Instalar ZOEK.exe

start

CreateRestorePoint:

AlternateDataStreams: C:\ProgramData\TEMP:373E1720

AlternateDataStreams: C:\Users\Todos os Usuários\TEMP:373E1720

HKLM Group Policy restriction on software: C:\Program Files\AVAST Software\Avast\avastui.exe <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\AVAST Software\Avast\avastsvc.exe <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\AVAST Software\Avast\ashUpd.exe <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\AVAST Software\Avast\ashQuick.exe <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\AVAST Software\Avast\sched.exe <====== ATTENTION

HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore: [DisableSR/DisableConfig]  <===== ATTENTION

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

HKU.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.oquefazernainternet.com/

HKU.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.oquefazernainternet.com/

URLSearchHook: [S-1-5-21-3504019602-3750793420-2798553429-500] ATTENTION ==> Default URLSearchHook is missing.

SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL =

SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01

SearchScopes: HKU.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-21-3504019602-3750793420-2798553429-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=key7&utm_campaign=install_ie&utm_content=ds&from=key7&uid=WDCXWD1600BEVS-00VAT0_WD-WXE308E2188021880&ts=1422740558&type=default&q={searchTerms}

SearchScopes: HKU\S-1-5-21-3504019602-3750793420-2798553429-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=key7&utm_campaign=install_ie&utm_content=ds&from=key7&uid=WDCXWD1600BEVS-00VAT0_WD-WXE308E2188021880&ts=1422740558&type=default&q={searchTerms}

SearchScopes: HKU\S-1-5-21-3504019602-3750793420-2798553429-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=key7&utm_campaign=install_ie&utm_content=ds&from=key7&uid=WDCXWD1600BEVS-00VAT0_WD-WXE308E2188021880&ts=1422740558&type=default&q={searchTerms}

SearchScopes: HKU\S-1-5-21-3504019602-3750793420-2798553429-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=key7&utm_campaign=install_ie&utm_content=ds&from=key7&uid=WDCXWD1600BEVS-00VAT0_WD-WXE308E2188021880&ts=1422740558&type=default&q={searchTerms}

SearchScopes: HKU\S-1-5-21-3504019602-3750793420-2798553429-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=key7&utm_campaign=install_ie&utm_content=ds&from=key7&uid=WDCXWD1600BEVS-00VAT0_WD-WXE308E2188021880&ts=1422740558&type=default&q={searchTerms}

StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe www.jogostempo.com?oem=brsoftv3&uid=WD-WXE308E21880_WDCWD1600BEVS-00VAT0&tm=1422627361

CHR HKU\S-1-5-21-3504019602-3750793420-2798553429-1000\SOFTWARE\Google\Chrome\Extensions...\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - https://clients2.google.com/service/update2/crx

OPR Extension: (I - Cinema) - C:\Users\CARLOS\AppData\Roaming\Opera Software\Opera Stable\Extensions\dimfohdigjaffdaanhmbocfkpolglnjk [2015-01-31]

S3 BdApiUtil; ??\C:\Program Files (x86)\Baidu Security\Baidu Antivirus\BdApiUtil64.sys [X]

S3 BdCameraProtect; ??\C:\Program Files (x86)\Baidu Security\Baidu Antivirus\BdCameraProtect64.sys [X]

S3 BprotectEx; ??\C:\Windows\System32\drivers\BprotectEx.sys [X]

S3 cpuz134; ??\C:\Users\CARLOS\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]

S3 PCFApiUtil; ??\C:\Program Files (x86)\PC Faster\PCFApiUtil64.sys [X]

C:\Program Files (x86)\Baidu Security

C:\Windows\System32\drivers\BprotectEx.sys

C:\Program Files (x86)\PC Faster

2015-01-25 13:12 - 2015-01-25 13:12 - 0001248 _____ () C:\Users\CARLOS\AppData\Roaming\YHSKM

2015-01-30 11:36 - 2015-01-30 11:36 - 0613057 _____ (CMI Limited) C:\Users\CARLOS\AppData\Local\nsnBC48.tmp

2014-01-15 02:15 - 2014-01-15 02:15 - 0167784 _____ (Baidu, Inc.) C:\ProgramData\FileSplitUpLoad.dll

C:\ProgramData\FileSplitUpLoad.dll

C:\Users\Todos os Usuários\FileSplitUpLoad.dll

C:\Users\CARLOS\AppData\Local\Temp\1.tmp.exe

C:\Users\CARLOS\AppData\Local\Temp\Baidu_Secure_SystemUp_5.1.3.109697.exe

C:\Users\CARLOS\AppData\Local\Temp\ce98ac2e-20c0-4a93-86f6-bdb3e61caf55.exe

C:\Users\CARLOS\AppData\Local\Temp\eFixProPackage.exe

EmptyTemp:

end

Além de seguir as orientações que te passei na mensagem anterior, confira também estes itens abaixo:

Estão constando no seu PC os antivirus Avg e Avast. Seria muito importante remover um dos dois, pois mais de um antivirus pode causar conflitos no sistema.

___________________________________________________________________

Está constando em seu PC este proxy: http=127.0.0.1:64578;https=127.0.0.1:64578 

Foi você que configurou este proxy ou você não fez isto?

Além de responder esta pergunta e desinstalar um destes antivirus, siga também as dicas que lhe passei na resposta anterior e poste o relatório Fixlog.txtem sua próxima resposta.

Acesse o link abaixo e clique no botão verde na parte superior direita onde está escrito DOWNLOAD (4.87 KB) para baixar o arquivo fixlist.txt:

http://migre.me/p1ZXR

Salve-o no Desktop (área de trabalho).

Clique com o botão direito do mouse sobre o FRST64, depois clique em .

Clique no botão Fix.

Aguarde e ao final, o relatório Fixlog.txt será salvo no seu desktop.

Selecione, copie e cole o conteúdo deste Fixlog.txt em sua próxima resposta.

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015

Ran by CARLOS (ATTENTION: The logged in user is not administrator) on CARLOS-PC on 15-03-2015 12:46:34

Running from C:\Users\CARLOS\Desktop

Loaded Profiles: CARLOS & Administrador (Available profiles: CARLOS & Administrador)

Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Português (Brasil)

Internet Explorer Version 11 (Default browser not detected!)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

Failed to access process -> smss.exe

Failed to access process -> csrss.exe

Failed to access process -> csrss.exe

Failed to access process -> wininit.exe

Failed to access process -> winlogon.exe

Failed to access process -> services.exe

Failed to access process -> lsass.exe

Failed to access process -> lsm.exe

Failed to access process -> svchost.exe

(GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe

Failed to access process -> svchost.exe

Failed to access process -> svchost.exe

Failed to access process -> svchost.exe

Failed to access process -> svchost.exe

Failed to access process -> svchost.exe

Failed to access process -> svchost.exe

Failed to access process -> spoolsv.exe

Failed to access process -> svchost.exe

Failed to access process -> armsvc.exe

Failed to access process -> AppleMobileDeviceService.exe

Failed to access process -> avgwdsvc.exe

Failed to access process -> mDNSResponder.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

Failed to access process -> netservice.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe

Failed to access process -> svchost.exe

Failed to access process -> svchost.exe

Failed to access process -> rndlresolversvc.exe

Failed to access process -> svchost.exe

Failed to access process -> svchost.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe

Failed to access process -> WLIDSVC.EXE

Failed to access process -> WLIDSVCM.EXE

Failed to access process -> GoogleCrashHandler.exe

Failed to access process -> GoogleCrashHandler64.exe

Failed to access process -> SearchIndexer.exe

Failed to access process -> iPodService.exe

(GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe

Failed to access process -> svchost.exe

Failed to access process -> WmiPrvSE.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_16_0_0_305_ActiveX.exe

Failed to access process -> SearchFilterHost.exe

Failed to access process -> SearchProtocolHost.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-02-13] (Apple Inc.)

HKLM-x32...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)

HKLM-x32...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3710416 2015-02-19] (AVG Technologies CZ, s.r.o.)

HKLM Group Policy restriction on software: C:\Program Files\AVAST Software\Avast\avastui.exe <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\AVAST Software\Avast\avastsvc.exe <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\AVAST Software\Avast\ashUpd.exe <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\AVAST Software\Avast\ashQuick.exe <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\AVAST Software\Avast\sched.exe <====== ATTENTION

Winlogon\Notify\ GbPluginAbn-x32: C:\Program Files (x86)\GbPlugin\gbiehAbn.dll (Banco Real)

Winlogon\Notify\ GbPluginBb-x32: C:\Program Files (x86)\GbPlugin\gbieh.dll (Banco do Brasil)

Winlogon\Notify\ GbPluginSfr-x32: C:\Program Files (x86)\GbPlugin\gbiehSfr.dll (Banco Safra)

HKLM...\Policies\Explorer: [HideSCAHealth] 1

HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore: [DisableSR/DisableConfig]  <===== ATTENTION

HKU\S-1-5-21-3504019602-3750793420-2798553429-1000...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-11-21] (Apple Inc.)

HKU\S-1-5-21-3504019602-3750793420-2798553429-1000...\Policies\Explorer: [NoLowDiskSpaceChecks] 1

HKU\S-1-5-21-3504019602-3750793420-2798553429-1000...\Policies\Explorer: [TaskbarNoNotification] 1

HKU\S-1-5-21-3504019602-3750793420-2798553429-1000...\MountPoints2: {d3dd82ce-62bf-11e4-9725-0023aee79dfb} - G:\iStudio.exe

HKU\S-1-5-18...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-11-03] (Microsoft Corporation)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: [S-1-5-21-3504019602-3750793420-2798553429-1000] => http=127.0.0.1:64578;https=127.0.0.1:64578

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com

HKU.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.oquefazernainternet.com/

HKU.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.oquefazernainternet.com/

HKU\S-1-5-21-3504019602-3750793420-2798553429-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01

HKU\S-1-5-21-3504019602-3750793420-2798553429-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/pt-br/?ocid=iehp

HKU\S-1-5-21-3504019602-3750793420-2798553429-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com.br/

URLSearchHook: [S-1-5-21-3504019602-3750793420-2798553429-500] ATTENTION ==> Default URLSearchHook is missing.

SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL =

SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01

SearchScopes: HKU.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-21-3504019602-3750793420-2798553429-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=key7&utm_campaign=install_ie&utm_content=ds&from=key7&uid=WDCXWD1600BEVS-00VAT0_WD-WXE308E2188021880&ts=1422740558&type=default&q={searchTerms}

SearchScopes: HKU\S-1-5-21-3504019602-3750793420-2798553429-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=key7&utm_campaign=install_ie&utm_content=ds&from=key7&uid=WDCXWD1600BEVS-00VAT0_WD-WXE308E2188021880&ts=1422740558&type=default&q={searchTerms}

SearchScopes: HKU\S-1-5-21-3504019602-3750793420-2798553429-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=key7&utm_campaign=install_ie&utm_content=ds&from=key7&uid=WDCXWD1600BEVS-00VAT0_WD-WXE308E2188021880&ts=1422740558&type=default&q={searchTerms}

SearchScopes: HKU\S-1-5-21-3504019602-3750793420-2798553429-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=key7&utm_campaign=install_ie&utm_content=ds&from=key7&uid=WDCXWD1600BEVS-00VAT0_WD-WXE308E2188021880&ts=1422740558&type=default&q={searchTerms}

SearchScopes: HKU\S-1-5-21-3504019602-3750793420-2798553429-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=key7&utm_campaign=install_ie&utm_content=ds&from=key7&uid=WDCXWD1600BEVS-00VAT0_WD-WXE308E2188021880&ts=1422740558&type=default&q={searchTerms}

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)

BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2013-08-14] (RealDownloader)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-20] (Oracle Corporation)

BHO-x32: Auxiliar de Conexão de Conta da Microsoft -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)

BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540000} -> C:\Program Files (x86)\GbPlugin\gbieh.dll [2015-01-13] (Banco do Brasil)

BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540007} -> C:\Program Files (x86)\GbPlugin\gbiehabn.dll [2014-11-18] (Banco Real)

BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540023} -> C:\Program Files (x86)\GbPlugin\gbiehsfr.dll [2014-12-10] (Banco Safra)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-20] (Oracle Corporation)

DPF: HKLM-x32 {1663ed61-23eb-11d2-b92f-008048fdd814} https://empregos.bol.uol.com.br/erv2/vagas/activex/smsx.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2013-02-26] (Skype Technologies)

ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\Program Files (x86)\GbPlugin\gbieh.dll [1836928 2015-01-13] (Banco do Brasil)

ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399007} - C:\Program Files (x86)\GbPlugin\gbiehabn.dll [1939512 2014-11-18] (Banco Real)

ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399023} - C:\Program Files (x86)\GbPlugin\gbiehsfr.dll [1793840 2014-12-10] (Banco Safra)

Tcpip\Parameters: [DhcpNameServer] 201.6.2.23 201.6.2.143

StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe www.jogostempo.com?oem=brsoftv3&uid=WD-WXE308E21880_WDCWD1600BEVS-00VAT0&tm=1422627361

FireFox:

========

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)

FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-20] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-20] (Oracle Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)

FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [2013-09-16] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2013-08-14] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2013-08-14] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2013-08-14] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [2013-09-16] (RealPlayer)

FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2013-08-14] (RealDownloader)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-3504019602-3750793420-2798553429-1000: gastecnologia.com.br/sf/abn -> C:\Users\CARLOS\AppData\Local\GAS Tecnologia\GBBD\npsf_abn.dll [2014-11-25] (GAS Tecnologia)

FF Plugin HKU\S-1-5-21-3504019602-3750793420-2798553429-1000: gastecnologia.com.br/sf/abn64 -> C:\Users\CARLOS\AppData\Local\GAS Tecnologia\GBBD\npsf_abn_64.dll [2014-11-25] (GAS Tecnologia)

FF Plugin HKU\S-1-5-21-3504019602-3750793420-2798553429-1000: gastecnologia.com.br/sf/bb -> C:\Users\CARLOS\AppData\Local\GAS Tecnologia\GBBD\npsf_bb.dll [2015-01-13] (GAS Tecnologia)

FF Plugin HKU\S-1-5-21-3504019602-3750793420-2798553429-1000: gastecnologia.com.br/sf/bb64 -> C:\Users\CARLOS\AppData\Local\GAS Tecnologia\GBBD\npsf_bb_64.dll [2015-01-13] (GAS Tecnologia)

FF Plugin HKU\S-1-5-21-3504019602-3750793420-2798553429-1000: gastecnologia.com.br/sf/sfr -> C:\Users\CARLOS\AppData\Local\GAS Tecnologia\GBBD\npsf_sfr.dll [2014-09-23] (GAS Tecnologia)

FF HKLM-x32...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-09-16]

FF HKLM-x32...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

Chrome:

=======

CHR HomePage: Default -> hxxp://yahoo.com.br/

CHR StartupUrls: Default -> "https://br.yahoo.com/"

CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}

CHR Profile: C:\Users\CARLOS\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Wallet) - C:\Users\CARLOS\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-31]

CHR Extension: (Gmail) - C:\Users\CARLOS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-31]

CHR HKU\S-1-5-21-3504019602-3750793420-2798553429-1000\SOFTWARE\Google\Chrome\Extensions...\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - https://clients2.google.com/service/update2/crx

CHR HKLM-x32...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14]

Opera:

=======

OPR Extension: (I - Cinema) - C:\Users\CARLOS\AppData\Roaming\Opera Software\Opera Stable\Extensions\dimfohdigjaffdaanhmbocfkpolglnjk [2015-01-31]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)

S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3411408 2015-02-19] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [308720 2015-02-19] (AVG Technologies CZ, s.r.o.)

R2 GbpSv; C:\Program Files (x86)\GbPlugin\gbpsv.exe [555320 2015-01-13] (GAS Tecnologia)

R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]

R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)

R2 lmhosts; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-13] (Microsoft Corporation)

U2 MyLocalService; C:\Windows\SysWOW64\NetService\netservice.exe [226888 2015-01-20] (QNT)

R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]

R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)

R2 NlaSvc; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-13] (Microsoft Corporation)

R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)

R2 nsi; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-13] (Microsoft Corporation)

R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]

R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [270816 2015-02-19] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)

R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)

R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [341472 2015-02-03] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [133088 2015-01-23] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [284128 2015-01-16] (AVG Technologies CZ, s.r.o.)

S0 GbpKm; C:\Windows\SysWOW64\drivers\GbpKm.sys [49536 2013-05-08] (GAS Tecnologia)

S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [93400 2014-11-21] (Malwarebytes Corporation)

S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-03-14] (Malwarebytes Corporation)

R3 Warsaw_PP; C:\Program Files (x86)\GbPlugin\wsftprp64.sys [24792 2014-10-31] (GAS Tecnologia LTDA)

S3 BdApiUtil; ??\C:\Program Files (x86)\Baidu Security\Baidu Antivirus\BdApiUtil64.sys [X]

S3 BdCameraProtect; ??\C:\Program Files (x86)\Baidu Security\Baidu Antivirus\BdCameraProtect64.sys [X]

S3 BprotectEx; ??\C:\Windows\System32\drivers\BprotectEx.sys [X]

S3 cpuz134; ??\C:\Users\CARLOS\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]

S3 PCFApiUtil; ??\C:\Program Files (x86)\PC Faster\PCFApiUtil64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-15 12:46 - 2015-03-15 12:47 - 00020566 _____ () C:\Users\CARLOS\Desktop\FRST.txt

2015-03-15 12:46 - 2015-03-15 12:46 - 00000000 ____D () C:\FRST

2015-03-15 12:45 - 2015-03-15 12:45 - 02095616 _____ (Farbar) C:\Users\CARLOS\Desktop\FRST64.exe

2015-03-14 12:02 - 2015-03-14 12:04 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-03-14 12:02 - 2015-03-14 12:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-03-14 12:02 - 2015-03-14 12:02 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-03-14 12:02 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-03-14 12:02 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-03-14 12:02 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-03-13 19:11 - 2015-03-13 19:11 - 06052446 _____ () C:\Users\CARLOS\Desktop\Anexos_2015313.zip

2015-03-13 12:34 - 2015-03-13 12:33 - 00001937 _____ () C:\Users\Administrador\Desktop\ZHPFixReport.txt

2015-03-12 17:06 - 2015-03-12 17:06 - 00087147 _____ () C:\Users\Administrador\Desktop\ZHPDiag.txt

2015-03-12 17:05 - 2015-03-12 17:05 - 00000512 _____ () C:\PhysicalDisk0_MBR.bin

2015-03-12 16:59 - 2015-03-12 16:59 - 00001987 _____ () C:\Users\Administrador\Desktop\ZHPFix.lnk

2015-03-12 16:59 - 2015-03-12 16:59 - 00001860 _____ () C:\Users\Administrador\Desktop\ZHPDiag.lnk

2015-03-12 16:59 - 2015-03-12 16:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP

2015-03-12 16:59 - 2015-03-12 16:59 - 00000000 ____D () C:\Program Files (x86)\ZHPDiag

2015-03-11 12:53 - 2015-03-11 12:53 - 00001941 _____ () C:\Users\CARLOS\Desktop\Orlando 2015 - Cláudia - Atalho.lnk

2015-03-11 12:41 - 2015-03-11 12:41 - 00001058 _____ () C:\Windows\WindowsUpdate.log

2015-03-02 14:20 - 2015-03-02 14:20 - 00000000 ____D () C:\Users\Administrador\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Programas RFB2015

2015-03-01 21:31 - 2015-03-14 12:14 - 00000000 ____D () C:\Users\CARLOS\Desktop\Cleaner´s

2015-02-27 21:16 - 2015-02-27 21:16 - 00000000 ____D () C:\Users\CARLOS\AppData\Local\WinZip

2015-02-27 21:16 - 2015-02-27 21:16 - 00000000 ____D () C:\Users\Administrador\AppData\Local\WinZip

2015-02-27 21:15 - 2015-02-27 21:16 - 00000000 ____D () C:\Users\Todos os Usuários\WinZip

2015-02-27 21:15 - 2015-02-27 21:16 - 00000000 ____D () C:\ProgramData\WinZip

2015-02-27 21:15 - 2015-02-27 21:15 - 00002211 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\WinZip.lnk

2015-02-27 21:15 - 2015-02-27 21:15 - 00001651 _____ () C:\WinZip Quick Pick.lnk

2015-02-27 21:15 - 2015-02-27 21:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip

2015-02-27 21:15 - 2015-02-27 21:15 - 00000000 ____D () C:\Program Files\WinZip

2015-02-27 21:13 - 2015-02-27 21:13 - 120105328 _____ () C:\Users\Administrador\Downloads\winzip-19-0-build-11294-32-bits [1].exe

2015-02-27 21:08 - 2015-02-27 21:08 - 00000000 ____D () C:\Users\CARLOS\Documents\Add-in Express

2015-02-27 18:43 - 2015-03-14 15:05 - 00051758 _____ () C:\Windows\PFRO.log

2015-02-27 17:54 - 2015-02-27 17:54 - 00000000 ____D () C:\Users\Todos os Usuários\Malwarebytes

2015-02-27 17:54 - 2015-02-27 17:54 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-02-27 16:32 - 2015-02-27 16:32 - 00000000 _____ () C:\essai.txt

2015-02-27 15:59 - 2015-03-13 12:34 - 00000000 ____D () C:\Users\Administrador\AppData\Roaming\ZHP

2015-02-27 14:11 - 2015-02-27 14:17 - 00000000 ____D () C:\AdwCleaner

2015-02-25 21:37 - 2015-02-25 22:08 - 00213547 _____ () C:\Users\CARLOS\Documents\1.pptx

2015-02-22 11:12 - 2015-02-22 11:12 - 00000000 ____D () C:\Users\Administrador\AppData\Local\Apple Computer

2015-02-22 11:12 - 2015-02-22 11:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2015-02-22 11:10 - 2015-02-22 11:12 - 00000000 ____D () C:\Users\Todos os Usuários\E1864A66-75E3-486a-BD95-D1B7D99A84A7

2015-02-22 11:10 - 2015-02-22 11:12 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7

2015-02-22 11:10 - 2015-02-22 11:12 - 00000000 ____D () C:\Program Files\iTunes

2015-02-22 11:10 - 2015-02-22 11:10 - 00000000 ____D () C:\Program Files\iPod

2015-02-22 11:10 - 2015-02-22 11:10 - 00000000 ____D () C:\Program Files (x86)\iTunes

2015-02-22 10:49 - 2015-03-15 12:36 - 00002712 _____ () C:\Windows\setupact.log

2015-02-22 10:49 - 2015-02-22 10:49 - 00000000 _____ () C:\Windows\setuperr.log

2015-02-22 01:42 - 2015-02-22 01:42 - 00000000 ____D () C:\Users\Administrador\AppData\Roaming\Macromedia

2015-02-21 22:29 - 2015-02-21 23:10 - 00000000 ___HD () C:\Users\CARLOS\Documents.4sh

2015-02-21 22:23 - 2015-02-21 22:25 - 11375064 _____ (New IT Solutions) C:\Users\CARLOS\Downloads\4shared-desktop-4-0-11-32-bits [1].exe

2015-02-21 17:47 - 2015-02-21 17:47 - 00000000 __SHD () C:\Users\Administrador\AppData\Local\EmieUserList

2015-02-21 17:47 - 2015-02-21 17:47 - 00000000 __SHD () C:\Users\Administrador\AppData\Local\EmieSiteList

2015-02-21 17:47 - 2015-02-21 17:47 - 00000000 __SHD () C:\Users\Administrador\AppData\Local\EmieBrowserModeList

2015-02-21 17:47 - 2015-02-21 17:47 - 00000000 ____D () C:\Users\Administrador\AppData\Roaming\RealNetworks

2015-02-21 17:46 - 2015-02-22 11:12 - 00000000 ____D () C:\Users\Administrador\AppData\Roaming\Apple Computer

2015-02-21 17:46 - 2015-02-21 17:46 - 00115528 _____ () C:\Users\Administrador\AppData\Local\GDIPFONTCACHEV1.DAT

2015-02-21 17:46 - 2015-02-21 17:46 - 00001389 _____ () C:\Users\Administrador\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-02-21 17:46 - 2015-02-21 17:46 - 00000000 ____D () C:\Users\Administrador\AppData\Roaming\AVG2015

2015-02-21 17:46 - 2015-02-21 17:46 - 00000000 ____D () C:\Users\Administrador\AppData\Roaming\Adobe

2015-02-21 17:46 - 2015-02-21 17:46 - 00000000 ____D () C:\Users\Administrador\AppData\Local\Google

2015-02-21 17:46 - 2015-02-21 17:46 - 00000000 ____D () C:\Users\Administrador\AppData\Local\Avg2015

2015-02-21 17:44 - 2015-02-21 17:46 - 00000000 ____D () C:\Users\Administrador

2015-02-21 17:44 - 2015-02-21 17:44 - 00000020 ___SH () C:\Users\Administrador\ntuser.ini

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Modelos

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Meus documentos

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Menu Iniciar

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Documents\Minhas músicas

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Documents\Minhas imagens

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Documents\Meus vídeos

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Dados de aplicativos

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Configurações locais

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\AppData\Roaming\Microsoft\Windows\Start Menu\Programas

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\AppData\Local\Histórico

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\AppData\Local\Dados de aplicativos

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Ambiente de rede

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Ambiente de impressão

2015-02-21 17:44 - 2013-05-15 18:38 - 00000000 ____D () C:\Users\Administrador\AppData\Roaming\TuneUp Software

2015-02-21 17:44 - 2013-04-23 10:12 - 00000000 ____D () C:\Users\Administrador\AppData\Local\Microsoft Help

2015-02-21 17:44 - 2009-07-14 01:54 - 00000000 ___RD () C:\Users\Administrador\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-02-21 17:44 - 2009-07-14 01:49 - 00000000 ___RD () C:\Users\Administrador\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2015-02-20 14:35 - 2015-02-20 14:35 - 00776274 _____ () C:\Users\CARLOS\Documents\europa 1.wlmp

2015-02-19 21:26 - 2015-02-19 21:26 - 00270816 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system