Todas as vezes que ligo o computador, o Windows Defender detecta um malware e me dá a seguinte informação: Itens detectados: settingsmodifier:win32/possiblehostsfilehijack Todas as vezes eu dou o comando para limpar o computador e mando remover o arquivo. Hoje já escanei o computador através dos programas Advanced System Protect, Malwarebytes, Supeantispyware, a ferramenta do Windows Malicious Software Removal tool e....muita coisa foi encontra e removida…menos esse hijack. Já alterei o arquivo hosts manualmente como é indicado pelo próprio site da Microsoft e também nada resolveu. O que mais posso fazer????

Valeu, agora está certo. Baixe o programa Junkware Removal Tool no link abaixo: http://thisisudax.org/downloads/JRT.exe Para executar corretamente o programa acima é só seguir as dicas deste tutorial: **Tutorial do Junkware Removal Tool** * Na sua próxima resposta poste o log (relatório) do Junkware Removal Tool que estará salvo em sua área de trabalho com o nome de JRT.txt Ficamos na espera.

Anônima

RAfael, segue o arquivo.


Junkware Removal Tool (JRT) by Malwarebytes  

Version: 7.6.4 (09.28.2015:1)  

OS: Windows 8.1 Single Language x64  

Ran by lilian on 01/10/2015 at 18:02:45,86


~~~ Tasks  

Successfully deleted: [Task] C:\Windows\system32\tasks\PCDEventLauncherTask  

Successfully deleted: [Task] C:\Windows\system32\tasks\PCDoctorBackgroundMonitorTask  

~~~ Registry Values  

~~~ Registry Keys  

~~~ Files  

~~~ Folders  

Successfully deleted: [Folder] C:\users\Public\Documents\guid  

~~~ Chrome  

[C:\Users\wawaz\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset  

[C:\Users\wawaz\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:  

[C:\Users\wawaz\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset  

[C:\Users\wawaz\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:  

[]

Scan was completed on 01/10/2015 at 18:34:54,36

End of JRT log

0 comentários

Anônima

Desative temporariamente seu antivírus para evitar conflitos.

* Acesse este link abaixo e clique no primeiro botão da esquerda que é o botão Download Zoek.exe:

http://www.hijackthis.nl/smeenk/

Salve-o no Desktop (Área de Trabalho).

Para executá-lo corretamente siga as dicas deste tutorial:

**Exclua adwares e outras ameaças de seu PC e browsers com o aplicativo Zoek**

* Assim que ele concluir a limpeza dos problemas acesse o log (relatório) do Zoek que estará em C:*zoek-results.txt* e copie todo seu conteúdo e poste em sua próxima resposta.

0 comentários

Excluído

Essa resposta foi excluída devido a uma violação de nosso Código de Conduta. A resposta foi denunciada manualmente ou identificada por meio da detecção automatizada antes da ação ser tomada. Consulte nosso Código de conduta para obter mais informações.

Os comentários foram desabilitados. Saiba mais

Anônima

Bom, Rafael, agora acho que meu computador não tem mais nada.

SEgue o log:

Zoek.exe v5.0.0.1 Updated 30-09-2015

Tool run by lilian on 02/10/2015 at 11:05:13,18.

Microsoft Windows 8.1 Single Language 6.3.9600 x64

Running in: Normal Mode Internet Access Detected

Launched: C:\Users\wawaz\Desktop\zoek.exe [Scan all users] [Script inserted]

=== System Restore Info ======================

02/10/2015 11:08:08 Zoek.exe System Restore Point Created Successfully.

==== Reset Hosts File ======================

Copyright (c) 1993-2006 Microsoft Corp.

#

This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

#

This file contains the mappings of IP addresses to host names. Each

entry should be kept on an individual line. The IP address should

be placed in the first column followed by the corresponding host name.

The IP address and the host name should be separated by at least one

space.

#

Additionally, comments (such as these) may be inserted on individual

lines or following the machine name denoted by a '#' symbol.

#

For example:

#

102.54.94.97 rhino.acme.com # source server

38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

==== Empty Folders Check ======================

C:\PROGRA~2\Lenovo deleted successfully

C:\PROGRA~3\CorelDRAW Graphics Suite X6 deleted successfully

C:\Users\wawaz\AppData\Roaming\Opera Software deleted successfully

C:\Users\lilian\AppData\Local\softthinks deleted successfully

C:\Users\wawaz\AppData\Local\EmieBrowserModeList deleted successfully

C:\Users\wawaz\AppData\Local\EmieSiteList deleted successfully

C:\Users\wawaz\AppData\Local\EmieUserList deleted successfully

C:\Users\wawaz\AppData\Local\Lenovo deleted successfully

C:\Users\wawaz\AppData\Local\Opera Software deleted successfully

==== Deleting CLSID Registry Keys ======================

==== Deleting CLSID Registry Values ======================

==== Deleting Services ======================

==== Deleting Files \ Folders ======================

C:\PROGRA~2\Lenovo not found

C:\PROGRA~3{883B8AEB-8992-48EA-868D-33C65435DFA9} deleted

C:\PROGRA~3{8AF32939-989B-460A-8726-CA2C776032A1} deleted

C:\PROGRA~3{C7C1B5DB-5639-4D3E-8FC2-D168C5FA4273} deleted

C:\PROGRA~3\Package Cache deleted

C:\Users\wawaz\AppData\Roaming\unins000.exe deleted

C:\Users\wawaz\AppData\Roaming\unins001.exe deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]

"[email protected]"="C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn" [25/11/2014 21:33]

==== Chromium Look ======================

Google Chrome Version: 45.0.2454.101

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions

efaidnbmnnnibpcajpcglclefindmkaj - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx[23/09/2012 19:43]

Google Slides - wawaz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek

Google Docs - wawaz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake

Google Drive - wawaz\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf

YouTube - wawaz\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo

Google Search - wawaz\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf

Adobe Acrobat - Create PDF - wawaz\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj

Google Sheets - wawaz\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap

Google Docs Offline - wawaz\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi

Chrome Hotword Shared Module - wawaz\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg

Chrome Web Store Payments - wawaz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

Gmail - wawaz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== Chromium Fix ======================

C:\Users\wawaz\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_shopping.uol.com.br_0.localstorage deleted successfully

C:\Users\wawaz\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_shopping.uol.com.br_0.localstorage-journal deleted successfully

C:\Users\wawaz\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_ads1.msads.net_0.localstorage deleted successfully

C:\Users\wawaz\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_ads1.msads.net_0.localstorage-journal deleted successfully

C:\Users\wawaz\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_c.betrad.com_0.localstorage deleted successfully

C:\Users\wawaz\AppData\Local\Google\Chrome\User Data\Default\Local Storage\https_c.betrad.com_0.localstorage-journal deleted successfully

C:\Users\wawaz\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_c.betrad.com_0.localstorage deleted successfully

C:\Users\wawaz\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_c.betrad.com_0.localstorage-journal deleted successfully

==== Set IE to Default ======================

Old Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://www.google.com.br/"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"="{60A54940-3DFC-4E35-A5B8-33065EBA7AF8}"

New Values:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://www.google.com.br/"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]

"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"

{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"

{60A54940-3DFC-4E35-A5B8-33065EBA7AF8} Unknown Url="Not_Found"

==== Reset Google Chrome ======================

C:\Users\wawaz\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully

C:\Users\wawaz\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences was reset successfully

C:\Users\wawaz\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

C:\Users\wawaz\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal was reset successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-3033700658-1954339994-4128058259-1001\Software\Microsoft\Internet Explorer\SearchScopes{60A54940-3DFC-4E35-A5B8-33065EBA7AF8} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes{60A54940-3DFC-4E35-A5B8-33065EBA7AF8} deleted successfully

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{60A54940-3DFC-4E35-A5B8-33065EBA7AF8} deleted successfully

==== Deleting CLSID Registry Values ======================

==== shortcuts on Users Desktops ======================

C:\Users\wawaz\Desktop\Windows Defender - Atalho.lnk -

==== shortcuts on All Users Desktop ======================

C:\Users\Public\Desktop\Adobe Acrobat XI Pro.lnk - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Acrobat.exe

C:\Users\Public\Desktop\Adobe FormsCentral.lnk - C:\Program Files (x86)\Adobe\Acrobat 11.0\FormsCentral\FormsCentralForAcrobat.exe

C:\Users\Public\Desktop\Adobe Reader XI.lnk - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe

C:\Users\Public\Desktop\Bitstream Font Navigator (64-Bit).lnk - C:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X6\FontNav64\FontNav.exe

C:\Users\Public\Desktop\Comprar suprimentos - HP Deskjet 2050 J510 series.lnk - C:\Program Files (x86)\HP\HP Deskjet 2050 J510 series\Bin\hpqDTSS.exe

C:\Users\Public\Desktop\Corel CAPTURE X6 (64-Bit).lnk - c:\Windows\Installer{1967EF95-E00B-4669-8B1C-A589BE8BF24F}\NewShortcut6_C2D12190778B49D7B6847BAECAE7BE9D.exe

C:\Users\Public\Desktop\Corel CONNECT X6 (64-Bit).lnk - C:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X6\Connect64\Connect.exe

C:\Users\Public\Desktop\Corel PHOTO-PAINT X6 (64-Bit).lnk - c:\Windows\Installer{D7C2687D-924E-4485-B367-C7D95CBF8DDD}\NewShortcut4_1B93EBAA624B47A7847E8976FF2E037B.exe

C:\Users\Public\Desktop\CorelDRAW X6 (64-Bit).lnk - c:\Windows\Installer{27AE72A4-B217-4CDC-B82B-3311E9D7460E}\NewShortcut1_41AAC0AC880545E6A1C81230F4159C30.exe

C:\Users\Public\Desktop\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Users\Public\Desktop\HP Deskjet 2050 J510 series.lnk - C:\Program Files (x86)\HP\HP Deskjet 2050 J510 series\Bin\HP Deskjet 2050 J510 series.exe -Start UDCDevicePage

C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

C:\Users\Public\Desktop\PowerISO.lnk - C:\Program Files\PowerISO\PowerISO.exe

C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Users\Public\Desktop\VLC media player.lnk - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe

==== shortcuts in All Users Start Menu ======================

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk - C:\Windows\Installer{AC76BA86-7AD7-FFFF-7B44-AB0000000001}\SC_Reader.ico

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcGIS\ArcCatalog 10.1.lnk - C:\Program Files (x86)\ArcGIS\Desktop10.1\bin\ArcCatalog.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcGIS\ArcGIS Administrator.lnk - C:\Program Files (x86)\Common Files\ArcGIS\bin\ArcGISAdmin.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcGIS\ArcGlobe 10.1.lnk - C:\Program Files (x86)\ArcGIS\Desktop10.1\bin\ArcGlobe.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcGIS\ArcMap 10.1.lnk - C:\Program Files (x86)\ArcGIS\Desktop10.1\bin\ArcMap.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcGIS\ArcScene 10.1.lnk - C:\Program Files (x86)\ArcGIS\Desktop10.1\bin\ArcScene.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcGIS\ArcGIS for Desktop Help\ArcGIS 10.1 for Desktop Help.lnk - C:\Windows\SysWOW64\hh.exe C:\Program Files (x86)\ArcGIS\Desktop10.1\Help\ArcInfoMain.chm

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcGIS\ArcGIS for Desktop Help\ArcGIS for Desktop Resource Center.lnk - C:\Program Files (x86)\ArcGIS\Desktop10.1\help\HelpOnline.url

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcGIS\Desktop Tools\ArcGIS Document Defragmenter.lnk - C:\Program Files (x86)\ArcGIS\Desktop10.1\Tools\DocDefragmenter.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcGIS\Desktop Tools\MXD Doctor.lnk - C:\Program Files (x86)\ArcGIS\Desktop10.1\Tools\MXDDoctor.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcGIS\License Manager\License Manager Reference Guide.lnk - C:\Program Files (x86)\ArcGIS\License10.1\Documentation\lmrefguide.htm

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcGIS\License Manager\License Server Administrator.lnk - C:\Program Files (x86)\ArcGIS\License10.1\bin\LSAdmin.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcGIS\Python 2.7\IDLE (Python GUI).lnk - C:\Python27\ArcGIS10.1\pythonw.exe "C:\Python27\ArcGIS10.1\Lib\idlelib\idle.pyw"

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcGIS\Python 2.7\Module Docs.lnk - C:\Python27\ArcGIS10.1\pythonw.exe "C:\Python27\ArcGIS10.1\Tools\scripts\pydocgui.pyw"

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcGIS\Python 2.7\Python (command line).lnk - C:\Python27\ArcGIS10.1\python.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArcGIS\Python 2.7\Python Manuals.lnk - C:\Python27\ArcGIS10.1\Doc\python272.chm

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X6 (64-Bit)\Bitstream Font Navigator (64-Bit).lnk - C:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X6\FontNav64\FontNav.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X6 (64-Bit)\Corel CAPTURE X6 (64-Bit).lnk - c:\Windows\Installer{1967EF95-E00B-4669-8B1C-A589BE8BF24F}\NewShortcut6_C2D12190778B49D7B6847BAECAE7BE9D.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X6 (64-Bit)\Corel CONNECT X6 (64-Bit).lnk - C:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X6\Connect64\Connect.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X6 (64-Bit)\Corel PHOTO-PAINT X6 (64-Bit).lnk - c:\Windows\Installer{D7C2687D-924E-4485-B367-C7D95CBF8DDD}\NewShortcut4_1B93EBAA624B47A7847E8976FF2E037B.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X6 (64-Bit)\CorelDRAW X6 (64-Bit).lnk - c:\Windows\Installer{27AE72A4-B217-4CDC-B82B-3311E9D7460E}\NewShortcut1_41AAC0AC880545E6A1C81230F4159C30.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X6 (64-Bit)\Duplexing Wizard (64-Bit).lnk - c:\Windows\Installer{27AE72A4-B217-4CDC-B82B-3311E9D7460E}\NewShortcut10_449D396305C74241ABE7BA91391CF9B4.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X6 (64-Bit)\Video Tutorials X6 (64-Bit).lnk - C:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X6\VideoBrowser64\VideoBrowser.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X6 (64-Bit)\Documentation\CorelDRAW Graphics Suite X6 Guidebook.lnk -

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X6 (64-Bit)\Documentation\Macro Programming Guide.lnk - C:\Program Files (x86)\Corel\CorelDRAW Graphics Suite X6\Data\Macro Programming Guide.pdf

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell\Dell Notification Center.lnk - C:\Program Files (x86)\Dell\Dell Foundation Services\DFSSystrayUI.exe /mainui

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell\Dell Update.lnk - C:\Program Files (x86)\Dell Update\DellUpTray.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Configurar Java.lnk - C:\Program Files (x86)\Java\jre1.8.0_60\bin\javacpl.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Sobre o Java.lnk - C:\Program Files (x86)\Java\jre1.8.0_60\bin\javacpl.exe -tab about

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Verificar Atualizações.lnk -

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Desinstalar Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\unins000.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Malwarebytes Anti-Malware Notifications.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Malwarebytes Anti-Malware.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk - C:\Program Files (x86)\Malwarebytes Anti-Malware\Chameleon\Windows\chameleon.chm

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SafeSign Standard\Administração de token.lnk -

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SafeSign Standard\Documentação\Contrato de Licença.lnk -

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware\SUPERAntiSpyware Alternate Start.lnk - C:\Program Files\SUPERAntiSpyware\RUNSAS.EXE

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware\SUPERAntiSpyware Free Edition.lnk - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware\SUPERAntiSpyware Registration-Activation.lnk - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe /register

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Documentation.lnk - C:\Program Files (x86)\VideoLAN\VLC\Documentation.url

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\Release Notes.lnk - C:\Program Files (x86)\VideoLAN\VLC\NEWS.txt

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VideoLAN Website.lnk - C:\Program Files (x86)\VideoLAN\VLC\VideoLAN Website.url

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player - reset preferences and cache files.lnk - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe --reset-config --reset-plugins-cache vlc://quit

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player skinned.lnk - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe -Iskins

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN\VLC media player.lnk - C:\Program Files (x86)\VideoLAN\VLC\vlc.exe

==== shortcuts in Quick Launch ======================

C:\Users\wawaz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Users\wawaz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\wawaz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk -

C:\Users\wawaz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk -

C:\Users\wawaz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Calculator.lnk - C:\Windows\system32\calc.exe

C:\Users\wawaz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Excel 2013.lnk - C:\Windows\Installer{91150000-0011-0000-1000-0000000FF1CE}\xlicons.exe

C:\Users\wawaz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk -

C:\Users\wawaz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Users\wawaz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk - C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Users\wawaz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\PowerPoint 2013.lnk - C:\Windows\Installer{91150000-0011-0000-1000-0000000FF1CE}\pptico.exe

C:\Users\wawaz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Word 2013.lnk - C:\Windows\Installer{91150000-0011-0000-1000-0000000FF1CE}\wordicon.exe