Zoek.exe v5.0.0.0 Updated 23-04-2015
Tool run by Administrador on **** 01/05/2015 at 12:22:23,46.
Microsoft Windows XP Professional 5.1.2600 Service Pack 3 x86
Running in: Normal Mode Internet Access Detected
Launched: E:\Documents and Settings\Administrador\Meus documentos\Downloads\zoek.exe [Scan all users] [Script inserted]
==== Older Logs ======================
E:\zoek-results2015-05-01-151002.log 1263 bytes
==== System Restore Info ======================
1/5/2015 12:28:11 Zoek.exe System Restore Point Created Successfully.
==== Reset Hosts File ======================
Copyright (c) 1993-2006 Microsoft Corp.
#
This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
This file contains the mappings of IP addresses to host names. Each
entry should be kept on an individual line. The IP address should
be placed in the first column followed by the corresponding host name.
The IP address and the host name should be separated by at least one
space.
#
lines or following the machine name denoted by a '#' symbol.
#
For example:
#
127.0.0.1 localhost
==== Empty Folders Check ======================
E:\Arquivos de programas\gmsd_br_375 deleted successfully
E:\DOCUME~1\ALLUSE~1\DADOSD~1\Atheros deleted successfully
==== Deleting CLSID Registry Keys ======================
HKEY_USERS\S-1-5-21-1454471165-515967899-1801674531-500\Software\Microsoft\Internet Explorer\SearchScopes{33BB0A4E-99AF-4226-BDF6-49120163DE86} deleted successfully
HKEY_USERS\S-1-5-21-1454471165-515967899-1801674531-500\Software\Microsoft\Internet Explorer\SearchScopes{9CB96984-43C3-4D44-90EF-01466EFCF7BB} deleted successfully
HKEY_USERS\S-1-5-21-1454471165-515967899-1801674531-500\Software\Microsoft\Internet Explorer\SearchScopes{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{33BB0A4E-99AF-4226-BDF6-49120163DE86} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{9CB96984-43C3-4D44-90EF-01466EFCF7BB} deleted successfully
==== Deleting CLSID Registry Values ======================
==== Deleting Services ======================
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WindowsMangerProtect deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Eventlog\Application\WindowsMangerProtect deleted successfully
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\WindowsMangerProtect deleted successfully
==== FireFox Fix ======================
Deleted from E:\Documents and Settings\ADMINI~1\Dados de aplicativos\Mozilla\Firefox\Profiles\wz1a2gye.default\prefs.js:
user_pref("browser.startup.homepage", "www.google.com");
user_pref("browser.search.defaulturl", "https://www.google.com/search/?trackid=sp-006");
user_pref("browser.newtab.url", "www.top8844.com?oem=mbtkv3&uid=WD-WMAM9PR50868_WDCWD800BB-75JHC0&tm=1429229079");
user_pref("browser.search.defaultengine", "Google (avast)");
user_pref("browser.search.defaultenginename", "Google (avast)");
user_pref("browser.search.selectedEngine", "Google (avast)");
user_pref("browser.search.order.1", "Google (avast)");
user_pref("keyword.URL", "https://www.google.com/search/?trackid=sp-006");
Added to E:\Documents and Settings\ADMINI~1\Dados de aplicativos\Mozilla\Firefox\Profiles\wz1a2gye.default\prefs.js:
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");
ProfilePath: E:\Documents and Settings\ADMINI~1\Dados de aplicativos\Mozilla\Firefox\Profiles\wz1a2gye.default
---- Lines mystart removed from prefs.js ----
user_pref("browser.search.searchengine.alias", "mystartsearch");
user_pref("browser.search.searchengine.iconURL", "http://www.mystartsearch.com/favicon.ico");
user_pref("browser.search.searchengine.name", "mystartsearch");
user_pref("browser.search.searchengine.url", "http://www.mystartsearch.com/web/?type=ds&ts=1428262869&from=slbnew&uid=WDCXWD800BB-75JHC0_WD-WMAM9PR508
---- Lines browser.startup.page removed from prefs.js ----
user_pref("browser.startup.page", 3);
---- FireFox user.js and prefs.js backups ----
user_20150105_1259_.backup
prefs_20150105_1259_.backup
==== Registry Fix Code ======================
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command]
@="E:\Arquivos de programas\Internet Explorer\iexplore.exe"
==== Deleting Files \ Folders ======================
E:\Arquivos de programas\gmsd_br_375 not found
E:\Arquivos de programas\ComPlus Applications deleted
E:\Arquivos de programas\WindowsUpdate deleted
E:\Documents and Settings\Administrador\Dados de aplicativos\WeatherTool deleted
E:\Documents and Settings\Administrador\Dados de aplicativos\mystartsearch deleted
E:\Documents and Settings\Administrador\Dados de aplicativos\PriceGong deleted
E:\DOCUME~1\ALLUSE~1\DADOSD~1\Duplicaterecord.js deleted
E:\DOCUME~1\ALLUSE~1\DADOSD~1\WindowsMangerProtect deleted
E:\DOCUME~1\ALLUSE~1\DADOSD~1\Package Cache deleted
E:\WINDOWS\002655_.tmp deleted
E:\WINDOWS\DUMP3c5d.tmp deleted
E:\WINDOWS\SET3.tmp deleted
E:\WINDOWS\SET4.tmp deleted
E:\WINDOWS\SET8.tmp deleted
E:\WINDOWS\tasks\060184C3-9766-46a0-B258-F4518A0B2633.job deleted
E:\WINDOWS\system32\GroupPolicy\Machine deleted
E:\WINDOWS\system32\GroupPolicy\User deleted
E:\WINDOWS\system32\GroupPolicy\gpt.ini deleted
E:\WINDOWS\System32\ConduitEngine.tmp deleted
E:\WINDOWS\System32\SET58.tmp deleted
E:\WINDOWS\System32\SET5C.tmp deleted
E:\WINDOWS\System32\SET5D.tmp deleted
E:\WINDOWS\System32\SET64.tmp deleted
E:\Documents and Settings\Administrador\Dados de aplicativos\unins000.exe deleted
E:\Documents and Settings\Administrador\Dados de aplicativos\unins001.exe deleted
==== Firefox Start and Search pages ======================
ProfilePath: E:\Documents and Settings\ADMINI~1\Dados de aplicativos\Mozilla\Firefox\Profiles\wz1a2gye.default
user_pref("browser.startup.homepage", "about:home");
user_pref("browser.newtab.url", "about:newtab");
==== Firefox Extensions Registry ======================
[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"istart_@gmail.com"="E:\Documents and Settings\Administrador\Dados de aplicativos\Mozilla\Firefox\Profiles\wz1a2gye.default\extensions\istart_@gmail.com" []
[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]
"{87F8774F-B485-47E2-A755-A40A8A5E886C}"="E:\Documents and Settings\Administrador\Configura‡äes locais\Dados de aplicativos\GAS Tecnologia\GBBD\bb\xpi" [26/03/2015 20:52]
==== Firefox Extensions ======================
ProfilePath: E:\Documents and Settings\ADMINI~1\Dados de aplicativos\Mozilla\Firefox\Profiles\wz1a2gye.default
- Undetermined - E:\Documents and Settings\Administrador\Configurações locais\Dados de aplicativos\GAS Tecnologia\GBBD\bb\xpi
==== Firefox Plugins ======================
Profilepath: E:\Documents and Settings\Administrador\Dados de aplicativos\Mozilla\Firefox\Profiles\wz1a2gye.default
76E34EA1089E92709C5725407B565DA1 - E:\Arquivos de programas\Windows Media Player\npdsplay.dll -
Windows Media Player Plug-in Dynamic Link Library
02A4A41FAC9BF96155B3E8068D1DF4B6 - E:\Arquivos de programas\Windows Media Player\npwmsdrm.dll -
Microsoft® DRM
CF4ABE599858E10EEB911E16FBCFD87D - E:\Arquivos de programas\Windows Media Player\npdrmv2.dll -
Microsoft® DRM
421CB2C1010522B3BF7C00725520B844 - E:\Arquivos de programas\Adobe\Reader 11.0\Reader\browser\nppdf32.dll -
Adobe Acrobat
005EBE4A4E6E9C9A7967F6C3F413C1DF - E:\Arquivos de programas\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll -
Adobe Acrobat
98137411B9C632095F919E2CE70B288A - E:\Arquivos de programas\Google\Update\1.3.26.9\npGoogleUpdate3.dll -
Google Update
9AE02005247DA91AB1743F5208DBEF76 - E:\WINDOWS\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll -
Shockwave Flash
==== Chromium Look ======================
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
bopakagnckmlgajfccecajhnimjiiedh - No path found[]
gomekmidlodglbbmalcneegieacbdmki - E:\Arquivos de programas\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[09/04/2015 20:35]
==== Set IE to Default ======================
Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="https://br.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}"
"Search Bar"="https://br.yahoo.com/?fr=hp-avast&type=avastbcl"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Search Page"="https://br.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms}"
"Search Bar"="https://br.yahoo.com/?fr=hp-avast&type=avastbcl"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://www.mystartsearch.com/web/?type=ds&ts=1428262869&from=slbnew&uid=WDCXWD800BB-75JHC0_WD-WMAM9PR5086850868&q={searchTerms}"
"CustomizeSearch"="http://www.mystartsearch.com/web/?type=ds&ts=1428262869&from=slbnew&uid=WDCXWD800BB-75JHC0_WD-WMAM9PR5086850868&q={searchTerms}"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{9CB96984-43C3-4D44-90EF-01466EFCF7BB}"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{9CB96984-43C3-4D44-90EF-01466EFCF7BB}] not found
New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Bar"="http://go.microsoft.com/fwlink/?LinkId=54896"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm"
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"
==== All HKCU SearchScopes ======================
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{632F07F3-19A1-4d16-A23F-E6CE9486BAB5} Microsoft (Bing) Url="http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01"
==== Reset Google Chrome ======================
Nothing found to reset
==== Deleting CLSID Registry Keys ======================
HKEY_USERS\S-1-5-21-1454471165-515967899-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} deleted successfully
HKEY_USERS\S-1-5-21-1454471165-515967899-1801674531-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats{9030D464-4C02-4ABF-8ECC-5164760863C6} deleted successfully
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} deleted successfully
HKEY_CLASSES_ROOT\CLSID{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{0E8A89AD-95D7-40EB-8D9D-083EF7066A01} deleted successfully
HKEY_CLASSES_ROOT\CLSID{9030D464-4C02-4ABF-8ECC-5164760863C6} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{9030D464-4C02-4ABF-8ECC-5164760863C6} deleted successfully
==== Deleting CLSID Registry Values ======================
HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions******@gmail.com deleted successfully
HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\istart_******@gmail.com deleted successfully
==== shortcuts on All Users Desktop ======================
E:\Documents and Settings\All Users\Desktop\Adobe Reader XI.lnk - E:\Arquivos de programas\Adobe\Reader 11.0\Reader\AcroRd32.exe
E:\Documents and Settings\All Users\Desktop\Avast Free Antivirus.lnk - E:\Arquivos de programas\AVAST Software\Avast\AvastUI.exe
E:\Documents and Settings\All Users\Desktop\Google Chrome.lnk - E:\Arquivos de programas\Google\Chrome\Application\chrome.exe
E:\Documents and Settings\All Users\Desktop\TP-LINK Wireless Configuration Utility.lnk - E:\Arquivos de programas\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe
==== shortcuts in All Users Start Menu ======================
E:\Documents and Settings\All Users\Menu Iniciar\Programas\Mozilla Firefox.lnk - E:\Arquivos de programas\Mozilla Firefox\firefox.exe
E:\Documents and Settings\All Users\Menu Iniciar\Programas\Ferramentas administrativas\Gerenciamento do computador.lnk - E:\WINDOWS\system32\compmgmt.msc /s
E:\Documents and Settings\All Users\Menu Iniciar\Programas\Google Chrome\Google Chrome.lnk - E:\Arquivos de programas\Google\Chrome\Application\chrome.exe
E:\Documents and Settings\All Users\Menu Iniciar\Programas\Jogos\Copas para Internet.lnk - E:\Arquivos de programas\MSN Gaming Zone\Windows\hrtzzm.exe
E:\Documents and Settings\All Users\Menu Iniciar\Programas\Jogos\Damas para Internet.lnk - E:\Arquivos de programas\MSN Gaming Zone\Windows\chkrzm.exe
E:\Documents and Settings\All Users\Menu Iniciar\Programas\Jogos\Espadas para Internet.lnk - E:\Arquivos de programas\MSN Gaming Zone\Windows\shvlzm.exe
E:\Documents and Settings\All Users\Menu Iniciar\Programas\Jogos\Gamão para Internet.lnk -
E:\Documents and Settings\All Users\Menu Iniciar\Programas\Jogos\Reversi para Internet.lnk - E:\Arquivos de programas\MSN Gaming Zone\Windows\Rvsezm.exe
==== Reset IE Proxy ======================
Value(s) before fix:
"ProxyEnable"=dword:00000000
Value(s) after fix:
"ProxyEnable"=dword:00000000
==== Deleting Registry Keys ======================
HKEY_LOCAL_MACHINE\Software\Policies\Google deleted successfully
==== Empty IE Cache ======================
E:\Documents and Settings\Administrador\Configurações locais\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 emptied successfully
E:\Documents and Settings\Administrador\Configurações locais\Temp\Temporary Internet Files\Content.IE5 emptied successfully
E:\Documents and Settings\Administrador\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
E:\Documents and Settings\Default User\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
E:\Documents and Settings\LocalService\Configurações locais\Temp\Temporary Internet Files\Content.IE5 emptied successfully
E:\Documents and Settings\LocalService\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
E:\Documents and Settings\NetworkService\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
E:\WINDOWS\system32\config\systemprofile\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
E:\WINDOWS\system32\config\systemprofile\Configurações locais\Temporary Internet Files\Content.IE5 emptied successfully
==== Empty FireFox Cache ======================
No FireFox Cache found
==== Empty Chrome Cache ======================
No Chrome User Data found
==== Empty All Flash Cache ======================
Flash Cache Emptied Successfully
==== Empty All Java Cache ======================
No Java Cache Found
==== E:\zoek_backup content ======================
E:\zoek_backup (files=54 folders=20 10573184 bytes)
==== Empty Temp Folders ======================
E:\WINDOWS\Temp will be emptied at reboot
==== After Reboot ======================
==== Empty Temp Folders ======================
E:\WINDOWS\Temp successfully emptied
E:\DOCUME~1\ADMINI~1\CONFIG~1\Temp successfully emptied
==== Empty Recycle Bin ======================
E:\RECYCLER successfully emptied
==== EOF on **** 01/05/2015 at 13:22:37,53 ======================
Rafael, agradeço por sua atenção!!!
Iriel