394-4B37-8FA7-12ADF33F2AE0}] (...) -- C:\Users\Nanda\Desktop\planetary annihilation\Planetary Annihilation\PA.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{B2020719-1A98-4865-BFC8-D7108DFB999A}] (...) -- C:\Users\Nanda\Desktop\planetary annihilation\Planetary Annihilation\PA.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{C46D5DD2-870C-4CED-A773-A2E3A91927F8}] (...) -- C:\Program Files\Kalypso\Imperium Romanum\Imperium Romanum.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{C794BCB7-1935-4011-A273-57315A7261CE}] (...) -- C:\Users\Nanda\Desktop\planetary annihilation\Planetary Annihilation\PA.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{CBB9CEF9-A189-45DD-BA9F-851FC75B1E9E}] (...) -- C:\Users\Nanda\Desktop\apploc (1).msi" (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{CE9E4D5D-40C5-4278-95F8-F2CBA99C274E}] (...) -- E:\AvP_Setup_Launcher.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{D1A39160-8E96-4A95-B17A-14DA5555BB7B}] (...) -- C:\Users\Nanda\Desktop\Downloads\Age-of-Empires-Classico-www.therebels.com.br.by.mike\setup.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{E29A42AF-D52E-4A94-A6A4-FF56DD747971}] (...) -- C:\Users\Nanda\Desktop\planetary annihilation\Planetary Annihilation\PA.exe (.not file.)   [0]

[MD5.00000000000000000000000000000000] [APT] [{F91DF0D5-9BD3-44D1-9891-0F000C9DB2F3}] (...) -- C:\Users\Nanda\Desktop\planetary annihilation\Planetary Annihilation\PA.exe (.not file.)   [0]

[MD5.2C753E9EFFAFDE7026CCEFED817F6D49] [APT] [{F92B6008-F898-4E18-A352-60982BC32D39}] (.TODO: <Company name>.) -- C:\Program Files\THQ\Dawn of War - Dark Crusade\DXP2-111-120.exe   [40645489]

[MD5.00000000000000000000000000000000] [APT] [{FE396A7D-B352-4F96-9B39-0C6DC218842A}] (...) -- C:\Users\Nanda\Desktop\NO$GBA.exe (.not file.)   [0]

~ Scheduled Task: 43 Legitimates Filtered in 00mn 16s

---\ Software instalados (042)

O42 - Logiciel: AS3 Class Diagram Viewer - (.JPL Productions.) [HKLM] -- com.jplprod.AS3viewer.A55F0C2D4E87165FB572446EEEB127111F48E3DA.1

O42 - Logiciel: AS3 Class Diagram Viewer - (.JPL Productions.) [HKLM] -- {8B9B5360-7FDE-0150-6CEC-161140572520}

O42 - Logiciel: BitLord 2.3 - (.House of Life.) [HKLM] -- BitLord =>Adware.WhenUSave

O42 - Logiciel: DoWpro 3.40 Full Installer - (...) [HKLM] -- DoWpro

O42 - Logiciel: Earth 2160 - (.Zuxxez Entertainment AG.) [HKLM] -- Earth 2160

O42 - Logiciel: FireWarrior - (...) [HKLM] -- FireWarriorA00

O42 - Logiciel: Inquisition Daemonhunt - (...) [HKLM] -- Inquisition Daemonhunt

O42 - Logiciel: Simple Port Forwarding - (.PcWinTech.com.) [HKLM] -- Simple Port Forwarding

O42 - Logiciel: UA Grand Release - (...) [HKLM] -- UA Grand Release

O42 - Logiciel: Windows Frotz - (...) [HKLM] -- WindowsFrotz

O42 - Logiciel: YTD Toolbar v6.2 - (.Spigot, Inc..) [HKLM] -- {BCC315E7-2E8F-4EFD-8A0B-F8F276FE73F2} =>PUP.Dealio

O42 - Logiciel: Yume Nikki 0.10 English v3 - (...) [HKCU] -- Yume Nikki 0.10 English v3

O42 - Logiciel: the white chamber 1.0 - (.Studio Trophis.) [HKLM] -- the white chamber

~ Logic: 18 Legitimates Filtered in 00mn 03s

---\ HKCU & HKLM Software Keys

[HKCU\Software\A.N.]

[HKCU\Software\AQW Helpers]

[HKCU\Software\ARAR]

[HKCU\Software\Celsys]

[HKCU\Software\Criador de icones]

[HKCU\Software\DataLab]

[HKCU\Software\DoWpro]

[HKCU\Software\Full Control]

[HKCU\Software\IFDB.tads.org]

[HKCU\Software\IncrediMail]

[HKCU\Software\JamesR]

[HKCU\Software\MS]

[HKCU\Software\MarbleStone]

[HKCU\Software\Pando Networks]

[HKCU\Software\Pelikan13]

[HKCU\Software\Russobit-M]

[HKCU\Software\SETTEC]

[HKCU\Software\SMTTB2009]

[HKCU\Software\Studio Trophis]

[HKCU\Software\YTD]

[HKCU\Software\Zeus Slaves]

[HKCU\Software\cpu.eng]

[HKCU\Software\eBook Maestro Books]

[HKLM\Software\Celsys]

[HKLM\Software\Fox Interactive]

[HKLM\Software\IFDB.tads.org]

[HKLM\Software\Kuju]

[HKLM\Software\Looking Glass Studios]

[HKLM\Software\Pando Networks]

[HKLM\Software\YTD]

[HKLM\Software\id]

~ Key Software: 444 Legitimates Filtered in 00mn 03s

---\ Conteúdo das pastas Programs/ProgramFiles/ProgramData/AppData (O43)

O43 - CFD: 05-11-2012 - 19:31:19 - [265,969] ----D C:\Program Files\Blade Kitten

O43 - CFD: 26-06-2012 - 23:35:31 - [0,878] ----D C:\Program Files\Desliga Aí!

O43 - CFD: 21-11-2011 - 11:35:30 - [0] -SH-D C:\Program Files\Ficheiros comuns

O43 - CFD: 06-11-2013 - 18:51:39 - [7,182] ----D C:\Program Files\Pando Networks

O43 - CFD: 04-04-2012 - 21:56:38 - [0,174] ----D C:\Program Files\PCSleek

O43 - CFD: 03-09-2012 - 17:10:22 - [1,613] ----D C:\Program Files\Windows Frotz

O43 - CFD: 21-11-2011 - 11:35:30 - [0] -SH-D C:\ProgramData\Ambiente de trabalho

O43 - CFD: 05-05-2012 - 19:11:59 - [0] ----D C:\ProgramData\CELSYS

O43 - CFD: 10-04-2012 - 20:56:08 - [0] ----D C:\ProgramData\RegCure =>Rogue.RegCure

O43 - CFD: 08-09-2012 - 22:31:14 - [0,001] ----D C:\Users\Nanda\AppData\Roaming\AniTuner

O43 - CFD: 23-07-2013 - 16:46:17 - [9,679] ----D C:\Users\Nanda\AppData\Roaming\cubby

O43 - CFD: 30-08-2012 - 14:35:40 - [97,606] ----D C:\Users\Nanda\AppData\Roaming\DarksporeData

O43 - CFD: 19-07-2013 - 17:47:13 - [0,001] ----D C:\Users\Nanda\AppData\Roaming\desunoya

O43 - CFD: 01-02-2014 - 20:00:40 - [0] -SH-D C:\Users\Nanda\AppData\Roaming\f4061

O43 - CFD: 20-08-2013 - 14:44:30 - [0,010] ----D C:\Users\Nanda\AppData\Roaming\Full Control

O43 - CFD: 21-01-2012 - 19:43:24 - [0,001] ----D C:\Users\Nanda\AppData\Roaming\GuiltyGearIsukaNA

O43 - CFD: 03-03-2014 - 17:15:06 - [0,324] ----D C:\Users\Nanda\AppData\Roaming\PC-Gizmos

O43 - CFD: 27-09-2012 - 21:29:36 - [0,103] ----D C:\Users\Nanda\AppData\Roaming\’O‰ºŒ“¬‹äŠy•”

O43 - CFD: 03-11-2013 - 02:59:42 - [0,001] ----D C:\Users\Nanda\AppData\Local\28050

O43 - CFD: 03-11-2013 - 13:23:58 - [0,042] ----D C:\Users\Nanda\AppData\Local\76561198054123322

O43 - CFD: 27-10-2013 - 03:09:01 - [0] ----D C:\Users\Nanda\AppData\Local\gemHEX a1

O43 - CFD: 25-08-2012 - 12:56:18 - [4,248] ----D C:\Users\Nanda\AppData\Local\rgewrg

O43 - CFD: 28-01-2013 - 19:43:12 - [0,002] ----D C:\Users\Nanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Counter Strike 1.6 - 2012

O43 - CFD: 17-11-2013 - 02:49:41 - [0] ----D C:\Users\Nanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DoWpro 3.40 Full Installer

O43 - CFD: 13-12-2012 - 19:26:14 - [0,002] ----D C:\Users\Nanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Simple Port Forwarding

O43 - CFD: 12-12-2012 - 23:10:45 - [0] ----D C:\Users\Nanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\the white chamber

O43 - CFD: 23-11-2012 - 18:45:34 - [0,005] ----D C:\Users\Nanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\To the Moon

O43 - CFD: 03-09-2012 - 17:10:22 - [0,004] ----D C:\Users\Nanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Frotz

O43 - CFD: 03-12-2012 - 18:14:44 - [0,002] ----D C:\Users\Nanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Yume Nikki 0.10 English v3

~ Program Folder: 306 Legitimates Filtered in 03mn 41s

---\ Últimos ficheiros alterados ou criados no Windows e Sistema32 (044)

O44 - LFC:[MD5.CC7AA7B42CF418FC3D926913490048F8] - 02-03-2014 - 19:16:41 ---A- . (...) -- C:\Windows\zoek-delete.exe   [24064]

O44 - LFC:[MD5.7343B8C1305D8AE1928B03EC47493AED] - 02-03-2014 - 19:49:23 ---A- . (...) -- C:\zoek-results.log   [30470]

O44 - LFC:[MD5.44A51E1DAC768BC671632784BCAEFE15] - 03-03-2014 - 17:49:50 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0   [25424]

O44 - LFC:[MD5.44A51E1DAC768BC671632784BCAEFE15] - 03-03-2014 - 17:49:50 --HA- . (...) -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0   [25424]

O44 - LFC:[MD5.BF34E901456C87A29AF2BC04249F47CF] - 26-02-2014 - 23:21:03 ---A- . (...) -- C:\Windows\System32\prfc0816.dat   [158542]

O44 - LFC:[MD5.5B590460F30DDD5B8E9BD973D5634477] - 26-02-2014 - 23:21:03 ---A- . (...) -- C:\Windows\System32\prfh0816.dat   [731052]

~ Files: 29 Legitimates Filtered in 00mn 26s

---\ Image File Execution Options (IFEO) (O50)

O50 - IFEO:Image File Execution Options - cfosspeed.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe"

O50 - IFEO:Image File Execution Options - hamachi-2-ui.exe - "C:\Program Files\TuneUp Utilities 2013\TUAutoReactivator32.exe"

~ IFEO:  Scanned in 00mn 00s

---\ Enumeração das chaves do registo PoliciesSystem (MWPS) (O55)

O55 - MWPS:[HKLM...\Policies\System] - "EnableUIADesktopToggle"=0

O55 - MWPS:[HKLM...\Policies\System] - "FilterAdministratorToken"=0

~ MWPS: 18 Legitimates Filtered in 00mn 00s

---\ Enumeração das chaves do registo PoliciesExplorer (MWPE) (O56)

O56 - MWPE:[HKLM...\policies\Explorer] - "HideSCAHealth"=1

~ MWPE Keys: 1 Legitimates Filtered in 00mn 00s

---\ Lista dos drivers do sistema (SDL) (O58)

O58 - SDL:[MD5.0ED67910C8C326796FAA00B2BF6D9D3C] - 14-07-2009 - 01:20:28 ---A- . (.Emulex - Storport Miniport Driver for LightPulse HBAs.) -- C:\Windows\System32\Drivers\elxstor.sys   [453712]

O58 - SDL:[MD5.C44E3C2BAB6837DB337DDEE7544736DB] - 13-07-2009 - 22:54:14 ---A- . (.Hauppauge Computer Works, Inc. - Hauppauge WinTV 885 Consumer IR Driver for eHome.) -- C:\Windows\System32\Drivers\hcw85cir.sys   [26624]

O58 - SDL:[MD5.DA416DDB775478624088FA341BFEFE37] - 07-12-2013 - 00:05:21 ---A- . (...) -- C:\Windows\System32\Drivers\PnkBstrK.sys   [139832]

O58 - SDL:[MD5.FEB11DBAA5E152D98BD897C97A6DDCD0] - 03-11-2013 - 16:26:46 ---A- . (.Duplex Secure Ltd. - SCSI Pass Through Direct Host.) -- C:\Windows\System32\Drivers\sptd.sys   [324096]

O58 - SDL:[MD5.DB32D325C192B801DF274BFD12A7E72B] - 14-07-2009 - 01:19:04 ---A- . (.Promise Technology - Promise  SuperTrak EX Series Driver for Windows.) -- C:\Windows\System32\Drivers\stexstor.sys   [21072]

O58 - SDL:[MD5.8AAD333C876590293F72B315E162BCC7] - 13-07-2009 - 21:40:41 ---A- . (...) -- C:\Windows\System32\ANSI.SYS   [9029]

O58 - SDL:[MD5.0FE9F16075C9ACB941C957B7C649176E] - 13-07-2009 - 21:40:44 ---A- . (...) -- C:\Windows\System32\country.sys   [27097]

O58 - SDL:[MD5.E6BC0F98FECEF245A0010D350C1A0B9B] - 13-07-2009 - 21:40:40 ---A- . (...) -- C:\Windows\System32\HIMEM.SYS   [4768]

O58 - SDL:[MD5.492090267B9608C62B956CD29BE3AFB7] - 13-07-2009 - 21:40:43 ---A- . (...) -- C:\Windows\System32\KEY01.SYS   [42809]

O58 - SDL:[MD5.FBBCFEC1379C5C02D88A361993EDF1B8] - 13-07-2009 - 21:40:43 ---A- . (...) -- C:\

boas jose, experimentei como disse desinstalar o adblock no painel de controlo mas nao o encontrei.

Ja utilizei o malwarebytes varias vezes mas o problema perssis-te