Resultado do exame da Farbar Recovery Scan Tool (FRST) (x64) Versão:05-03-2016 01
Executado por Renee (administrador) em RENEE-PC (01-04-2016 22:13:20)
Executando a partir de C:\Users\Renee\Downloads
Perfis Carregados: Renee (Perfis Disponíveis: Renee)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Idioma: Português (Brasil)
Internet Explorer Versão 11 (Navegador padrão: Chrome)
Modo da Inicialização: Normal
Tutorial da Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processos (Whitelisted) =================

(Se uma entrada for incluída na fixlist, o processo será fechado. O arquivo não será movido.)

(GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.5\GoogleCrashHandler64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Projector\Epson USB Display V1.6\EMP_UDSA.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Popcorn Time) C:\Program Files (x86)\Popcorn Time\Updater.exe
(GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
() C:\Program Files\Nognerxokjocmo\UcooRudvup.exe
() C:\Users\Renee\AppData\Roaming\Ujiqfaumb\Ujiqfaumb.exe
() C:\Users\Renee\AppData\Roaming\Ujiqfaumb\Jhwyyp.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
() C:\Program Files\NewExt\nssm.exe
() C:\Program Files\NewExt\jsinjector.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
() C:\Program Files\Nognerxokjocmo\Savtanhe.exe
() C:\Program Files (x86)\CalendarTool\2.0.0.11189\CalendarServ.exe
(skype.cog.cc) C:\Program Files (x86)\SkypeUpdateEx\SkypeUpdateEx.exe
() C:\Windows\Temp\F55D.tmp
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\Renee\AppData\Roaming\Ujiqfaumb\Igiymeen.exe


==================== Registro (Whitelisted) ===========================

(Se uma entrada for incluída na fixlist, o ítem no Registro será restaurado para o padrão ou removido. O arquivo não será movido.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13776088 2014-12-11] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1391472 2014-12-11] (Realtek Semiconductor)
HKLM\...\Run: [Diebold - Warsaw] => C:\Program Files\Diebold\Warsaw\core.exe [904928 2015-11-04] (GAS Tecnologia LTDA)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [807392 2016-03-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [EPSON_UD_START] => C:\Program Files (x86)\EPSON Projector\Epson USB Display V1.6\EMP_UD.exe [536168 2013-05-31] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [134368 2015-06-02] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1085656 2015-12-13] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [WizzWifiHotspot] => C:\Program Files (x86)\WizzWifiHotspot\WizzWifiHotspot.exe [2814464 2016-03-31] (Wizzlabs)
HKLM-x32\...\Run: [HomePageHelper] => c:\users\renee\appdata\roaming\homepage.exe
HKLM\...\RunOnce: [WINDOWS_SCREEN_MANAGER_UPDATER_1] => C:\Program Files\Windows Screen Manager\Windows screen manage updater.exe [16896 2016-04-01] (Wizzservices)
HKLM-x32\...\RunOnce: [Update] => C:\Users\Renee\AppData\Roaming\ASPackage\ASPackage.exe /runonce
HKLM-x32\...\RunOnce: [Wizzwifihotspot] => C:\Program Files (x86)\WizzWifiHotspot\WizzWifiHotspot.exe [2814464 2016-03-31] (Wizzlabs)
HKLM-x32\...\RunOnce: [GrpConv] => grpconv -o
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\ GbPluginBb: C:\Program Files (x86)\GbPlugin\gbieh.dll [2015-10-20] (Banco do Brasil)
HKU\S-1-5-21-3490166764-1889719786-4269277187-1000\...\Run: [WindApp] => "C:\Users\Renee\AppData\Roaming\Store\WindApp\WindApp.exe" /winstartup
HKU\S-1-5-21-3490166764-1889719786-4269277187-1000\...\Run: [Selection Tools] => C:\Users\Renee\AppData\Roaming\WTools\Selection Tools\Selection Tools.exe [4083952 2016-03-14] (Nosibay)
HKU\S-1-5-21-3490166764-1889719786-4269277187-1000\...\MountPoints2: {17f3f5a5-dfff-11e4-9a08-1867b08891a2} - F:\EMP_UDSe.exe /autorun
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2015-03-30] (Microsoft Corporation)
ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\PROGRAM FILES (X86)\GbPlugin\gbieh.dll [1945472 2015-10-20] (Banco do Brasil)
Startup: C:\Users\Renee\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitorar alertas de tinta - HP Deskjet 1000 J110 series.lnk [2016-04-01]
ShortcutTarget: Monitorar alertas de tinta - HP Deskjet 1000 J110 series.lnk -> C:\Program Files\HP\HP Deskjet 1000 J110 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

(Se um ítem for incluído na fixlist, sendo um ítem do Registro, será removido ou restaurado para o padrão.)

AutoConfigURL: [S-1-5-21-3490166764-1889719786-4269277187-1000] => hxxp://un-stop.org/wpad.dat?951a8bc08cb07bff60cadefac8b2bd408302882
Winsock: Catalog5 08 C:\ProgramData\System32\SafeGuard32.dll Nenhum Arquivo 
Winsock: Catalog5-x64 08 C:\ProgramData\System32\SafeGuard64.dll [3587000 2016-04-01] ()
Hosts: Há mais de uma entrada no Hosts. Veja a seção Hosts do Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.10.10
Tcpip\..\Interfaces\{110E537C-9C8A-482B-9F81-5F5BF3BF0868}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{7EDBDF37-1AEF-403A-A2C9-B23A760DAF6A}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{7EDBDF37-1AEF-403A-A2C9-B23A760DAF6A}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{AE1C3CB9-8B89-43CC-BE1D-E5FB6A6D85AC}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{AE1C3CB9-8B89-43CC-BE1D-E5FB6A6D85AC}: [DhcpNameServer] 192.168.10.10
Tcpip\..\Interfaces\{CA199097-7344-4811-87A2-84A391BC41DD}: [NameServer] 104.197.191.4
ManualProxies: 0hxxp://un-stop.org/wpad.dat?951a8bc08cb07bff60cadefac8b2bd408302882

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yeabests.cc/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchtudo.com/pt/?uid={304565711b5a43f79ceba83c14827999}&r=nclbr02
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.navegaki.com?q={searchTerms}&uid={304565711b5a43f79ceba83c14827999}&r=nclbr02
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.searchtudo.com/pt/?uid={304565711b5a43f79ceba83c14827999}&r=nclbr02
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.navegaki.com?q={searchTerms}&uid={304565711b5a43f79ceba83c14827999}&r=nclbr02
HKU\S-1-5-21-3490166764-1889719786-4269277187-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.navegaki.com?q={searchTerms}&uid={304565711b5a43f79ceba83c14827999}&r=nclbr02
HKU\S-1-5-21-3490166764-1889719786-4269277187-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yeabests.cc/
HKU\S-1-5-21-3490166764-1889719786-4269277187-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.searchtudo.com/pt/?uid={304565711b5a43f79ceba83c14827999}&r=nclbr02
HKU\S-1-5-21-3490166764-1889719786-4269277187-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.navegaki.com?q={searchTerms}&uid={304565711b5a43f79ceba83c14827999}&r=nclbr02
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {E921F400-D383-4B1B-9DE6-FCFCACFC1173} URL = hxxp://search.navegaki.com?q={searchTerms}&uid={304565711b5a43f79ceba83c14827999}&r=nclbr02
SearchScopes: HKLM-x32 -> {E921F400-D383-4B1B-9DE6-FCFCACFC1173} URL = hxxp://search.navegaki.com?q={searchTerms}&uid={304565711b5a43f79ceba83c14827999}&r=nclbr02
SearchScopes: HKU\S-1-5-21-3490166764-1889719786-4269277187-1000 -> DefaultScope {DA988AC4-F16E-4C43-845A-66B565AE9D21} URL = hxxps://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3490166764-1889719786-4269277187-1000 -> {279B1B94-DC2B-43D8-A7A5-C5E17D271902} URL = hxxp://www.google.com/search?hl=en&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3490166764-1889719786-4269277187-1000 -> {DA988AC4-F16E-4C43-845A-66B565AE9D21} URL = hxxps://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3490166764-1889719786-4269277187-1000 -> {E921F400-D383-4B1B-9DE6-FCFCACFC1173} URL = hxxp://search.navegaki.com?q={searchTerms}&uid={304565711b5a43f79ceba83c14827999}&r=nclbr02
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-19] (Oracle Corporation)
BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540000} -> C:\PROGRAM FILES (X86)\GBPLUGIN\gbieh.dll [2015-10-20] (Banco do Brasil)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-19] (Oracle Corporation)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.yoursearching.com/?type=sc&ts=1459557814&z=d1c74e45d539a532a7b99ccgaz8wbt1w3wdmabcg3m&from=face&uid=HGSTXHTS545050A7E380_TP8516LDGENJWEGENJWEX

FireFox:
========
FF ProfilePath: C:\Users\Renee\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1
FF Plugin: @microsoft.com/GENUINE -> disabled [Nenhum Arquivo]
FF Plugin: @microsoft.com/VirtualEarth3D,version=4.0 -> C:\Program Files (x86)\Virtual Earth 3D\ [Nenhum Arquivo]
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-07-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-07-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-19] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-19] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Nenhum Arquivo]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-01-31] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-01-31] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-02-27] (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Renee\AppData\Roaming\Mozilla\Firefox\Profiles\uQGeD5tr.default\user.js [2016-04-01]
FF user.js: detected! => C:\Users\Renee\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\user.js [2016-04-01]
FF SearchPlugin: C:\Users\Renee\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\searchplugins\DD1B66D4.xml [2016-04-01]
FF Extension: Avira Browser Safety - C:\Users\Renee\AppData\Roaming\Mozilla\Firefox\Profiles\uQGeD5tr.default\Extensions\abs@avira.com [2015-03-30] [não assinado]
FF Extension: GsearchFinder - C:\Users\Renee\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\@E9438230-A7DF-4D1F-8F2D-CA1D0F0F7924.xpi [2016-03-29]
FF Extension: Avira Browser Safety - C:\Users\Renee\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\abs@avira.com [2016-04-01] [não assinado]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.yoursearching.com/?type=hp&ts=1459557814&z=d1c74e45d539a532a7b99ccgaz8wbt1w3wdmabcg3m&from=face&uid=HGSTXHTS545050A7E380_TP8516LDGENJWEGENJWEX
CHR StartupUrls: Default -> "hxxp://www.yoursearching.com/?type=hp&ts=1459557814&z=d1c74e45d539a532a7b99ccgaz8wbt1w3wdmabcg3m&from=face&uid=HGSTXHTS545050A7E380_TP8516LDGENJWEGENJWEX"
CHR DefaultSearchURL: Default -> hxxp://yoursearching.com/web?type=ds&ts=1459557814&z=d1c74e45d539a532a7b99ccgaz8wbt1w3wdmabcg3m&from=face&uid=HGSTXHTS545050A7E380_TP8516LDGENJWEGENJWEX&q={searchTerms}
CHR DefaultSearchKeyword: Default -> yoursearching
CHR Profile: C:\Users\Renee\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Apresentações) - C:\Users\Renee\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-03-30]
CHR Extension: (Google Docs) - C:\Users\Renee\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-30]
CHR Extension: (Google Drive) - C:\Users\Renee\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]
CHR Extension: (YouTube) - C:\Users\Renee\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-26]
CHR Extension: (Google Search) - C:\Users\Renee\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-29]
CHR Extension: (Planilhas do Google) - C:\Users\Renee\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-03-30]
CHR Extension: (Documentos Google off-line) - C:\Users\Renee\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]
CHR Extension: (Pagamentos da Chrome Web Store) - C:\Users\Renee\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-01]
CHR Extension: (Gmail) - C:\Users\Renee\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-30]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.yoursearching.com/?type=sc&ts=1459557814&z=d1c74e45d539a532a7b99ccgaz8wbt1w3wdmabcg3m&from=face&uid=HGSTXHTS545050A7E380_TP8516LDGENJWEGENJWEX

==================== Serviços (Whitelisted) ========================

(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [955736 2016-03-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [466504 2016-03-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [466504 2016-03-17] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1424880 2016-03-17] (Avira Operations GmbH & Co. KG)
S2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [217280 2015-06-02] (Avira Operations GmbH & Co. KG)
R3 B34D674E-C42C-4740-9E8A-ED6ACA5CE2A0; C:\Program Files\Nognerxokjocmo\Savtanhe.exe [233824 2016-04-01] ()
R2 EMP_UDSA; C:\Program Files (x86)\EPSON Projector\Epson USB Display V1.6\EMP_UDSA.exe [157696 2013-05-31] (SEIKO EPSON CORPORATION) [Arquivo não assinado]
R2 GbpSv; C:\Program Files (x86)\GbPlugin\gbpsv.exe [593120 2015-09-22] (GAS Tecnologia)
S2 ggbugreport; C:\Program Files (x86)\SearchesToYesbnd\bugreport.exe [1609280 2016-03-29] ()
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89840 2015-03-28] (Hewlett-Packard Company)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128280 2012-07-06] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165144 2012-07-06] (Intel Corporation)
R2 JsInjector; C:\Program Files\NewExt\nssm.exe [294912 2016-04-01] () [Arquivo não assinado]
R2 Kydefodm; C:\Users\Renee\AppData\Roaming\Ujiqfaumb\Ujiqfaumb.exe [174432 2016-04-01] ()
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [Arquivo não assinado]
S2 MPCProtectService; C:\Program Files (x86)\MPC Cleaner\MPCProtectService.exe [350688 2016-04-01] (DotC United Inc)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272688 2012-08-23] ()
R2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [337776 2014-04-30] (arvato digital services llc)
R2 SkypeUpdateEx; C:\Program Files (x86)\SkypeUpdateEx\SkypeUpdateEx.exe [167352 2016-03-21] (skype.cog.cc)
R2 TheCalendarService; C:\Program Files (x86)\CalendarTool\2.0.0.11189\CalendarServ.exe [141960 2015-12-25] ()
R3 UcooRudvup; C:\Program Files\Nognerxokjocmo\UcooRudvup.exe [426848 2016-04-01] ()
R2 Update service; C:\Program Files (x86)\Popcorn Time\Updater.exe [339968 2015-10-19] (Popcorn Time) [Arquivo não assinado]
R2 Warsaw Technology; C:\Program Files\Diebold\Warsaw\core.exe [904928 2015-11-04] (GAS Tecnologia LTDA)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3342640 2012-08-23] (Intel® Corporation)
S2 Wuvsunl; "C:\Users\Renee\AppData\Roaming\HhwaGekse\Jeamup.exe" -cms [X]

===================== Drivers (Whitelisted) ==========================

(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [154816 2016-03-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [133168 2016-03-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2015-03-17] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [69888 2016-03-17] (Avira Operations GmbH & Co. KG)
R1 bsdriver; C:\Windows\system32\drivers\bsdriver.sys [34720 2016-04-01] ()
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 EMP_MIRRUD; C:\Windows\System32\DRIVERS\EMP_MirrUD.sys [5632 2013-05-31] (Windows (R) Codename Longhorn DDK provider)
R3 eppvad_simple; C:\Windows\System32\drivers\EMP_UDAU.sys [23040 2013-05-31] (SEIKO EPSON CORPORATION)
R1 gbpddfac; C:\Windows\System32\drivers\gbpddfac64.sys [28888 2016-04-01] (GAS Tecnologia)
R3 GBPRCM; C:\Program Files (x86)\GbPlugin\gbprcm64.sys [29912 2015-08-26] (GAS Tecnologia)
R1 MPCKpt; C:\Windows\System32\DRIVERS\MPCKpt.sys [60136 2016-04-01] (DotC United Inc)
R3 Warsaw_PP; C:\Program Files (x86)\GbPlugin\wsftprp64.sys [24792 2015-04-29] (GAS Tecnologia LTDA)
R4 WinDivert1.1; C:\Program Files\Diebold\Warsaw\WinDivert64.sys [38104 2015-07-07] (Basil)
R1 wsddfac; C:\Windows\System32\drivers\wsddfac.sys [101080 2016-04-01] (GAS Tecnologia)
R1 wsddpp; C:\Windows\system32\drivers\wsddpp.sys [103640 2015-03-18] (GAS Tecnologia)
S0 gbpddreg; system32\drivers\gbpddreg64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)


==================== Um Mês Criados arquivos e pastas ========

(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)

2016-04-01 22:13 - 2016-04-01 22:13 - 00022731 _____ C:\Users\Renee\Downloads\FRST.txt
2016-04-01 22:06 - 2016-04-01 22:09 - 00041629 _____ C:\Users\Renee\Desktop\FRST.txt
2016-04-01 22:06 - 2016-04-01 22:09 - 00031950 _____ C:\Users\Renee\Desktop\Addition.txt
2016-04-01 21:57 - 2016-04-01 22:13 - 00000000 ____D C:\FRST
2016-04-01 21:56 - 2016-04-01 21:56 - 02374144 _____ (Farbar) C:\Users\Renee\Downloads\FRST64 (1).exe
2016-04-01 21:55 - 2016-04-01 21:55 - 02374144 _____ (Farbar) C:\Users\Renee\Downloads\FRST64.exe
2016-04-01 21:45 - 2016-04-01 22:03 - 00000000 ____D C:\Users\Renee\AppData\Local\app
2016-04-01 21:44 - 2016-04-01 21:43 - 00060136 _____ (DotC United Inc) C:\Windows\system32\Drivers\MPCKpt.sys
2016-04-01 21:43 - 2016-04-01 22:03 - 00000000 ____D C:\Program Files (x86)\CleanBrowser
2016-04-01 21:43 - 2016-04-01 21:43 - 00000000 ____D C:\Users\Renee\AppData\Roaming\yoursearching
2016-04-01 21:43 - 2016-04-01 21:43 - 00000000 ____D C:\Users\Renee\AppData\Roaming\Neanmuj
2016-04-01 21:43 - 2016-04-01 21:43 - 00000000 ____D C:\Users\Renee\AppData\Roaming\BipxQacsaf
2016-04-01 21:43 - 2016-04-01 21:43 - 00000000 ____D C:\Program Files\Nunrofmiu
2016-04-01 21:43 - 2016-04-01 21:43 - 00000000 ____D C:\Program Files (x86)\MPC Cleaner
2016-04-01 21:38 - 2016-04-01 21:51 - 00000000 ____D C:\Users\Todos os Usuários\System32
2016-04-01 21:38 - 2016-04-01 21:51 - 00000000 ____D C:\ProgramData\System32
2016-04-01 21:38 - 2016-04-01 21:39 - 00001001 _____ C:\Windows\SysWOW64\${LOGFILE}
2016-04-01 21:38 - 2016-04-01 21:38 - 00000000 ____D C:\Program Files (x86)\SkypeUpdateEx
2016-04-01 21:36 - 2016-04-01 21:36 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-04-01 21:36 - 2016-04-01 21:36 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-04-01 21:36 - 2016-04-01 21:36 - 00003840 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-04-01 21:36 - 2016-04-01 21:36 - 00000902 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-04-01 21:36 - 2016-04-01 21:36 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2016-04-01 21:35 - 2016-04-01 21:35 - 00000000 ____D C:\Windows\system32\Macromed
2016-04-01 21:34 - 2016-04-01 21:34 - 00003744 _____ C:\Windows\System32\Tasks\Selection Tools Update
2016-04-01 21:34 - 2016-04-01 21:34 - 00000000 ____D C:\Program Files (x86)\SrpnFiles
2016-04-01 21:34 - 2016-04-01 21:34 - 00000000 ____D C:\Program Files (x86)\CalendarTool
2016-04-01 21:33 - 2016-04-01 21:33 - 00000000 ____D C:\Users\Renee\AppData\Roaming\WTools
2016-04-01 21:32 - 2016-04-01 21:32 - 00022168 _____ C:\Windows\System32\Tasks\DNSWILLISTON
2016-04-01 21:32 - 2016-04-01 21:32 - 00002914 _____ C:\Windows\System32\Tasks\osTip
2016-04-01 21:31 - 2016-04-01 21:31 - 00003018 _____ C:\Windows\System32\Tasks\ttwifi
2016-04-01 21:31 - 2016-04-01 21:31 - 00000000 ____D C:\Users\Public\Documents\Tools
2016-04-01 21:31 - 2016-04-01 21:28 - 00001006 _____ C:\Windows\system32\Drivers\etc\hp.bak
2016-04-01 21:30 - 2016-04-01 21:57 - 00000000 ____D C:\Users\Renee\AppData\Roaming\XBox
2016-04-01 21:30 - 2016-04-01 21:57 - 00000000 ____D C:\Program Files (x86)\58965E7A-1459557029-1CE5-BD7D-6D76CC9D87B5
2016-04-01 21:30 - 2016-04-01 21:34 - 00000000 ____D C:\Users\Renee\AppData\Roaming\CalendarTool
2016-04-01 21:30 - 2016-04-01 21:30 - 00848437 _____ C:\Users\Renee\AppData\Roaming\Kan-Tax.bin
2016-04-01 21:30 - 2016-04-01 21:30 - 00126464 _____ C:\Users\Renee\AppData\Roaming\lobby.dat
2016-04-01 21:30 - 2016-04-01 21:30 - 00072699 _____ C:\Users\Renee\AppData\Roaming\Dento-It.tst
2016-04-01 21:30 - 2016-04-01 21:30 - 00054272 _____ C:\Users\Renee\AppData\Roaming\ApplicationHosting.dat
2016-04-01 21:30 - 2016-04-01 21:30 - 00003710 _____ C:\Windows\System32\Tasks\WindApp Update
2016-04-01 21:30 - 2016-04-01 21:30 - 00002880 _____ C:\Users\Renee\AppData\Roaming\md.xml
2016-04-01 21:30 - 2016-04-01 21:30 - 00000000 ____D C:\Users\Public\Documents\Guid
2016-04-01 21:30 - 2016-04-01 21:30 - 00000000 ____D C:\Users\Public\Documents\Baidu
2016-04-01 21:29 - 2016-04-01 21:57 - 00000000 ____D C:\Users\Todos os Usuários\WindowsMsg
2016-04-01 21:29 - 2016-04-01 21:57 - 00000000 ____D C:\ProgramData\WindowsMsg
2016-04-01 21:29 - 2016-04-01 21:57 - 00000000 ____D C:\Program Files (x86)\ttwifi
2016-04-01 21:29 - 2016-04-01 21:57 - 00000000 ____D C:\Program Files (x86)\sunnyday
2016-04-01 21:29 - 2016-04-01 21:57 - 00000000 ____D C:\Program Files (x86)\KokoMoss
2016-04-01 21:29 - 2016-04-01 21:57 - 00000000 ____D C:\Program Files (x86)\Hostify
2016-04-01 21:29 - 2016-04-01 21:57 - 00000000 ____D C:\Program Files (x86)\comoBoss
2016-04-01 21:29 - 2016-04-01 21:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ttwifi
2016-04-01 21:29 - 2016-04-01 21:31 - 00204706 _____ C:\Users\Renee\AppData\Roaming\inst.lat
2016-04-01 21:29 - 2016-04-01 21:31 - 00011568 _____ C:\Users\Renee\AppData\Roaming\InstallationConfiguration.xml
2016-04-01 21:29 - 2016-04-01 21:31 - 00000000 ____D C:\Program Files (x86)\Navegaki
2016-04-01 21:29 - 2016-04-01 21:30 - 00000000 ____D C:\Program Files\NewExt
2016-04-01 21:29 - 2016-04-01 21:29 - 00127488 _____ C:\Users\Renee\AppData\Roaming\Installer.dat
2016-04-01 21:29 - 2016-04-01 21:29 - 00003026 _____ C:\Windows\System32\Tasks\MAXDriverUpdater_UPDATES
2016-04-01 21:29 - 2016-04-01 21:29 - 00002958 _____ C:\Windows\System32\Tasks\svchost
2016-04-01 21:29 - 2016-04-01 21:29 - 00001095 _____ C:\Users\Renee\Desktop\WizzWifiHotspot.lnk
2016-04-01 21:29 - 2016-04-01 21:29 - 00001015 _____ C:\Users\Public\Desktop\ttwifi.lnk
2016-04-01 21:29 - 2016-04-01 21:29 - 00000995 _____ C:\Users\Renee\Desktop\Hostify.lnk
2016-04-01 21:29 - 2016-04-01 21:29 - 00000284 _____ C:\Windows\Tasks\MAXDriverUpdater_UPDATES.job
2016-04-01 21:29 - 2016-04-01 21:29 - 00000034 ___SH C:\Users\Public\Documents\{DE764086-1C0A-4DD3-90BA-0B93BDD794BE}
2016-04-01 21:29 - 2016-04-01 21:29 - 00000000 ____D C:\Users\Renee\AppData\Roaming\Store
2016-04-01 21:29 - 2016-04-01 21:29 - 00000000 ____D C:\Users\Renee\AppData\Local\tuto_monetize_220160330
2016-04-01 21:29 - 2016-04-01 21:29 - 00000000 ____D C:\Users\Renee\AppData\Local\tuto_monetize_120160330
2016-04-01 21:29 - 2016-04-01 21:29 - 00000000 ____D C:\Users\Renee\AppData\Local\csdi_monetize_220160330
2016-04-01 21:29 - 2016-04-01 21:29 - 00000000 ____D C:\Program Files\Windows Screen Manager
2016-04-01 21:29 - 2016-04-01 21:29 - 00000000 ____D C:\Program Files (x86)\WizzWifiHotspot
2016-04-01 21:28 - 2016-04-01 21:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DESKTOPPLAY
2016-04-01 21:28 - 2016-04-01 21:48 - 00000000 ____D C:\Program Files (x86)\dply_en_015020285
2016-04-01 21:28 - 2016-04-01 21:28 - 00023152 _____ C:\Windows\System32\Tasks\{0F7D0D47-787D-0A7F-0C11-78097A78117D}
2016-04-01 21:28 - 2016-04-01 21:28 - 00003340 _____ C:\Windows\System32\Tasks\Mecob
2016-04-01 21:28 - 2016-04-01 21:28 - 00003150 _____ C:\Windows\System32\Tasks\MAXDriverUpdaterRunAtStartup
2016-04-01 21:28 - 2016-04-01 21:28 - 00000000 ____D C:\Users\Renee\AppData\Local\dply_en_015020285
2016-04-01 21:27 - 2016-04-01 22:00 - 00000000 ____D C:\Users\Renee\AppData\Local\3810282D-6C19-47B0-8283-5C6C29A7E108
2016-04-01 21:27 - 2016-04-01 21:57 - 00000000 ____D C:\Users\Renee\AppData\Roaming\HhwaGekse
2016-04-01 21:27 - 2016-04-01 21:57 - 00000000 ____D C:\Program Files\Nognerxokjocmo
2016-04-01 21:27 - 2016-04-01 21:57 - 00000000 ____D C:\Program Files (x86)\Max Driver Updater
2016-04-01 21:27 - 2016-04-01 21:43 - 00000000 ____D C:\Users\Renee\AppData\Local\Tempfolder
2016-04-01 21:27 - 2016-04-01 21:28 - 00000000 ____D C:\Program Files (x86)\SearchesToYesbnd
2016-04-01 21:27 - 2016-04-01 21:27 - 00034720 _____ () C:\Windows\system32\Drivers\bsdriver.sys
2016-04-01 21:27 - 2016-04-01 21:27 - 00000000 ____D C:\Users\Todos os Usuários\6c2e2a87-6295-1
2016-04-01 21:27 - 2016-04-01 21:27 - 00000000 ____D C:\Users\Todos os Usuários\6c2e2a87-45b7-0
2016-04-01 21:27 - 2016-04-01 21:27 - 00000000 ____D C:\Users\Renee\AppData\Roaming\Ujiqfaumb
2016-04-01 21:27 - 2016-04-01 21:27 - 00000000 ____D C:\Users\Renee\AppData\Roaming\csdimedia
2016-04-01 21:27 - 2016-04-01 21:27 - 00000000 ____D C:\Users\Renee\AppData\LocalLow\Company
2016-04-01 21:27 - 2016-04-01 21:27 - 00000000 ____D C:\Users\Renee\AppData\LocalLow\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}
2016-04-01 21:27 - 2016-04-01 21:27 - 00000000 ____D C:\Users\Renee\AppData\Local\csdi_monetize_120160330
2016-04-01 21:27 - 2016-04-01 21:27 - 00000000 ____D C:\Users\Public\Documents\dmp
2016-04-01 21:27 - 2016-04-01 21:27 - 00000000 ____D C:\uninst
2016-04-01 21:27 - 2016-04-01 21:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Max Driver Updater
2016-04-01 21:27 - 2016-04-01 21:27 - 00000000 ____D C:\ProgramData\6c2e2a87-6295-1
2016-04-01 21:27 - 2016-04-01 21:27 - 00000000 ____D C:\ProgramData\6c2e2a87-45b7-0
2016-04-01 21:27 - 2016-04-01 21:27 - 00000000 ____D C:\Program Files (x86)\WinTaske
2016-04-01 21:27 - 2016-04-01 21:27 - 00000000 ____D C:\Program Files (x86)\Winsere
2016-04-01 21:18 - 2016-04-01 21:18 - 01451159 _____ C:\Users\Renee\Downloads\WLoader21_para todas as versões Windows 7.rar
2016-04-01 20:55 - 2016-04-01 21:27 - 00082752 _____ (Cherimoya Ltd) C:\Windows\system32\Drivers\cherimoya.sys
2016-04-01 20:31 - 2016-04-01 20:31 - 00000000 ____D C:\Windows\XSxS
2016-04-01 20:31 - 2016-04-01 20:31 - 00000000 ____D C:\Program Files (x86)\Xenocode
2016-04-01 20:30 - 2016-04-01 20:30 - 00000000 ____D C:\Users\Renee\AppData\Local\Xenocode
2016-04-01 20:30 - 2010-03-02 00:23 - 219384547 _____ (Blog do Birungueta) C:\Users\Renee\Desktop\Portable CorelDRAW X5.exe
2016-04-01 20:20 - 2016-04-01 20:20 - 00026488 _____ C:\Users\Renee\Downloads\Backup_of_planta f (2).cdr
2016-04-01 20:19 - 2016-04-01 20:19 - 03654770 _____ C:\Users\Renee\Downloads\panfleto.cdr
2016-04-01 20:19 - 2016-04-01 20:19 - 00928438 _____ C:\Users\Renee\Downloads\image.jpeg
2016-04-01 20:19 - 2016-04-01 20:19 - 00587092 _____ C:\Users\Renee\Downloads\Sem título-1.cdr
2016-04-01 20:18 - 2016-04-01 20:18 - 00424841 _____ C:\Users\Renee\Downloads\VII expotur.cdr
2016-04-01 20:16 - 2016-04-01 20:18 - 219384850 _____ C:\Users\Renee\Downloads\CDX5Portable.rar
2016-03-24 16:21 - 2016-03-24 16:21 - 00113538 _____ C:\Users\Renee\Documents\DECLARACAO DE ESTAGIO.pdf
2016-03-24 15:00 - 2016-03-24 15:00 - 00113538 _____ C:\Users\Renee\Downloads\DECLARACAO DE ESTAGIO.pdf
2016-03-24 15:00 - 2016-03-24 15:00 - 00113538 _____ C:\Users\Renee\Desktop\DECLARACAO DE ESTAGIO PDF.pdf
2016-03-21 09:37 - 2016-03-21 09:37 - 00370443 _____ C:\Users\Renee\Documents\louvor Ibbne fortaleza 1.pptx
2016-03-15 11:13 - 2016-03-15 11:13 - 00018364 _____ C:\Users\Renee\Downloads\MARCUS022016.pdf
2016-03-13 18:34 - 2016-03-13 18:34 - 00114521 _____ C:\Users\Renee\Desktop\IBBNE - 13.03.2016.pptx
2016-03-06 16:56 - 2015-10-18 19:12 - 00312142 _____ C:\Users\Renee\Desktop\VIM PARA ADORAR-TE.pptx
2016-03-06 16:55 - 2015-11-15 19:37 - 00317297 _____ C:\Users\Renee\Desktop\PODER PRA SALVAR.pptx
2016-03-06 16:54 - 2015-11-21 18:41 - 00315707 _____ C:\Users\Renee\Desktop\NADA ALÉM DO SANGUE.pptx
2016-03-06 16:54 - 2015-10-25 19:11 - 00302510 _____ C:\Users\Renee\Desktop\FOI ASSIM.pptx
2016-03-06 16:54 - 2015-09-27 17:24 - 00310153 _____ C:\Users\Renee\Desktop\GLÓRIA PRA SEMPRE.pptx
2016-03-06 16:52 - 2016-01-30 19:35 - 00293951 _____ C:\Users\Renee\Desktop\CELEBRAI COM JUBILIO.pptx

==================== Um Mês Modificados arquivos e pastas ========

(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)

2016-04-01 22:13 - 2015-08-30 18:18 - 00028888 _____ (GAS Tecnologia) C:\Windows\system32\Drivers\gbpddfac64.sys
2016-04-01 21:37 - 2015-03-30 22:37 - 00001066 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-04-01 21:35 - 2009-07-14 14:55 - 00705268 _____ C:\Windows\system32\prfh0416.dat
2016-04-01 21:35 - 2009-07-14 14:55 - 00147108 _____ C:\Windows\system32\prfc0416.dat
2016-04-01 21:35 - 2009-07-14 02:13 - 01633534 _____ C:\Windows\system32\PerfStringBackup.INI
2016-04-01 21:35 - 2009-07-14 00:20 - 00000000 ____D C:\Windows\inf
2016-04-01 21:30 - 2015-03-29 21:14 - 00001551 _____ C:\Users\Renee\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-04-01 21:29 - 2015-03-30 18:55 - 00000000 ____D C:\Users\Todos os Usuários\Intel
2016-04-01 21:29 - 2015-03-30 18:55 - 00000000 ____D C:\ProgramData\Intel
2016-04-01 21:27 - 2015-03-30 22:41 - 00002119 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-04-01 21:20 - 2015-07-31 16:30 - 00000000 ____D C:\Users\Todos os Usuários\CorelDRAW Graphics Suite X7 x64
2016-04-01 21:20 - 2015-07-31 16:30 - 00000000 ____D C:\ProgramData\CorelDRAW Graphics Suite X7 x64
2016-04-01 20:30 - 2015-03-29 21:14 - 00000000 ____D C:\Users\Renee\AppData\Local\VirtualStore
2016-04-01 20:24 - 2015-07-31 10:23 - 00000000 ____D C:\Users\Todos os Usuários\GbPlugin
2016-04-01 20:24 - 2015-07-31 10:23 - 00000000 ____D C:\ProgramData\GbPlugin
2016-04-01 20:21 - 2009-07-14 01:45 - 00017168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-04-01 20:21 - 2009-07-14 01:45 - 00017168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-04-01 20:14 - 2015-07-31 10:23 - 00000000 ____D C:\Program Files (x86)\GbPlugin
2016-04-01 20:13 - 2015-11-18 23:06 - 00101080 _____ (GAS Tecnologia) C:\Windows\system32\Drivers\wsddfac.sys
2016-04-01 20:13 - 2015-03-30 22:37 - 00001062 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-04-01 20:13 - 2009-07-14 02:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-03-31 13:47 - 2009-07-14 00:20 - 00000000 ____D C:\Windows\system32\NDF
2016-03-21 09:38 - 2016-01-24 18:46 - 00000000 ____D C:\Users\Renee\Downloads\Nova pasta
2016-03-17 11:05 - 2015-03-30 22:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2016-03-17 11:03 - 2015-03-30 23:00 - 00154816 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2016-03-17 11:03 - 2015-03-30 23:00 - 00133168 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2016-03-17 11:03 - 2015-03-30 23:00 - 00069888 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2016-03-14 19:15 - 2009-07-14 02:08 - 00032586 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-03-13 01:00 - 2016-02-11 08:18 - 00000000 ____D C:\Users\Renee\AppData\Local\ElevatedDiagnostics

==================== Arquivos na raiz de alguns diretórios =======

2016-04-01 21:30 - 2016-04-01 21:30 - 0054272 _____ () C:\Users\Renee\AppData\Roaming\ApplicationHosting.dat
2016-04-01 21:26 - 2016-04-01 21:34 - 0001257 _____ () C:\Users\Renee\AppData\Roaming\Bubble Dock.boostrap.log
2016-04-01 21:27 - 2016-04-01 21:29 - 0005711 _____ () C:\Users\Renee\AppData\Roaming\Bubble Dock.installation.log
2016-04-01 21:30 - 2016-04-01 21:30 - 0072699 _____ () C:\Users\Renee\AppData\Roaming\Dento-It.tst
2016-04-01 21:29 - 2016-04-01 21:31 - 0204706 _____ () C:\Users\Renee\AppData\Roaming\inst.lat
2016-04-01 21:29 - 2016-04-01 21:31 - 0011568 _____ () C:\Users\Renee\AppData\Roaming\InstallationConfiguration.xml
2016-04-01 21:29 - 2016-04-01 21:29 - 0127488 _____ () C:\Users\Renee\AppData\Roaming\Installer.dat
2016-04-01 21:30 - 2016-04-01 21:30 - 0848437 _____ () C:\Users\Renee\AppData\Roaming\Kan-Tax.bin
2016-04-01 21:30 - 2016-04-01 21:30 - 0126464 _____ () C:\Users\Renee\AppData\Roaming\lobby.dat
2016-04-01 21:30 - 2016-04-01 21:30 - 0002880 _____ () C:\Users\Renee\AppData\Roaming\md.xml
2016-04-01 21:32 - 2016-04-01 21:33 - 0000078 _____ () C:\Users\Renee\AppData\Roaming\Selection Tools.installation.log
2016-04-01 21:27 - 2016-04-01 21:27 - 0000097 _____ () C:\Users\Renee\AppData\Roaming\WindApp.boostrap.log
2016-04-01 21:29 - 2016-04-01 21:29 - 0000078 _____ () C:\Users\Renee\AppData\Roaming\WindApp.installation.log
2015-10-18 18:25 - 2015-10-25 18:33 - 0003584 _____ () C:\Users\Renee\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-05-12 12:13 - 2015-05-12 12:13 - 0000057 _____ () C:\ProgramData\Ament.ini
2015-03-31 19:37 - 2015-03-31 19:37 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Alguns arquivos em TEMP:
====================
C:\Users\Renee\AppData\Local\Temp\0VA8P06ZSO.exe
C:\Users\Renee\AppData\Local\Temp\106NPO2A5B.exe
C:\Users\Renee\AppData\Local\Temp\1voXQxJaTW.exe
C:\Users\Renee\AppData\Local\Temp\6H3BXLLWGF.exe
C:\Users\Renee\AppData\Local\Temp\8V8FLOS9CQ.exe
C:\Users\Renee\AppData\Local\Temp\8yW0NqrOXZ.exe
C:\Users\Renee\AppData\Local\Temp\avgnt.exe
C:\Users\Renee\AppData\Local\Temp\BZGb7DU7wE.exe
C:\Users\Renee\AppData\Local\Temp\E321DGi71f.exe
C:\Users\Renee\AppData\Local\Temp\ELVdCsZS8w.exe
C:\Users\Renee\AppData\Local\Temp\FoxitUpdater.exe
C:\Users\Renee\AppData\Local\Temp\jre-8u45-windows-au.exe
C:\Users\Renee\AppData\Local\Temp\PASHX9NOMK.exe
C:\Users\Renee\AppData\Local\Temp\Q9M04DX6SN.exe
C:\Users\Renee\AppData\Local\Temp\qOEFnYqfK4.exe
C:\Users\Renee\AppData\Local\Temp\SGUUVB46FB.exe
C:\Users\Renee\AppData\Local\Temp\tmp2A8A.tmp.exe
C:\Users\Renee\AppData\Local\Temp\update.exe
C:\Users\Renee\AppData\Local\Temp\wsXbFVlapk.exe


==================== Bamital & volsnap =================

(Não há correção automática para arquivos que não passaram na verificação.)

C:\Windows\system32\winlogon.exe => O arquivo é assinado digitalmente
C:\Windows\system32\wininit.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\wininit.exe => O arquivo é assinado digitalmente
C:\Windows\explorer.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\explorer.exe => O arquivo é assinado digitalmente
C:\Windows\system32\svchost.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\svchost.exe => O arquivo é assinado digitalmente
C:\Windows\system32\services.exe => O arquivo é assinado digitalmente
C:\Windows\system32\User32.dll => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\User32.dll => O arquivo é assinado digitalmente
C:\Windows\system32\userinit.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\userinit.exe => O arquivo é assinado digitalmente
C:\Windows\system32\rpcss.dll => O arquivo é assinado digitalmente
C:\Windows\system32\dnsapi.dll => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\dnsapi.dll => O arquivo é assinado digitalmente
C:\Windows\system32\Drivers\volsnap.sys => O arquivo é assinado digitalmente


LastRegBack: 2016-03-29 00:56

==================== Fim de FRST.txt ============================