Virus?!

Outros problemas foram removidos.

___________________________________________

Abra o Malwarebytes que você já tem instalado em seu PC > Faça a atualização dele (update) > Faça uma verificação completa com ele > Quando ele terminar, marque todos os problemas que ele encontrar e clique em Remover Selecionados. Depois disto poste o relatório que ele irá criar aqui no seu tópico.

aqui esta o solicitado.

Junkware Removal Tool (JRT) by Thisisu  

Version: 6.1.2 (02.20.2014:1)  

OS: Windows 7 Professional x86  

Ran by Nanda on 02-03-2014 at 21:52:00,66  

~~~ Registry Values  

~~~ Registry Keys  

Successfully deleted: [Registry Key] HKEY\_CURRENT\_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3983158026-637607574-1965650666-1001\Software\sweetim  

Successfully deleted: [Registry Key] HKEY\_LOCAL\_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4B2468513CA2D6943A1A233CD3F88CE7  

~~~ Files  

Successfully deleted: [File] "C:\Users\Nanda\appdata\locallow\SkwConfig.bin"  

~~~ Folders  

Successfully deleted: [Folder] "C:\ProgramData\pc1data"  

Successfully deleted: [Folder] "C:\Users\Nanda\AppData\Roaming\pc cleaners"  

Successfully deleted: [Folder] "C:\Users\Nanda\AppData\Roaming\pcpro"  

Successfully deleted: [Folder] "C:\Users\Nanda\appdata\locallow\ytd"  

Successfully deleted: [Folder] "C:\Users\Nanda\start menu\programs\browser manager"  

~~~ Event Viewer Logs were cleared  

Scan was completed on 02-03-2014 at 21:56:01,79

End of JRT log

* Siga, por gentileza, as dicas do tutorial abaixo:

Tutorial do Junkware Removal Tool

* Na sua próxima resposta poste, por gentileza, o log do Junkware Removal Tool que estará salvo em sua área de trabalho com o nome de JRT.txt 

Ficamos na espera.

eis o ficheiro Txt do Zoek.

sample\Adlock.exe renamed to DD84B26FFC01B871657EF645014AB8F5 C:\Users\Public\Desktop\sample__1939.zip created successfully ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-3983158026-637607574-1965650666-1001\Software\Microsoft\Internet Explorer\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A} deleted successfully HKEY_USERS\S-1-5-21-3983158026-637607574-1965650666-1001\Software\Microsoft\Internet Explorer\SearchScopes{25B24B0C-679C-47FB-9C2C-F0FCA0F86AC5} deleted successfully HKEY_USERS\S-1-5-21-3983158026-637607574-1965650666-1001\Software\Microsoft\Internet Explorer\SearchScopes{6759D342-7641-4130-9043-7175579C860C} deleted successfully HKEY_USERS\S-1-5-21-3983158026-637607574-1965650666-1001\Software\Microsoft\Internet Explorer\SearchScopes{B83A86FE-D522-4F3C-9218-D35EA51D6497} deleted successfully HKEY_USERS\S-1-5-21-3983158026-637607574-1965650666-1001\Software\Microsoft\Internet Explorer\SearchScopes{D24A1B8C-D1F4-4F17-9809-63FB1A98DA0B} deleted successfully HKEY_USERS\S-1-5-21-3983158026-637607574-1965650666-1001\Software\Microsoft\Internet Explorer\SearchScopes{E35D4394-7242-42FE-8BE4-8BD30F00CB35} deleted successfully ==== Deleting CLSID Registry Values ====================== ==== Deleting Services ====================== ==== FireFox Fix ====================== Deleted from C:\Users\Nanda\AppData\Roaming\Mozilla\Firefox\Profiles\0\prefs.js: Added to C:\Users\Nanda\AppData\Roaming\Mozilla\Firefox\Profiles\0\prefs.js: user_pref("browser.startup.homepage", "http://www.google.com"); user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Searchq="); user_pref("browser.newtab.url", "http://www.google.com/"); user_pref("browser.search.defaultengine", "Google"); user_pref("browser.search.defaultenginename", "Google"); user_pref("browser.search.selectedEngine", "Google"); user_pref("browser.search.order.1", "Google"); user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Searchq="); user_pref("browser.search.suggest.enabled", true); user_pref("browser.search.useDBForOrder", true); Deleted from C:\Users\Nanda\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js: user_pref("browser.search.defaultenginename", "Yahoo"); user_pref("browser.search.selectedEngine", "Yahoo"); user_pref("keyword.URL", "http://search.yahoo.com/search?ei=utf-8fr=greentree_ff1type=937811ilc=12p="); Added to C:\Users\Nanda\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js: user_pref("browser.startup.homepage", "http://www.google.com"); user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Searchq="); user_pref("browser.newtab.url", "http://www.google.com/"); user_pref("browser.search.defaultengine", "Google"); user_pref("browser.search.defaultenginename", "Google"); user_pref("browser.search.selectedEngine", "Google"); user_pref("browser.search.order.1", "Google"); user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Searchq="); user_pref("browser.search.suggest.enabled", true); user_pref("browser.search.useDBForOrder", true); ProfilePath: C:\Users\Nanda\AppData\Roaming\Mozilla\Firefox\Profiles\0 user.js not found ---- FireFox user.js and prefs.js backups ---- prefs__1940_.backup ProfilePath: C:\Users\Nanda\AppData\Roaming\Mozilla\Firefox\Profiles\extensions user.js not found ---- FireFox user.js and prefs.js backups ---- prefs__1940_.backup ==== Registry Fix Code ====================== Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "BrowserMngr Start Page"=- ==== Deleting Files \ Folders ====================== C:\PROGRA~2{32364CEA-7855-4A3C-B674-53D8E9B97936} deleted C:\PROGRA~2{6AD8E59C-250C-4201-B5BA-56ADEF76FF46} deleted C:\PROGRA~2{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F} deleted C:\Users\Nanda\AppData\Roaming\uninstall.bat deleted C:\Users\Nanda\AppData\Roaming\GetRightToGo deleted C:\Users\Nanda\Music\Qtrax Media Library deleted C:\PROGRA~2\Adobe\50E60B.vbe deleted C:\PROGRA~2\WoW Worldwide Software LTD deleted C:\PROGRA~2\InstallMate deleted C:\PROGRA~2\YTD Video Downloader deleted C:\Users\Nanda\AppData\Local\CRE deleted C:\Users\Nanda\AppData\Local\avgchrome deleted C:\Users\Nanda\AppData\Local\Google\Chrome\User Data\Default\External Extensions{EEE6C373-6118-11DC-9C72-001320C79847} deleted C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YTD Video Downloader deleted C:\Users\Nanda\AppData\LocalLow\microsoft\silverlight\outofbrowser\index\portal.qtrax.com deleted C:\Windows\system32\config\systemprofile\AppData\LocalLow\Application Updater deleted C:\Windows\system32\tasks\RunAsStdUser Task deleted C:\Windows\system32\tasks\YourFile DownloaderUpdate deleted C:\user.js deleted C:\prefs.js deleted C:\Windows\System32\tmp7FC7.tmp deleted C:\Windows\System32\tmp8016.tmp deleted C:\Windows\System32\tmpB778.tmp deleted C:\Windows\System32\tmpB805.tmp deleted C:\Windows\System32\searchplugins deleted C:\Windows\System32\Extensions deleted C:\Users\Nanda\AppData\Roaming\Mozilla\Firefox\Profiles\0\extensions*@OneClickDownloader.com.xpi deleted C:\Users\Nanda\AppData\Roaming\Mozilla\Firefox\Profiles\extensions*@OneClickDownload.com deleted "C:\ProgramData\cc1d6cf06c3cdf85d5d41ca3e31233f5_c" deleted "C:\Users\Nanda\AppData\Roaming\Adlock.exe" not deleted "C:\Users\Nanda\AppData\Roaming\tiger-k" deleted ==== Firefox Extensions Registry ====================== [HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions] "@installdaddy.com"="C:\Program Files\fbphotozoom\fbphotozoom14.xpi" [] ==== Firefox Extensions ====================== ExtDir: C:\Users\Nanda\AppData\Roaming\Mozilla\Firefox\Profiles\extensions - GoPhotoIt - %ExtDir%*@gophoto.it.xpi ==== Firefox Plugins ====================== ==== Deleted Firefox Extensions ====================== C:\Users\Nanda\AppData\Roaming\Mozilla\Firefox\Profiles\extensions*@gophoto.it.xpi deleted ==== Chrome Look ====================== HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions aaaailpifkkekipiachodfkfmgmiapmp - C:\ProgramData\AskPartnerNetwork\Toolbar\SGT-V7\CRX\ToolbarCR.crx[] blmbcjbinolkjkcbmalfhildaohcciih - C:\Users\Nanda\AppData\Local\CRE\blmbcjbinolkjkcbmalfhildaohcciih.crx[] mdebcffgnijbblbinknkbefciofebcda - C:\Users\Nanda\AppData\Local\Temp\ccex.crx[] mpieaakhacmfleokhjcjnpcnmnmpfkid - C:\Program Files\fbphotozoom\fbphotozoom14.crx[] HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions blmbcjbinolkjkcbmalfhildaohcciih - C:\Users\Nanda\AppData\Local\CRE\blmbcjbinolkjkcbmalfhildaohcciih.crx[] YouTube - Nanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo Last updated at time on date - Nanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb Website Blocker Beta - Nanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\hclgegipaehbigmbhdpfapmjadbaldib dawn of war 2 theme - Nanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\iibiokfkhnceehcdlnldfkehkdnnekoi Desprotetor de Links - Nanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\imcbnnnoghiihopefblgehihofbfbmei Grepolis - Nanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\kkgkognjknhcgbgbeijjondlikfkgnog ActiveX for Chrome - Nanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgllffgicojgllpmdbemgglaponefajn Google Wallet - Nanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda ==== Chrome Fix ====================== C:\Users\Nanda\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_websearch.a-searchpage.info_0.localstorage deleted successfully C:\Users\Nanda\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_websearch.a-searchpage.info_0.localstorage-journal deleted successfully C:\Users\Nanda\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_opengl.en.softonic.com_0.localstorage deleted successfully C:\Users\Nanda\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_opengl.en.softonic.com_0.localstorage-journal deleted successfully C:\Users\Nanda\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_teamspeak.softonic.com.br_0.localstorage deleted successfully C:\Users\Nanda\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_teamspeak.softonic.com.br_0.localstorage-journal deleted successfully C:\Users\Nanda\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.softonic.com.br_0.localstorage deleted successfully C:\Users\Nanda\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.softonic.com.br_0.localstorage-journal deleted successfully C:\Users\Nanda\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_blmbcjbinolkjkcbmalfhildaohcciih_0.localstorage deleted successfully C:\Users\Nanda\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_blmbcjbinolkjkcbmalfhildaohcciih_0.localstorage-journal deleted successfully C:\Users\Nanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\cekcjpgehmohobmdiikfnopibipmgnml deleted successfully ==== Set IE to Default ====================== Old Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\g] @="http://www.google.com/cse?cx=partner-pub-9609672093949948%3A2pdkvfm6u5yie=ISO-8859-1q={searchTerms}src=IE-SearchBoxmaxwidth={ie:maxWidth}rowheight={ie:rowHeight}sectionHeight={ie:sectionHeight}FORM=IE8SSCmarket={Language}" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs] "Tabs"="http://www.google.com" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search] "SearchAssistant"="http://www.bing.com/search?q={searchTerms}" "CustomizeSearch"="http://www.bing.com/search?q={searchTerms}" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] No DefaultScope Set For HKCU New Values: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157" [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl] "(Default)"="http://search.msn.com/results.asp?q=%s" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs] "Tabs"="res://ieframe.dll/tabswelcome.htm" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search] "CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm" "SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes] "DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" ==== All HKCU SearchScopes ====================== HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes {0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}src=IE-SearchBoxFORM=IE8SRC" {6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google Url="http://www.google.com/search?q={searchTerms}rls=com.microsoft:{language}ie={inputEncoding}oe={outputEncoding}startIndex={startIndex?}startPage={startPage}" ==== Reset Google Chrome ====================== C:\Users\Nanda\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully C:\Users\Nanda\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully ==== Deleting CLSID Registry Keys ====================== HKEY_USERS\S-1-5-21-3983158026-637607574-1965650666-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats{5347542D-5637-006A-76A7-7A786E7484D7} deleted successfully HKEY_USERS\S-1-5-21-3983158026-637607574-1965650666-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings{5347542D-5637-006A-76A7-7A786E7484D7} deleted successfully HKEY_CLASSES_ROOT\CLSID{5347542D-5637-006A-76A7-7A786E7484D7} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{5347542D-5637-006A-76A7-7A786E7484D7} deleted successfully ==== Deleting CLSID Registry Values ====================== HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar{5347542D-5637-006A-76A7-7A786E7484D7} deleted successfully HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions*@installdaddy.com deleted successfully ==== shortcuts on Users Desktops ====================== C:\Users\Nanda\Desktop\FalloutLauncher - Atalho.lnk - C:\Program Files\Bethesda Softworks\Fallout 3\FalloutLauncher.exe C:\Users\Nanda\Desktop\Format Factory.lnk - C:\Program Files\FreeTime\FormatFactory\FormatFactory.exe C:\Users\Nanda\Desktop\System Shock 2.lnk - C:\Games\Sshock2\shock2.exe C:\Users\Nanda\Desktop\TESV - Atalho.lnk - C:\Program Files\The Elder Scrolls V Skyrim\TESV.exe C:\Users\Nanda\Desktop\ZHPDiag.lnk - C:\Program Files\ZHPDiag\ZHPhep.exe C:\Users\Nanda\Desktop\ZHPFix.lnk - C:\Program Files\ZHPDiag\ZHPFix\ZHPhep.exe C:\Users\Nanda\Desktop\Downloads\Amnesia.The.Dark.Descent-SKIDROW\Amnesia.The.Dark.Descent-SKIDROW - Atalho.lnk - C:\Users\Nanda\Desktop\Downloads\Amnesia.The.Dark.Descent-SKIDROW C:\Users\Nanda\Desktop\Downloads\Amnesia.The.Dark.Descent-SKIDROW\Control Panel.{21EC2020-3AEA-1069-A2DD -08002B30309D}\Lucky Star Etc\ \Malwarebytes Anti-Malware.lnk - C:\Users\Nanda\Desktop\Downloads\Amnesia.The.Dark.Descent-SKIDROW\Control Panel.{21EC2020-3AEA-1069-A2DD -08002B30309D}\Lucky Star Etc\ \TeamSpeak 3 Client.lnk - C:\Users\Nanda\Desktop\EMULATOR\GBA\GBA\DAEMON Tools Lite.lnk - C:\Program Files\DAEMON Tools Lite\DTLite.exe C:\Users\Nanda\Desktop\EMULATOR\GBA\Jogos\Project64 1.6.lnk - C:\Program Files\Project64 1.6\Project64.exe C:\Users\Nanda\Desktop\EMULATOR\GBA\Jogos\Steam.lnk - C:\Program Files\Steam\steam.exe C:\Users\Nanda\Desktop\EMULATOR\GBA\Jogos\µTorrent.lnk - C:\Users\Nanda\Desktop\EMULATOR\Project\Project64 - Atalho.lnk - C:\Program Files\Project64 1.6\Project64.exe C:\Users\Nanda\Desktop\EMULATOR\Sega\Flyff.lnk - C:\Users\Nanda\Desktop\EMULATOR\vba\Fernando Rocha\Project64 1.6.lnk - C:\Program Files\Project64 1.6\Project64.exe C:\Users\Nanda\Desktop\Games\AppLocale.lnk - C:\Users\Nanda\AppData\Roaming\Microsoft\Installer{394BE3D9-7F57-4638-A8D1-1D88671913B7}\_294823.exe C:\Users\Nanda\Desktop\Games\Call of Duty Multiplayer.lnk - C:\Program Files\Call of Duty\CoDMP.exe C:\Users\Nanda\Desktop\Games\Call of Duty Single Player.lnk - C:\Program Files\Call of Duty\CoDSP.exe C:\Users\Nanda\Desktop\Games\Counter Strike 1.6.lnk - C:\Users\Nanda\Desktop\Games\cs\hl.exe -game cstrike C:\Users\Nanda\Desktop\Games\Earth 2160.lnk - C:\Program Files\Reality Pump\Earth 2160\Earth2160_START.exe C:\Users\Nanda\Desktop\Games\Katawa Shoujo.lnk - C:\Users\Nanda\Desktop\Games\Katawa Shoujo\Katawa Shoujo.exe C:\Users\Nanda\Desktop\Games\SkyrimLauncher - Atalho.lnk - C:\Program Files\The Elder Scrolls V Skyrim\SkyrimLauncher.exe C:\Users\Nanda\Desktop\Games\the white chamber.lnk - C:\Users\Nanda\Desktop\Games\the-white-chamber\the white chamber\game.exe C:\Users\Nanda\Desktop\Games\To the Moon.lnk - C:\Users\Nanda\Desktop\Games\To the Moon.exe C:\Users\Nanda\Desktop\Games\dawn of war\DCpro_DPS_3.40.lnk - C:\Program Files\THQ\Dawn of War - Dark Crusade\DoWpro\DoWpro Manuals\Manuals\DCpro_DPS_3.40.htm C:\Users\Nanda\Desktop\Games\dawn of war\DoWpro (DCpro).lnk - C:\Program Files\THQ\Dawn of War - Dark Crusade\DoWModDCpro.exe -modname DoWpro -nomovies C:\Users\Nanda\Desktop\Games\dawn of war\DoWpro AutoWiki.lnk - C:\Program Files\THQ\Dawn of War - Dark Crusade\DoWpro\DoWpro Manuals\AutoWiki\index.htm C:\Users\Nanda\Desktop\Games\dawn of war\DoWpro Manuals.lnk - C:\Program Files\THQ\Dawn of War - Dark Crusade\DoWpro\DoWpro Manuals\Manuals C:\Users\Nanda\Desktop\Games\LOL\BATTERY\Media Player Classic - Home Cinema.lnk - C:\Program Files\Media Player Classic - Home Cinema\mpc-hc.exe C:\Users\Nanda\Desktop\Games\Rodrigo\Sega\Flyff.lnk - C:\Users\Nanda\Desktop\games quiet fluffy\Nova pasta (2)\Ryona Rpg\RyonaRPG\RPG Maker 2000.lnk - C:\Program Files\ASCII\RPG2000\rpg2000.exe C:\Users\Nanda\Desktop\games quiet fluffy\Nova pasta (2)???\AppLocale.lnk - C:\Users\Nanda\Desktop\gyyfc\EXTRA HERETICAL\Super Strip Fighter IV\AppLocale.lnk - C:\Users\Nanda\AppData\Roaming\Microsoft\Installer{394BE3D9-7F57-4638-A8D1-1D88671913B7}\_294823.exe C:\Users\Nanda\Desktop\***\Características do cFosSpeed.lnk - C:\Users\Nanda\Desktop\****\cFosSpeed Calibration.lnk - C:\Users\Nanda\Desktop\Manga\YTD YouTube Downloader Converter.lnk - C:\Program Files\YTD YouTube Downloader Converter\ytd.exe C:\Users\Nanda\Desktop\Manga\Nova pasta\BitLord.lnk - C:\Program Files\BitLord 2\Bitlord files\bitlord.exe C:\Users\Nanda\Desktop\Manga\Nova pasta\Cubby.lnk - C:\Users\Nanda\AppData\Roaming\cubby\cubby.exe C:\Users\Nanda\Desktop\minecraft\Mineshafter-proxy - Atalho.lnk - C:\Users\Nanda\Desktop\minecraft\Mineshafter-proxy.jar C:\Users\Nanda\Desktop\minecraft\Universe at War Earth Assault.lnk - C:\Users\Nanda\Desktop\minecraft\hamachi\LogMeIn Hamachi.lnk - C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe C:\Users\Nanda\Desktop\minecraft\Nova pasta (2)\Aprenda a Duelar com o Magic.lnk - C:\Users\Nanda\Desktop\minecraft\Nova pasta (2)\9th.exe C:\Users\Nanda\Desktop\Moar pc games??? Tower Defense\AppLocale.lnk - C:\Users\Nanda\Desktop\Musicas\Fernando Rocha\Project64 1.6.lnk - C:\Program Files\Project64 1.6\Project64.exe C:\Users\Nanda\Desktop\Nanda\Música\Mp3 novas\VH1 80\Atalho (2) para 01 Living on a Prayer.lnk - C:\Users\Nanda\Desktop\Nanda\Música\Mp3 novas\VH1 80\Atalho (3) para 01 Living on a Prayer.lnk - C:\Users\Nanda\Desktop\Nanda\Música\Mp3 novas\VH1 80\Atalho para 01 Living on a Prayer.lnk - C:\Users\Nanda\Desktop\SLOT\BitLord.lnk - C:\Program Files\BitLord 2\Bitlord files\bitlord.exe C:\Users\Nanda\Desktop\Starcraft\Battleships Forever.lnk - C:\Program Files\Battleships Forever\BattleshipsForever.exe C:\Users\Nanda\Desktop\Starcraft\BF Ship Maker.lnk - C:\Program Files\Battleships Forever\ShipMaker.exe C:\Users\Nanda\Desktop\Starcraft\Diablo II - Lord of Destruction.lnk - C:\Program Files\Diablo II\Diablo II.exe C:\Users\Nanda\Desktop\Starcraft\Diablo II.lnk - C:\Program Files\Diablo II\Diablo II.exe C:\Users\Nanda\Desktop\Starcraft\Starcraft - Brood War.lnk - C:\Program Files\Starcraft\StarCraft.exe ==== shortcuts on All Users Desktop ====================== C:\Users\Public\Desktop\DAEMON Tools Lite.lnk - C:\Program Files\DAEMON Tools Lite\DTLite.exe C:\Users\Public\Desktop\Play League of Legends.lnk - C:\Riot Games\League of Legends\lol.launcher.exe C:\Users\Public\Desktop\YTD Video Downloader.lnk - C:\Program Files\YTD YouTube Downloader Converter\ytd.exe ==== shortcuts in Users Start Menu ====================== C:\Users\Nanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games\System Shock 2.lnk - C:\Users\Nanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk - C:\Users\Nanda\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Nanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft AppLocale\EEclick???????????.lnk - C:\Users\Nanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft AppLocale\sinigami.lnk - C:\Windows\AppPatch\AppLoc.exe "C:\Users\Nanda\Documents\BitLord[hshare.net].Death.Milk\sinigami.exe" "/L0411" ==== shortcuts in All Users Start Menu ====================== C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk - C:\Windows\Installer{AC76BA86-7AD7-1046-7B44-AA1000000001}\SC_Reader.ico C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle for Wesnoth 1.10.7\Battle for Wesnoth.lnk - C:\Program Files\Battle for Wesnoth 1.10.7\wesnoth.exe --config-dir Wesnoth1.10 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle for Wesnoth 1.10.7\Changelog.lnk - C:\Program Files\Battle for Wesnoth 1.10.7\changelog.txt C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle for Wesnoth 1.10.7\License.lnk - C:\Program Files\Battle for Wesnoth 1.10.7\COPYING.txt C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle for Wesnoth 1.10.7\Manual.lnk - C:\Program Files\Battle for Wesnoth 1.10.7\manual\manual.en.html C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle for Wesnoth 1.10.7\Map editor.lnk - C:\Program Files\Battle for Wesnoth 1.10.7\wesnoth.exe -e --config-dir Wesnoth1.10 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle for Wesnoth 1.10.7\Multiplayer server.lnk - C:\Program Files\Battle for Wesnoth 1.10.7\wesnothd.exe C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle for Wesnoth 1.10.7\Player's changelog.lnk - C:\Program Files\Battle for Wesnoth 1.10.7\players_changelog.txt C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle for Wesnoth 1.10.7\Uninstall.lnk - C:\Program Files\Battle for Wesnoth 1.10.7\Uninstall.exe C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\About Java.lnk - C:\Program Files\Java\jre7\bin\javacpl.exe -tab about C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Check For Updates.lnk - C:\Program Files\Java\jre7\bin\javacpl.exe -tab update C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Configure Java.lnk - C:\Program Files\Java\jre7\bin\javacpl.exe C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.lnk - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.lnk - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rato Microsoft\Ajuda do Rato.lnk - c:\Windows\Installer{942E5031-2BD6-4C1B-918C-C8A1CBAE7B8C}\UserGuide.ico mouse help C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rato Microsoft\Definições de Qualidade.lnk - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rato Microsoft\Ligar Rato para Bluetooth.lnk - c:\Windows\Installer{942E5031-2BD6-4C1B-918C-C8A1CBAE7B8C}\Help.ico Mouse bluetoothwizard C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rato Microsoft\Manual de Utilização Saudável do Rato.lnk - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rato Microsoft\Rato Microsoft.lnk - c:\Windows\Installer{942E5031-2BD6-4C1B-918C-C8A1CBAE7B8C}\Mouse.ico mouse cpl C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP\ZHPDiag.lnk - C:\Program Files\ZHPDiag\ZHPhep.exe C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP\ZHPFix.lnk - C:\Program Files\ZHPDiag\ZHPFix\ZHPhep.exe ==== shortcuts in Quick Launch ====================== C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk - C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk - C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk - C:\Users\Default User\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk - C:\Users\Nanda\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\BitTorrent.lnk - C:\Program Files\BitTorrent\BitTorrent.exe C:\Users\Nanda\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Nanda\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk - C:\Users\Nanda\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk - C:\Users\Nanda\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Xilisoft PDF to PowerPoint Converter.lnk - C:\Program Files\Xilisoft\PDF to PowerPoint Converter\pdf2ppt.exe C:\Users\Nanda\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk - C:\Users\Nanda\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\7e4dca80246863e3\pinned.lnk - C:\Windows\system32\control.exe C:\Users\Nanda\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Nexus Mod Manager.lnk - C:\Program Files\Nexus Mod Manager\NexusClient.exe C:\Users\Nanda\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Steam.lnk - C:\Program Files\Steam\steam.exe C:\Users\Nanda\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\BitLord.lnk - C:\Program Files\BitLord 2\Bitlord files\bitlord.exe C:\Users\Nanda\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Users\Nanda\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\Nanda\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\TuneUp Utilities - Start Center.lnk - C:\Program Files\TuneUp Utilities 2013\Integrator.exe C:\Users\Nanda\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk - C:\Windows\explorer.exe ==== Reset IE Proxy ====================== Value(s) before fix: "ProxyEnable"=dword:00000001 Value(s) after fix: "ProxyEnable"=dword:00000000 ==== Deleting Registry Keys ====================== HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall{1EDF36EE-ECE5-44F1-A61A-A4C7C53C1418} deleted successfully HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall{269382DF-EAED-4F84-AD6F-A2CFFD70A029} deleted successfully HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall{D45F2E72-1701-49D5-AB3E-5F230FBC0C84} deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\aaaailpifkkekipiachodfkfmgmiapmp deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\blmbcjbinolkjkcbmalfhildaohcciih deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\mdebcffgnijbblbinknkbefciofebcda deleted successfully HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\mpieaakhacmfleokhjcjnpcnmnmpfkid deleted successfully HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\blmbcjbinolkjkcbmalfhildaohcciih deleted successfully HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\2474427538.portal.qtrax.com deleted successfully HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall{89505A66-35F0-4401-B3AD-D077051F8698} deleted successfully HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\66A505980F5310443BDA0D7750F16889 deleted successfully ==== Empty IE Cache ====================== C:\Users\Nanda\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Users\Nanda\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully C:\Users\Nanda\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully ==== Empty FireFox Cache ====================== No FireFox Cache found ==== Empty Chrome Cache ====================== C:\Users\Nanda\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully ==== Empty All Flash Cache ====================== Flash Cache Emptied Successfully ==== Empty All Java Cache ====================== Java Cache cleared successfully ==== C:\zoek_backup content ====================== C:\zoek_backup (files=237 folders=63 18555523 bytes) ==== Empty Temp Folders ====================== C:\Users\Default\AppData\Local\Temp emptied successfully C:\Users\Default User\AppData\Local\Temp emptied successfully C:\Users\Nanda\AppData\Local\Temp will be emptied at reboot C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully C:\Windows\Temp will be emptied at reboot ==== After Reboot ====================== ==== Empty Temp Folders ====================== C:\Windows\Temp successfully emptied C:\Users\Nanda\AppData\Local\Temp successfully emptied ==== Empty Recycle Bin ====================== C:$RECYCLE.BIN successfully emptied ==== Deleting Files / Folders ====================== "C:\Users\Nanda\AppData\Roaming\Adlock.exe" deleted ==== EOF on 02-03-2014 at 19:49:23,45 ======================

Desative temporariamente seu antivirus para evitar conflitos.

Acesse este link abaixo e clique no primeiro botão da esquerda que é o botão Download Zoek.exe:

http://www.hijackthis.nl/smeenk/

*Clique com o botão direito do mouse no Zoek.exe e selecione Executar como administrador

* Copie todo este texto destacado em negrito que te passei e cole-o no espaço em branco do Zoek

*Clique em Run Script

*Durante o scan uma mensagem parecida com esta abaixo mostrando o progresso do escaneamento será apresentada. Aguarde o término...pode demorar!

*Caso a reinicialização do PC seja solicitada, clique OK

* Poste o log do Zoek que estará em C:*zoek-results.txt* em sua próxima resposta.