# # # # # # #

AdwCleaner v2.306 - Relatrio criado em 15/08/2013 s 09:49:56 Atualizado em 19/07/2013 por Xplode Sistema Operacional : Windows 7 Ultimate Service Pack 1 (64 bits) Usurio : Marcos - MARCOS-PC Modo de Boot : Normal Executado de : C:\Users\Marcos\Downloads\adwcleaner.exe Opo [Verificar]

***** [Servios] ***** Encontrado : BrowserProtect Encontrado : IBUpdaterService ***** [Arquivos/Pastas] ***** Arquivo Encontrado : C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Defau lt\bProtector Web Data Arquivo Encontrado : C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Defau lt\bprotectorpreferences Arquivo Encontrado : C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Defau lt\Local Storage\chrome-extension_ojcgaoafcmbadjkfdippkdddgkeaipbn_0.localstorag e Arquivo Encontrado : C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Defau lt\Local Storage\chrome-extension_ojcgaoafcmbadjkfdippkdddgkeaipbn_0.localstorag e-journal Arquivo Encontrado : C:\Users\Marcos\AppData\Roaming\BabMaint.exe Arquivo Encontrado : C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\hp zl8c1k.default\bprotector_extensions.sqlite Arquivo Infected : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google C hrome\Google Chrome.lnk ( arg. : hxxp://www.qvo6.com/?utm_source=b&utm_medium=ne wgdp&from=newgdp&uid=WDCXWD3200BPVT-80JJ5T0_WD-WXM1EC1FNAMKFNAMK&ts=1367873780) Arquivo Infected : C:\Users\Marcos\AppData\Roaming\Microsoft\Internet Explorer\Q uick Launch\Google Chrome.lnk ( arg. : hxxp://www.qvo6.com/?utm_source=b&utm_med ium=newgdp&from=newgdp&uid=WDCXWD3200BPVT-80JJ5T0_WD-WXM1EC1FNAMKFNAMK&ts=136787 3780) Arquivo Infected : C:\Users\Marcos\AppData\Roaming\Microsoft\Internet Explorer\Q uick Launch\Launch Internet Explorer Browser.lnk ( arg. : hxxp://www.22find.com/ ?utm_source=b&utm_medium=slbnew&from=slbnew&uid=WDCXWD3200BPVT-80JJ5T0_WD-WXM1EC 1FNAMKFNAMK&ts=1363610788) Arquivo Infected : C:\Users\Marcos\AppData\Roaming\Microsoft\Internet Explorer\Q uick Launch\User Pinned\TaskBar\Google Chrome.lnk ( arg. : hxxp://www.qvo6.com/? utm_source=b&utm_medium=newgdp&from=newgdp&uid=WDCXWD3200BPVT-80JJ5T0_WD-WXM1EC1 FNAMKFNAMK&ts=1367873780) Arquivo Infected : C:\Users\Marcos\AppData\Roaming\Microsoft\Internet Explorer\Q uick Launch\User Pinned\TaskBar\Internet Explorer.lnk ( arg. : hxxp://www.22find .com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=WDCXWD3200BPVT-80JJ5T0_WD-W XM1EC1FNAMKFNAMK&ts=1363610788) Arquivo Infected : C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\ Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk ( arg. : hx xp://www.22find.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=WDCXWD3200BP VT-80JJ5T0_WD-WXM1EC1FNAMKFNAMK&ts=1363610788) Arquivo Infected : C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\ Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk ( arg. : hx xp://www.22find.com/?utm_source=b&utm_medium=slbnew&from=slbnew&uid=WDCXWD3200BP VT-80JJ5T0_WD-WXM1EC1FNAMKFNAMK&ts=1363610788) Arquivo Infected : C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\ Programs\Internet Explorer.lnk ( arg. : hxxp://www.22find.com/?utm_source=b&utm_ medium=slbnew&from=slbnew&uid=WDCXWD3200BPVT-80JJ5T0_WD-WXM1EC1FNAMKFNAMK&ts=136 3610788)

Arquivo Infected : C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\ Programs\Internet Explorer.lnk ( arg. : hxxp://www.22find.com/?utm_source=b&utm_ medium=slbnew&from=slbnew&uid=WDCXWD3200BPVT-80JJ5T0_WD-WXM1EC1FNAMKFNAMK&ts=136 3610788) Arquivo Infected : C:\Users\Public\Desktop\Google Chrome.lnk ( arg. : hxxp://www .qvo6.com/?utm_source=b&utm_medium=newgdp&from=newgdp&uid=WDCXWD3200BPVT-80JJ5T0 _WD-WXM1EC1FNAMKFNAMK&ts=1367873780) Pasta Encontrado : C:\Program Files (x86)\DealPly Pasta Encontrado : C:\Program Files (x86)\Desk 365 Pasta Encontrado : C:\Program Files (x86)\Minibar Pasta Encontrado : C:\ProgramData\Babylon Pasta Encontrado : C:\ProgramData\boost_interprocess Pasta Encontrado : C:\ProgramData\BrowserProtect Pasta Encontrado : C:\ProgramData\eSafe Pasta Encontrado : C:\ProgramData\IBUpdaterService Pasta Encontrado : C:\ProgramData\Tarma Installer Pasta Encontrado : C:\Users\Marcos\AppData\Local\B1E Pasta Encontrado : C:\Users\Marcos\AppData\Local\Minibar Pasta Encontrado : C:\Users\Marcos\AppData\Local\Temp\Desk365 Pasta Encontrado : C:\Users\Marcos\AppData\LocalLow\Minibar Pasta Encontrado : C:\Users\Marcos\AppData\Roaming\B1Toolbar Pasta Encontrado : C:\Users\Marcos\AppData\Roaming\BabSolution Pasta Encontrado : C:\Users\Marcos\AppData\Roaming\Babylon Pasta Encontrado : C:\Users\Marcos\AppData\Roaming\DealPly Pasta Encontrado : C:\Users\Marcos\AppData\Roaming\eIntaller Pasta Encontrado : C:\Users\Marcos\AppData\Roaming\file scout Pasta Encontrado : C:\Users\Marcos\AppData\Roaming\Microsoft\Windows\Start Menu\ Programs\DealPly Pasta Encontrado : C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\hpzl 8c1k.default\extensions\plugin@getwebcake.com ***** [Registro] ***** Chave Encontrada : HKCU\Software\AppDataLow\Software\SmartBar Chave Encontrada : HKCU\Software\BabSolution Chave Encontrada : HKCU\Software\BabylonToolbar Chave Encontrada : HKCU\Software\Conduit Chave Encontrada : HKCU\Software\DataMngr Chave Encontrada : HKCU\Software\DataMngr_Toolbar Chave Encontrada : HKCU\Software\DealPly Chave Encontrada : HKCU\Software\filescout Chave Encontrada : HKCU\Software\IM Chave Encontrada : HKCU\Software\ImInstaller Chave Encontrada : HKCU\Software\InstallCore Chave Encontrada : HKCU\Software\lollipop Chave Encontrada : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSe ttings Chave Encontrada : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{ 4B6ACEA2-308A-4876-AD36-57CEC5B4FCC7} Chave Encontrada : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{ AA74D58F-ACD0-450D-A85E-6C04B171C044} Chave Encontrada : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4B6 ACEA2-308A-4876-AD36-57CEC5B4FCC7} Chave Encontrada : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AA7 4D58F-ACD0-450D-A85E-6C04B171C044} Chave Encontrada : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AAA 38851-3CFF-475F-B5E0-720D3645E4A5} Chave Encontrada : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Deal Ply Chave Encontrada : HKCU\Software\Minibar

Chave Encontrada : HKCU\Software\performersoft llc Chave Encontrada : HKCU\Software\e088dbb038e944 Chave Encontrada : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF 796-C2DC-4D79-A620-CCE0C0A66CC9} Chave Encontrada : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0 A4E-99AF-4226-BDF6-49120163DE86} Chave Encontrada : HKLM\Software\Babylon Chave Encontrada : HKLM\SOFTWARE\Classes\AppID\{7169BBB3-3289-4696-B35D-4A88BCF6 FB12} Chave Encontrada : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD 98DB} Chave Encontrada : HKLM\SOFTWARE\Classes\AppID\WebCakeIEClient.DLL Chave Encontrada : HKLM\SOFTWARE\Classes\Prod.cap Chave Encontrada : HKLM\SOFTWARE\Classes\TypeLib\{F13D3582-1359-4F8F-9A48-EF3AE9 F5701C} Chave Encontrada : HKLM\SOFTWARE\Classes\WebCakeIEClient.Api Chave Encontrada : HKLM\SOFTWARE\Classes\WebCakeIEClient.Api.1 Chave Encontrada : HKLM\SOFTWARE\Classes\WebCakeIEClient.Layers Chave Encontrada : HKLM\SOFTWARE\Classes\WebCakeIEClient.Layers.1 Chave Encontrada : HKLM\Software\DataMngr Chave Encontrada : HKLM\Software\DealPly Chave Encontrada : HKLM\Software\delta-homesSoftware Chave Encontrada : HKLM\Software\Desksvc Chave Encontrada : HKLM\Software\eSafeSecControl Chave Encontrada : HKLM\Software\ImInstaller Chave Encontrada : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{AAA3885 1-3CFF-475F-B5E0-720D3645E4A5} Chave Encontrada : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32 Chave Encontrada : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS Chave Encontrada : HKLM\Software\Minibar Chave Encontrada : HKLM\Software\qvo6Software Chave Encontrada : HKLM\Software\V9 Chave Encontrada : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4B6ACEA2-308A-4876-A D36-57CEC5B4FCC7} Chave Encontrada : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{539F76FD-084E-4858-8 6D5-62F02F54AE86} Chave Encontrada : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AA74D58F-ACD0-450D-A 85E-6C04B171C044} Chave Encontrada : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AAA38851-3CFF-475F-B 5E0-720D3645E4A5} Chave Encontrada : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{26E7211D-0650-43 CF-8498-4C81E83AEAAA} Chave Encontrada : HKLM\SOFTWARE\Wow6432Node\e088dbb038e944 Chave Encontrada : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dhkplhfnhc eodhffomolpfigojocbpcb Chave Encontrada : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\fjoijdanha iflhibkljeklcghcmmfffh Chave Encontrada : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchS copes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} Chave Encontrada : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ex plorer\Browser Helper Objects\{4B6ACEA2-308A-4876-AD36-57CEC5B4FCC7} Chave Encontrada : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ex plorer\Browser Helper Objects\{AA74D58F-ACD0-450D-A85E-6C04B171C044} Chave Encontrada : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Un install\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693} Chave Encontrada : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Un install\Babylon Chrome Toolbar Chave Encontrada : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Un install\DealPly Chave Encontrada : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Un

install\Updater Service Chave Encontrada : HKLM\SOFTWARE\Classes\Interface\{26E7211D-0650-43CF-8498-4C81 E83AEAAA} Chave Encontrada : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0 A4E-99AF-4226-BDF6-49120163DE86} Chave Encontrada : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C4E D781C-7394-4906-AAFF-D6AB64FF7C38} Chave Encontrada : HKLM\SOFTWARE\Tarma Installer Chave Encontrada : HKU\S-1-5-21-220462299-3195353997-2129605699-1000\Software\Mi crosoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Chave Encontrada : HKU\S-1-5-21-220462299-3195353997-2129605699-1000\Software\Mi crosoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} Dados Encontrada : HKLM\...\StartMenuInternet\FIREFOX.EXE [(Default)] = C:\Progr am Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.delta-homes.com/?utm_sourc e=b&utm_medium=newgdp&from=newgdp&uid=WDCXWD3200BPVT-80JJ5T0_WD-WXM1EC1FNAMKFNAM K&ts=1373048106 Dados Encontrada : HKLM\...\StartMenuInternet\IEXPLORE.EXE [(Default)] = C:\Prog ram Files\Internet Explorer\iexplore.exe hxxp://www.22find.com/?utm_source=b&utm _medium=slbnew&from=slbnew&uid=WDCXWD3200BPVT-80JJ5T0_WD-WXM1EC1FNAMKFNAMK&ts=13 63610788 Valor Encontrada : HKCU\Software\Microsoft\Internet Explorer\Main [bprotector st art page] Valor Encontrada : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{53 9F76FD-084E-4858-86D5-62F02F54AE86}] ***** [Navegadores] ***** -\\ Internet Explorer v10.0.9200.16635 [HKCU\Software\Microsoft\Internet Explorer\Main - Search Page] = hxxp://search.b 1.org/?bsrc=hmior&chid=c167991 [HKCU\Software\Microsoft\Internet Explorer\Main - Default_Page_URL] = hxxp://www .delta-homes.com/?utm_source=b&utm_medium=newgdp&from=newgdp&uid=WDCXWD3200BPVT80JJ5T0_WD-WXM1EC1FNAMKFNAMK&ts=1373048106 [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page Before] = hxxp://ww w.qvo6.com/?utm_source=b&utm_medium=newgdp&from=newgdp&uid=WDCXWD3200BPVT-80JJ5T 0_WD-WXM1EC1FNAMKFNAMK&ts=1367873780 [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Default_Page_URL] = hxxp://www .delta-homes.com/?utm_source=b&utm_medium=newgdp&from=newgdp&uid=WDCXWD3200BPVT80JJ5T0_WD-WXM1EC1FNAMKFNAMK&ts=1373048106 [HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main - Default_Page_URL] = hxxp://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&from=newgdp&uid=WDC XWD3200BPVT-80JJ5T0_WD-WXM1EC1FNAMKFNAMK&ts=1373048106 -\\ Mozilla Firefox v21.0 (pt-BR) Arquivo : C:\Users\Marcos\AppData\Roaming\Mozilla\Firefox\Profiles\hpzl8c1k.defa ult\prefs.js Encontrada : user_pref("browser.search.defaultenginename", "delta-homes"); Encontrada : user_pref("browser.search.order.1", "delta-homes"); Encontrada : user_pref("browser.search.selectedEngine", "delta-homes"); -\\ Google Chrome v28.0.1500.95 Arquivo : C:\Users\Marcos\AppData\Local\Google\Chrome\User Data\Default\Preferen ces Encontrada [l.68] : keyword = "qvo6", Encontrada [l.72] : search_url = "hxxp://search.qvo6.com/web/?utm_source=b&utm_m

edium=newgdp&from=newgdp&uid=WDCXWD3200BPVT-80JJ5T0_WD-WXM1EC1FNAMKFNAMK&ts=0&ty pe=default&q={searchTerms}", Encontrada [l.2373] : urls_to_restore_on_startup = [ "hxxp://www.delta-homes.com /?utm_source=b&utm_medium=newgdp&from=newgdp&uid=WDCXWD3200BPVT-80JJ5T0_WD-WXM1E C1FNAMKFNAMK&ts=1373048106" ] ************************* AdwCleaner[R1].txt - [13067 octets] - [15/08/2013 09:49:56] ########## EOF - C:\AdwCleaner[R1].txt - [13128 octets] ##########