Oi Adriana.

Siga a outra parte da minha resposta quanto ao uso do ZHPFix e poste o relatório dele.

Boa tarde Power,

* Acesse o site https://www.virustotal.com e envie este arquivo destacado em negrito abaixo para ser analisado:

C:\windows\system32\WinDir*Svchost.exe*

Esta aparecendo a seguinte mensagem arquivo não existe caminho não encontrado.

Oi Power Max, ao  responder,  além  da  pergunta  que  postei  anteriormente,  esqueci  de perguntar  se  devo deixar o Setup  do Zoek  e do AdwCleaner   e respectivos Backups e relatórios, pq  acredito que os relatórios posso deletar,  mas  preferi perguntar  pois  é  perguntando  que  se  aprende  além  de  estudar  né?. Pensei em deixar, para futuras pesquisas  de Malweres, ou deleto? e  caso  aconteça  algum problema faço  nova  consulta a  Microsoft Community? 

Fiz também uma  varredura no meu Pc, apenas com o AdwCleaner, embora aparentemente  estivesse funcionando corretamente,  mas  achei  que  não seria  nada  de  mais  pois  ele  pegou  algumas coisas  como  exemplo "C:\Program Files\Systweak Support Dock"  que  entrou ao  ser  atualizado  o C.Cleaner  sem  que  eu  notasse  algo que  pudesse  evitar, pois fui direto  na  atualização do próprio C.Cleaner.  Notei isso  pois  costumo fazer uma cópia da tela c/ as imagens  dos  programas  instalados, pois me ajuda a tomar conta se entram coisas como o exemplo citado acima. Segue o relatório abaixo p/ sua análise, por favor. Muito Obrigado  mais  uma  vez,  uma  ótima  tarde  e  parabéns  a  vocês pelo suporte "excelente" aos  usuários.

---

AdwCleaner v3.210 - Relatório criado 23/05/2014 às 05:18:22

Atualizado 19/05/2014 por Xplode

Sistema Operacional : Windows 7 Starter Service Pack 1 (32 bits)

Usuário : Celso - CELSOABUZAID

Executando de : C:\Downloaded Program Files\AdwCleaner.exe

Opção : Limpar

***** [ Serviços ] *****

***** [ Arquivos / Pastas ] *****

Pasta Deletada : C:\ProgramData\FileCure

Pasta Deletada : C:\ProgramData\IBUpdaterService

Pasta Deletada : C:\ProgramData\SuperbApp

Pasta Deletada : C:\Program Files\Systweak Support Dock

Pasta Deletada : C:\Users\Celso\AppData\Local\PriceMeterLiveUpdate

Pasta Deletada : C:\Users\Celso\AppData\Roaming\Mozilla\Firefox\Profiles\0e5946g9.default\Extensions\staged{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}

Pasta Deletada : C:\Program Files\Mozilla Firefox\Extensions******@babylon.com

Arquivo Deletada : C:\Users\Celso\AppData\Roaming\Mozilla\Firefox\Profiles\2ow6osr3.default-1362228345603\Extensions{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}.xpi

Arquivo Deletada : C:\Users\Celso\AppData\Roaming\Mozilla\Firefox\Profiles\2ow6osr3.default-1362228345603\invalidprefs.js

Arquivo Deletada : C:\Users\Celso\AppData\Roaming\Mozilla\Firefox\Profiles\0e5946g9.default\searchplugins\Mysearchdial.xml

Arquivo Deletada : C:\Users\Celso\AppData\Roaming\Mozilla\Firefox\Profiles\2ow6osr3.default-1362228345603\searchplugins\Mysearchdial.xml

Arquivo Deletada : C:\Users\Celso\AppData\Roaming\Mozilla\Firefox\Profiles\0e5946g9.default\user.js

Arquivo Deletada : C:\Users\Celso\AppData\Roaming\Mozilla\Firefox\Profiles\2ow6osr3.default-1362228345603\user.js

Arquivo Deletada : C:\Windows\Tasks\UpdaterEX.job

Arquivo Deletada : C:\Windows\System32\Tasks\UpdaterEX

***** [ Atalhos ] *****

***** [ Registro ] *****

[#] Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{1BF24D5D-DE72-40A8-8938-6B25CD623E18}

[#] Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain{6E9C1AC6-079D-4FC9-8B7C-3930E630A4BA}

[#] Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{6E9C1AC6-079D-4FC9-8B7C-3930E630A4BA}

Chave Deletedo : HKLM\SOFTWARE\Classes\AppID{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}

Chave Deletedo : HKLM\SOFTWARE\Classes\AppID\esrv.EXE

Chave Deletedo : HKLM\SOFTWARE\Classes\Prod.cap

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\biclient_RASAPI32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\biclient_RASMANCS

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASAPI32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASMANCS

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\Savings Sidekick_RASAPI32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\Savings Sidekick_RASMANCS

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasapi32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasmancs

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\sweetimsetup_rasapi32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\sweetimsetup_rasmancs

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS

Chave Deletedo : HKCU\Software\5868adfb568ee45

Chave Deletedo : HKCU\Software\AppDataLow{5F189DF5-2D05-472B-9091-84D9848AE48B}

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_para_free-mp3-converter_RASAPI32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_para_free-mp3-converter_RASMANCS

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_para_google-chrome_RASAPI32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_para_google-chrome_RASMANCS

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_para_k-lite-codec-pack_RASAPI32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_para_k-lite-codec-pack_RASMANCS

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_para_media-player-codec-pack_RASAPI32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_para_media-player-codec-pack_RASMANCS

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_para_windows-live-movie-maker_RASAPI32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_para_windows-live-movie-maker_RASMANCS

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_para_windows-movie-maker_RASAPI32

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_para_windows-movie-maker_RASMANCS

Chave Deletedo : HKLM\SOFTWARE\Classes\AppID{C292AD0A-C11F-479B-B8DB-743E72D283B0}

Chave Deletedo : HKLM\SOFTWARE\Classes\AppID{EA28B360-05E0-4F93-8150-02891F1D8D3C}

Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID{02054E11-5113-4BE3-8153-AA8DFB5D3761}

Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}

Chave Deletedo : HKLM\SOFTWARE\Classes\CLSID{6E993643-8FBC-44FE-BC85-D318495C4D96}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{021B4049-F57D-4565-A693-FD3B04786BFA}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{0362AA09-808D-48E9-B360-FB51A8CBCE09}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{06844020-CD0B-3D3D-A7FE-371153013E49}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{0ADC01BB-303B-3F8E-93DA-12C140E85460}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{10D3722F-23E6-3901-B6C1-FF6567121920}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{1675E62B-F911-3B7B-A046-EB57261212F3}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{192929F2-9273-3894-91B0-F54671C4C861}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{2932897E-3036-43D9-8A64-B06447992065}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{32B80AD6-1214-45F4-994E-78A5D482C000}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{5D8C3CC3-3C05-38A1-B244-924A23115FE9}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{641593AF-D9FD-30F7-B783-36E16F7A2E08}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{711FC48A-1356-3932-94D8-A8B733DBC7E4}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{72227B7F-1F02-3560-95F5-592E68BACC0C}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{8C68913C-AC3C-4494-8B9C-984D87C85003}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{8D019513-083F-4AA5-933F-7D43A6DA82C4}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{8DA8B89E-0C65-403B-8231-AB22ECFA0687}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{923F6FB8-A390-370E-A0D2-DD505432481D}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{A928E66C-F501-4E66-9953-855C712F93B2}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{B06D4521-D09C-3F41-8E39-9D784CCA2A75}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{B0E28FA0-DF07-44B6-95CE-48BE26DB9266}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{C2E799D0-43A5-3477-8A98-FC5F3677F35C}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{D16107CD-2AD5-46A8-BA59-303B7C32C500}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{D25B101F-8188-3B43-9D85-201F372BC205}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{D8FA96CA-B250-312C-AF34-4FF1DD72589D}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{E1B4C9DE-D741-385F-981E-6745FACE6F01}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{E6B4EE8F-C38E-4994-BE28-229A3F92262C}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{E7B623F5-9715-3F9F-A671-D1485A39F8A2}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{ED916A7B-7C68-3198-B87D-2DABC30A5587}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{FC32005D-E27C-32E0-ADFA-152F598B75E7}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{FCA8936E-403A-4487-A966-70F80F1D5A6A}

Chave Deletedo : HKLM\SOFTWARE\Classes\Interface{FE0273D1-99DF-4AC0-87D5-1371C6271785}

Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}

Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}

Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib{C292AD0A-C11F-479B-B8DB-743E72D283B0}

Chave Deletedo : HKLM\SOFTWARE\Classes\TypeLib{DB538320-D3C5-433C-BCA9-C4081A054FCF}

Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}

Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats{AAA38851-3CFF-475F-B5E0-720D3645E4A5}

Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}

Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings{AAA38851-3CFF-475F-B5E0-720D3645E4A5}

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{628F3201-34D0-49C0-BB9A-82A26AEFB291}

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{68B81CCD-A80C-4060-8947-5AE69ED01199}

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{E6B969FB-6D33-48D2-9061-8BBD4899EB08}

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{EEE6C367-6118-11DC-9C72-001320C79847}

Chave Deletedo : HKCU\Software\Microsoft\Internet Explorer\SearchScopes{77AA745B-F4F8-45DA-9B14-61D2D95054C8}

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{77AA745B-F4F8-45DA-9B14-61D2D95054C8}

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{D3F22A84-2A84-49EB-91E6-5DADAAF0165D}

Chave Deletedo : HKCU\Software\BI

Chave Deletedo : HKCU\Software\dsiteproducts

Chave Deletedo : HKCU\Software\Headlight

Chave Deletedo : HKCU\Software\InstallCore

Chave Deletedo : HKCU\Software\systweak

Chave Deletedo : HKCU\Software\UpdaterEX

Chave Deletedo : HKCU\Software\AppDataLow\Software\MyWebFace_5a

Chave Deletedo : HKCU\Software\AppDataLow\Software\simplytech

Chave Deletedo : HKLM\Software{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Chave Deletedo : HKLM\Software{5F189DF5-2D05-472B-9091-84D9848AE48B}

Chave Deletedo : HKLM\Software{77D46E27-0E41-4478-87A6-AABE6FBCF252}

Chave Deletedo : HKLM\Software\Conduit

Chave Deletedo : HKLM\Software\Iminent

Chave Deletedo : HKLM\Software\Speedchecker Limited

Chave Deletedo : HKLM\Software\systweak

Chave Deletedo : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\UpdaterEX

Chave Deletedo : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP

Chave Deletedo : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5

Chave Deletedo : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

Chave Deletedo : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375

***** [ Navegadores ] *****

-\ Internet Explorer v11.0.9600.17041

Configurações Restauradas : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]

-\ Mozilla Firefox v28.0 (pt-BR)

[ Arquivo : C:\Users\Celso\AppData\Roaming\Mozilla\Firefox\Profiles\0e5946g9.default\prefs.js ]

Linha deletada : user_pref("browser.startup.homepage", "hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutDtDtByDtCtC0ByE0FtBtA0CtC0DtByEtN0D0Tzu0SyBzyzztN1L2XzutBtFtCzztFtAtFtDtN1L1CzutDtBtCtC1V1TtN1L1G[...]

Linha deletada : user_pref("browser.search.selectedEngine", "Mysearchdial");

[ Arquivo : C:\Users\Celso\AppData\Roaming\Mozilla\Firefox\Profiles\2ow6osr3.default-1362228345603\prefs.js ]

Linha deletada : user_pref("browser.search.defaultenginename", "Mysearchdial");

Linha deletada : user_pref("browser.search.selectedEngine", "Mysearchdial");

Linha deletada : user_pref("extensions.delta.admin", false);

Linha deletada : user_pref("extensions.delta.aflt", "babsst");

Linha deletada : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");

Linha deletada : user_pref("extensions.delta.autoRvrt", "false");

Linha deletada : user_pref("extensions.delta.dfltLng", "pt");

Linha deletada : user_pref("extensions.delta.excTlbr", false);

Linha deletada : user_pref("extensions.delta.ffxUnstlRst", true);

Linha deletada : user_pref("extensions.delta.id", "30d61d24000000000000002511b4f23c");

Linha deletada : user_pref("extensions.delta.instlDay", "15886");

Linha deletada : user_pref("extensions.delta.instlRef", "sst");

Linha deletada : user_pref("extensions.delta.newTab", false);

Linha deletada : user_pref("extensions.delta.prdct", "delta");

Linha deletada : user_pref("extensions.delta.prtnrId", "delta");

Linha deletada : user_pref("extensions.delta.rvrt", "false");

Linha deletada : user_pref("extensions.delta.smplGrp", "none");

Linha deletada : user_pref("extensions.delta.tlbrId", "base");

Linha deletada : user_pref("extensions.delta.tlbrSrchUrl", "");

Linha deletada : user_pref("extensions.delta.vrsn", "1.8.21.5");

Linha deletada : user_pref("extensions.delta.vrsnTs", "1.8.21.521:12:15");

Linha deletada : user_pref("extensions.delta.vrsni", "1.8.21.5");

Linha deletada : user_pref("extensions.delta_i.babExt", "");

Linha deletada : user_pref("extensions.delta_i.babTrack", "affID=119818&tt=250613_gr1&tsp=4929");

Linha deletada : user_pref("extensions.delta_i.srcExt", "ss");

Linha deletada : user_pref("extensions.mysearchdial.AL", 2);

Linha deletada : user_pref("extensions.mysearchdial.aflt", "dsites");

Linha deletada : user_pref("extensions.mysearchdial.appId", "{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}");

Linha deletada : user_pref("extensions.mysearchdial.cd", "2XzuyEtN2Y1L1QzutDtDtByDtCtC0ByE0FtBtA0CtC0DtByEtN0D0Tzu0SyBzyzztN1L2XzutBtFtCzztFtAtFtDtN1L1CzutDtBtCtC1V1TtN1L1G1B1V1N2Y1L1Qzu2SyE0DzztAzytAyEtBtGtC0BtAtDtGy[...]

Linha deletada : user_pref("extensions.mysearchdial.cr", "1005995226");

Linha deletada : user_pref("extensions.mysearchdial.dfltLng", "");

Linha deletada : user_pref("extensions.mysearchdial.dfltSrch", true);

Linha deletada : user_pref("extensions.mysearchdial.dnsErr", true);

Linha deletada : user_pref("extensions.mysearchdial.excTlbr", false);

Linha deletada : user_pref("extensions.mysearchdial.hmpg", true);

Linha deletada : user_pref("extensions.mysearchdial.hmpgUrl", "hxxp://start.mysearchdial.com/?f=1&a=dsites&cd=2XzuyEtN2Y1L1QzutDtDtByDtCtC0ByE0FtBtA0CtC0DtByEtN0D0Tzu0SyBzyzztN1L2XzutBtFtCzztFtAtFtDtN1L1CzutDtBtCtC1V1[...]

Linha deletada : user_pref("extensions.mysearchdial.id", "002511B4F23C1D24");

Linha deletada : user_pref("extensions.mysearchdial.instlDay", "16137");

Linha deletada : user_pref("extensions.mysearchdial.instlRef", "0211_a");

Linha deletada : user_pref("extensions.mysearchdial.newTabUrl", "hxxp://start.mysearchdial.com/?f=2&a=dsites&cd=2XzuyEtN2Y1L1QzutDtDtByDtCtC0ByE0FtBtA0CtC0DtByEtN0D0Tzu0SyBzyzztN1L2XzutBtFtCzztFtAtFtDtN1L1CzutDtBtCtC1[...]

Linha deletada : user_pref("extensions.mysearchdial.prdct", "mysearchdial");

Linha deletada : user_pref("extensions.mysearchdial.prtnrId", "mysearchdial");

Linha deletada : user_pref("extensions.mysearchdial.srchPrvdr", "Mysearchdial");

Linha deletada : user_pref("extensions.mysearchdial.tlbrId", "base");

Linha deletada : user_pref("extensions.mysearchdial.tlbrSrchUrl", "hxxp://start.mysearchdial.com/?f=3&a=dsites&cd=2XzuyEtN2Y1L1QzutDtDtByDtCtC0ByE0FtBtA0CtC0DtByEtN0D0Tzu0SyBzyzztN1L2XzutBtFtCzztFtAtFtDtN1L1CzutDtBtCt[...]

Linha deletada : user_pref("extensions.mysearchdial.vrsn", "1.8.29.0");

Linha deletada : user_pref("extensions.mysearchdial.vrsni", "1.8.29.0");

Linha deletada : user_pref("extensions.mysearchdial_i.newTab", false);

Linha deletada : user_pref("extensions.mysearchdial_i.smplGrp", "none");

Linha deletada : user_pref("extensions.mysearchdial_i.vrsnTs", "1.8.29.018:9:16");

Linha deletada : user_pref("extensions.toolbar.mindspark._5aMembers_.homepage", "hxxp://home.mywebsearch.com/index.jhtml?ptb=C0B14AAC-000A-4D22-A89C-D5B8A6222F1B&n=77fc9431&p2=^GR^xdm386^YY^br");

Linha deletada : user_pref("extensions.toolbar.mindspark._5aMembers_.hp.enabled", true);

Linha deletada : user_pref("extensions.toolbar.mindspark._5aMembers_.initialized", true);

Linha deletada : user_pref("extensions.toolbar.mindspark._5aMembers_.installation.contextKey", "");

Linha deletada : user_pref("extensions.toolbar.mindspark._5aMembers_.installation.installDate", "2013041713");

Linha deletada : user_pref("extensions.toolbar.mindspark._5aMembers_.installation.partnerId", "^GR^xdm386^YY^br");

Linha deletada : user_pref("extensions.toolbar.mindspark._5aMembers_.installation.partnerSubId", "");

Linha deletada : user_pref("extensions.toolbar.mindspark._5aMembers_.installation.success", true);

Linha deletada : user_pref("extensions.toolbar.mindspark._5aMembers_.installation.toolbarId", "C0B14AAC-000A-4D22-A89C-D5B8A6222F1B");

Linha deletada : user_pref("extensions.toolbar.mindspark._5aMembers_.lastActivePing", "1366217740683");

Linha deletada : user_pref("extensions.toolbar.mindspark._5aMembers_.options.defaultSearch", false);

Linha deletada : user_pref("extensions.toolbar.mindspark._5aMembers_.options.homePageEnabled", true);

Linha deletada : user_pref("extensions.toolbar.mindspark._5aMembers_.options.keywordEnabled", false);

Linha deletada : user_pref("extensions.toolbar.mindspark._5aMembers_.options.tabEnabled", true);

Linha deletada : user_pref("extensions.toolbar.mindspark._5aMembers_.weather.location", "10001");

Linha deletada : user_pref("extensions.toolbar.mindspark.hp.enabled", true);

Linha deletada : user_pref("extensions.toolbar.mindspark.hp.enabled.guid", "******@mindspark.com");

Linha deletada : user_pref("extensions.toolbar.mindspark.lastInstalled", "******@mindspark.com");

-\ Google Chrome v34.0.1847.116

[ Arquivo : C:\Users\Celso\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deletedo [Search Provider] : hxxp://br.ask.com/web?q={searchTerms}

Deletedo [Homepage] : hxxps://accounts.google.com/ServiceLogin?service=mail&passive=true&rm=false&continue=hxxps://mail.google.com/mail/?hl%3Dpt-BR%26shva%3D1&ss=1&scc=1&ltmpl=default&ltmplcache=2&hl=pt-BR&emr=1#inbox

*************************

AdwCleaner[R0].txt - [21730 octets] - [23/05/2014 05:15:11]

AdwCleaner[S0].txt - [20677 octets] - [23/05/2014 05:18:22]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [20738 octets] ##########

Oi Adriana.

* Acesse o site https://www.virustotal.com e envie este arquivo destacado em negrito abaixo para ser analisado:

C:\windows\system32\WinDir*Svchost.exe*

Assim que a análise dele for concluída, copie o link que aparecerá na barra de endereços de seu navegador e poste este link em sua próxima resposta juntamente com o relatório do ZHPFix pedido abaixo nesta postagem.

Maiores informações de como analisar arquivos no site Virus Total você encontra neste tutorial:

Analise arquivos e links suspeitos de forma online e totalmente gratuita

____________________________________________________________________________________________________

* Selecione e copie todo o texto destacado em negrito abaixo (começando em script zhpfix e indo até emptyclsid):

script zhpfix

SysRestore

O20 - AppInit_DLLs: . (...) - C:\Program Files\SupTab\SEARCH~1.dll (.not file.)   =>PUP.SupTab

[HKCU\Software\Bonanza]   =>Adware.BonanzaDeals

O43 - CFD: 23/05/2014 - 15:19:49 - [0] ----D C:\Program Files\WebBiNg

O43 - CFD: 23/05/2014 - 17:10:01 - [0] ----D C:\ProgramData\WebBiNg

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyLiveUpdateTaskMachineUA]   =>PUP.DealPly

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyLiveUpdateTaskMachineCore]   =>PUP.DealPly

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Dealply]   =>PUP.DealPly

[HKCU\Software\Bonanza]   =>Adware.BonanzaDeals^

ShortcutFix

ProxyFix

EmptyTemp

EmptyFlash

emptyclsid

_____________________________________________________________________________________________________________

 Vá no menu: Iniciar > Todos os programas > ZHP > Clique com o botão direito do mouse sobre o Zhpfix e escolha a opção de Executar como administrador > Clique em Importação > Clique no botão GO > Clique em Oui > Caso queira que os arquivos da lixeira sejam excluídos clique em Oui novamente > Um relatório aparecerá no bloco de notas. 

Copie este relatório e poste em sua próxima resposta juntamente com o link da análise do arquivo no site Virus Total.