ÿþOTL logfile created on: 25/07/2015 03:24:25 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = F:\downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17914)
Locale: 00000416 | Country: Brasil | Language: PTB | Date Format: dd/MM/yyyy

7,92 Gb Total Physical Memory | 3,33 Gb Available Physical Memory | 42,10% Memory free
8,41 Gb Paging File | 3,35 Gb Available in Paging File | 39,80% Paging File free
Paging file location(s): c:\pagefile.sys 512 1024 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 58,59 Gb Total Space | 6,75 Gb Free Space | 11,52% Space Free | Partition Type: NTFS
Drive F: | 630,18 Gb Total Space | 391,63 Gb Free Space | 62,15% Space Free | Partition Type: NTFS

Computer Name: EDUARDO-WIN | User Name: eduardo | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2015/07/25 03:22:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- F:\downloads\OTL.exe
PRC - [2015/07/15 00:30:15 | 003,423,920 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_209.exe
PRC - [2015/07/14 19:43:40 | 000,866,424 | ---- | M] (Opera Software) -- C:\Program Files (x86)\Opera\30.0.1835.125\opera.exe
PRC - [2015/07/14 16:52:10 | 000,597,504 | ---- | M] (QuestSoft) -- F:\downloads\QTranslate.5.5.0.2\QTranslate.exe
PRC - [2015/07/07 06:58:56 | 003,907,152 | ---- | M] (Tonec Inc.) -- C:\Program Files (x86)\Internet Download Manager\IDMan.exe
PRC - [2015/07/04 16:43:32 | 000,377,000 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2015/06/30 08:58:40 | 001,030,904 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
PRC - [2015/06/18 21:13:12 | 000,448,304 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2015/06/18 21:11:50 | 000,996,600 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
PRC - [2015/06/18 21:11:30 | 000,448,304 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2015/06/18 21:11:28 | 000,705,840 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2015/06/18 21:11:27 | 001,044,728 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
PRC - [2015/06/18 21:11:20 | 000,705,992 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
PRC - [2015/03/26 15:44:20 | 020,337,664 | ---- | M] (XBMC-Foundation) -- F:\Program Files\app\Kodi\Kodi.exe
PRC - [2014/11/23 14:34:42 | 000,060,176 | ---- | M] (The Pidgin developer community) -- C:\Program Files (x86)\Pidgin\pidgin.exe
PRC - [2014/10/08 18:18:56 | 000,211,104 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2014/10/08 18:18:50 | 000,534,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2014/08/16 17:36:00 | 002,682,880 | ---- | M] (Lingoes Project) -- F:\Program Files\app\lingoes_portable_2.9.1\Lingoes.exe
PRC - [2014/06/12 18:23:08 | 000,359,128 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnetdhcp.exe
PRC - [2014/06/12 18:22:40 | 000,437,976 | ---- | M] (VMware, Inc.) -- C:\Windows\SysWOW64\vmnat.exe
PRC - [2014/06/12 17:44:08 | 014,407,384 | ---- | M] () -- F:\Program Files\vmware-hostd.exe
PRC - [2014/06/12 17:22:10 | 000,086,744 | ---- | M] (VMware, Inc.) -- F:\Program Files\vmware-authd.exe
PRC - [2013/12/24 16:35:31 | 020,870,904 | ---- | M] () -- C:\Arquivos de Programas\Transmission\transmission-qt.exe
PRC - [2013/12/24 16:35:27 | 001,016,848 | ---- | M] () -- C:\Arquivos de Programas\Transmission\dbus-daemon.exe
PRC - [2013/11/22 08:50:14 | 000,449,592 | ---- | M] (GAS Tecnologia) -- C:\PROGRA~2\GbPlugin\GbpSv.exe
PRC - [2012/04/24 14:37:56 | 000,169,752 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
PRC - [2010/10/05 11:08:46 | 002,655,768 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2010/10/05 11:08:42 | 000,325,656 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2005/05/17 11:51:42 | 000,229,376 | ---- | M] (Acapela Group) -- c:\program files (x86)\nextup-acapela\bin\acatel_srv.exe


[color=#E56717]========== Modules (No Company Name) ==========[/color]

MOD - [2015/07/15 00:30:15 | 017,448,624 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll
MOD - [2015/07/14 19:43:32 | 001,649,272 | ---- | M] () -- C:\Program Files (x86)\Opera\30.0.1835.125\libglesv2.dll
MOD - [2015/07/14 19:43:32 | 000,081,016 | ---- | M] () -- C:\Program Files (x86)\Opera\30.0.1835.125\libegl.dll
MOD - [2015/07/10 15:00:52 | 000,726,340 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\libfacebook.dll
MOD - [2015/07/10 14:59:50 | 000,574,322 | ---- | M] () -- C:\Program Files (x86)\Pidgin\libjson-glib-1.0.dll
MOD - [2015/03/26 15:44:50 | 000,066,048 | ---- | M] () -- F:\Program Files\app\Kodi\system\cpluff.dll
MOD - [2015/03/13 18:33:50 | 000,258,962 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\libskype.dll
MOD - [2014/12/05 14:04:34 | 000,374,169 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\libmsn.dll
MOD - [2014/12/05 13:38:34 | 000,560,054 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\libmsnxmpp.dll
MOD - [2014/11/23 14:34:36 | 000,171,123 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\libsilc.dll
MOD - [2014/11/23 14:34:36 | 000,123,540 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\libnovell.dll
MOD - [2014/11/23 14:34:36 | 000,116,071 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\libsametime.dll
MOD - [2014/11/23 14:34:36 | 000,069,625 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\spellchk.dll
MOD - [2014/11/23 14:34:36 | 000,055,880 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\libsimple.dll
MOD - [2014/11/23 14:34:36 | 000,047,934 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\log_reader.dll
MOD - [2014/11/23 14:34:36 | 000,044,494 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\xmppdisco.dll
MOD - [2014/11/23 14:34:36 | 000,037,191 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\xmppconsole.dll
MOD - [2014/11/23 14:34:36 | 000,032,020 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\ticker.dll
MOD - [2014/11/23 14:34:36 | 000,031,993 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\ssl-nss.dll
MOD - [2014/11/23 14:34:36 | 000,030,771 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\winprefs.dll
MOD - [2014/11/23 14:34:36 | 000,030,353 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\themeedit.dll
MOD - [2014/11/23 14:34:36 | 000,029,791 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\win2ktrans.dll
MOD - [2014/11/23 14:34:36 | 000,029,256 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\pidginrc.dll
MOD - [2014/11/23 14:34:36 | 000,029,225 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\notify.dll
MOD - [2014/11/23 14:34:36 | 000,023,851 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\timestamp_format.dll
MOD - [2014/11/23 14:34:36 | 000,022,832 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\libyahoo.dll
MOD - [2014/11/23 14:34:36 | 000,021,795 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\markerline.dll
MOD - [2014/11/23 14:34:36 | 000,021,337 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\libxmpp.dll
MOD - [2014/11/23 14:34:36 | 000,019,793 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\libyahoojp.dll
MOD - [2014/11/23 14:34:36 | 000,018,399 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\timestamp.dll
MOD - [2014/11/23 14:34:36 | 000,017,023 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\offlinemsg.dll
MOD - [2014/11/23 14:34:36 | 000,015,978 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\statenotify.dll
MOD - [2014/11/23 14:34:36 | 000,015,429 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\relnot.dll
MOD - [2014/11/23 14:34:36 | 000,015,380 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\psychic.dll
MOD - [2014/11/23 14:34:36 | 000,015,045 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\sendbutton.dll
MOD - [2014/11/23 14:34:36 | 000,013,456 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\newline.dll
MOD - [2014/11/23 14:34:36 | 000,012,004 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\ssl.dll
MOD - [2014/11/23 14:34:34 | 000,417,758 | ---- | M] () -- C:\Program Files (x86)\Pidgin\libjabber.dll
MOD - [2014/11/23 14:34:34 | 000,328,186 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\libgg.dll
MOD - [2014/11/23 14:34:34 | 000,311,021 | ---- | M] () -- C:\Program Files (x86)\Pidgin\liboscar.dll
MOD - [2014/11/23 14:34:34 | 000,236,666 | ---- | M] () -- C:\Program Files (x86)\Pidgin\libymsg.dll
MOD - [2014/11/23 14:34:34 | 000,150,598 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\libmxit.dll
MOD - [2014/11/23 14:34:34 | 000,107,365 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\libirc.dll
MOD - [2014/11/23 14:34:34 | 000,106,671 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\libmyspace.dll
MOD - [2014/11/23 14:34:34 | 000,092,398 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\libbonjour.dll
MOD - [2014/11/23 14:34:34 | 000,024,924 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\convcolors.dll
MOD - [2014/11/23 14:34:34 | 000,021,075 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\.dll
MOD - [2014/11/23 14:34:34 | 000,020,997 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\autoaccept.dll
MOD - [2014/11/23 14:34:34 | 000,019,043 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\idle.dll
MOD - [2014/11/23 14:34:34 | 000,018,882 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\history.dll
MOD - [2014/11/23 14:34:34 | 000,018,555 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\joinpart.dll
MOD - [2014/11/23 14:34:34 | 000,016,005 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\libicq.dll
MOD - [2014/11/23 14:34:34 | 000,015,702 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\extplacement.dll
MOD - [2014/11/23 14:34:34 | 000,015,074 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\libaim.dll
MOD - [2014/11/23 14:34:34 | 000,014,147 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\gtkbuddynote.dll
MOD - [2014/11/23 14:34:34 | 000,013,253 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\buddynote.dll
MOD - [2014/11/23 14:34:34 | 000,012,865 | ---- | M] () -- C:\Program Files (x86)\Pidgin\plugins\iconaway.dll
MOD - [2014/11/23 14:34:28 | 000,671,031 | ---- | M] () -- C:\Program Files (x86)\Pidgin\exchndl.dll
MOD - [2014/11/23 14:34:28 | 000,475,580 | ---- | M] () -- C:\Program Files (x86)\Pidgin\spellcheck\libgtkspell-0.dll
MOD - [2014/11/23 14:34:28 | 000,036,878 | ---- | M] () -- C:\Program Files (x86)\Pidgin\libssp-0.dll
MOD - [2014/11/23 14:34:04 | 000,486,400 | ---- | M] () -- C:\Program Files (x86)\Pidgin\sqlite3.dll
MOD - [2014/11/23 14:34:00 | 002,097,721 | ---- | M] () -- C:\Program Files (x86)\Pidgin\libsilc-1-1-2.dll
MOD - [2014/11/23 14:34:00 | 000,818,985 | ---- | M] () -- C:\Program Files (x86)\Pidgin\libsilcclient-1-1-3.dll
MOD - [2014/11/23 14:34:00 | 000,152,852 | ---- | M] () -- C:\Program Files (x86)\Pidgin\libmeanwhile-1.dll
MOD - [2014/11/23 14:33:56 | 001,274,655 | ---- | M] () -- C:\Program Files (x86)\Pidgin\libxml2-2.dll
MOD - [2014/11/23 14:33:56 | 000,190,464 | ---- | M] () -- C:\Program Files (x86)\Pidgin\libsasl.dll
MOD - [2014/11/23 14:33:56 | 000,140,288 | ---- | M] () -- C:\Program Files (x86)\Pidgin\sasl2\saslDIGESTMD5.dll
MOD - [2014/11/23 14:33:56 | 000,115,712 | ---- | M] () -- C:\Program Files (x86)\Pidgin\sasl2\saslCRAMMD5.dll
MOD - [2014/11/23 14:33:56 | 000,102,912 | ---- | M] () -- C:\Program Files (x86)\Pidgin\sasl2\saslPLAIN.dll
MOD - [2014/11/23 14:33:56 | 000,102,912 | ---- | M] () -- C:\Program Files (x86)\Pidgin\sasl2\saslLOGIN.dll
MOD - [2014/11/23 14:33:56 | 000,102,400 | ---- | M] () -- C:\Program Files (x86)\Pidgin\sasl2\saslANONYMOUS.dll
MOD - [2014/08/19 11:04:10 | 000,708,608 | ---- | M] () -- F:\Program Files\app\Kodi\system\sqlite3.dll
MOD - [2014/08/16 17:40:34 | 000,335,872 | ---- | M] () -- F:\Program Files\app\lingoes_portable_2.9.1\OpenText32.dll
MOD - [2014/06/30 13:04:20 | 000,010,240 | ---- | M] () -- F:\Program Files\app\Kodi\system\python\DLLs\select.pyd
MOD - [2014/06/30 13:04:16 | 000,715,264 | ---- | M] () -- F:\Program Files\app\Kodi\system\python\DLLs\_hashlib.pyd
MOD - [2014/06/30 13:04:14 | 000,127,488 | ---- | M] () -- F:\Program Files\app\Kodi\system\python\DLLs\pyexpat.pyd
MOD - [2014/06/30 13:04:10 | 000,087,552 | ---- | M] () -- F:\Program Files\app\Kodi\system\python\DLLs\_ctypes.pyd
MOD - [2014/06/30 13:04:04 | 000,048,128 | ---- | M] () -- F:\Program Files\app\Kodi\system\python\DLLs\_sqlite3.pyd
MOD - [2014/06/30 13:04:02 | 000,686,080 | ---- | M] () -- F:\Program Files\app\Kodi\system\python\DLLs\unicodedata.pyd
MOD - [2014/06/30 13:04:00 | 001,160,704 | ---- | M] () -- F:\Program Files\app\Kodi\system\python\DLLs\_ssl.pyd
MOD - [2014/06/30 13:03:54 | 000,046,080 | ---- | M] () -- F:\Program Files\app\Kodi\system\python\DLLs\_socket.pyd
MOD - [2014/03/20 18:12:49 | 000,904,525 | ---- | M] () -- C:\Program Files (x86)\Pidgin\Gtk\bin\libcairo-2.dll
MOD - [2014/03/20 18:12:49 | 000,553,382 | ---- | M] () -- C:\Program Files (x86)\Pidgin\Gtk\bin\freetype6.dll
MOD - [2014/03/20 18:12:49 | 000,279,059 | ---- | M] () -- C:\Program Files (x86)\Pidgin\Gtk\bin\libfontconfig-1.dll
MOD - [2014/03/20 18:12:49 | 000,216,992 | ---- | M] () -- C:\Program Files (x86)\Pidgin\Gtk\bin\libpng14-14.dll
MOD - [2014/03/20 18:12:49 | 000,177,586 | ---- | M] () -- C:\Program Files (x86)\Pidgin\Gtk\bin\libexpat-1.dll
MOD - [2014/03/20 18:12:49 | 000,100,352 | ---- | M] () -- C:\Program Files (x86)\Pidgin\Gtk\bin\zlib1.dll
MOD - [2014/03/20 18:12:49 | 000,090,496 | ---- | M] () -- C:\Program Files (x86)\Pidgin\Gtk\lib\gtk-2.0\2.10.0\engines\libwimp.dll
MOD - [2014/02/11 16:29:20 | 000,093,696 | ---- | M] () -- C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
MOD - [2013/12/24 16:35:31 | 020,870,904 | ---- | M] () -- C:\Arquivos de Programas\Transmission\transmission-qt.exe
MOD - [2013/12/24 16:35:27 | 001,016,848 | ---- | M] () -- C:\Arquivos de Programas\Transmission\dbus-daemon.exe
MOD - [2013/09/05 00:14:10 | 004,300,456 | ---- | M] () -- C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
MOD - [2013/08/03 04:49:38 | 001,600,107 | ---- | M] () -- F:\Program Files\app\Kodi\system\players\dvdplayer\libgnutls-28.dll
MOD - [2013/08/03 04:07:56 | 000,512,332 | ---- | M] () -- F:\Program Files\app\Kodi\system\players\dvdplayer\libp11-kit-0.dll
MOD - [2013/08/03 04:07:32 | 004,372,384 | ---- | M] () -- F:\Program Files\app\Kodi\system\players\dvdplayer\libhogweed-2-5.dll
MOD - [2013/08/03 04:07:32 | 003,397,336 | ---- | M] () -- F:\Program Files\app\Kodi\system\players\dvdplayer\libnettle-4-7.dll
MOD - [2013/08/03 04:07:06 | 000,723,998 | ---- | M] () -- F:\Program Files\app\Kodi\system\players\dvdplayer\libgmp-10.dll
MOD - [2011/12/20 07:25:22 | 000,743,157 | ---- | M] () -- F:\Program Files\app\Kodi\libcdio-13.dll
MOD - [2011/06/19 16:52:50 | 000,987,136 | ---- | M] () -- F:\Program Files\app\Kodi\libxml2.dll
MOD - [2011/02/14 13:07:06 | 001,552,412 | ---- | M] () -- F:\Program Files\app\Kodi\system\libeay32.dll
MOD - [2011/02/14 13:07:06 | 000,354,814 | ---- | M] () -- F:\Program Files\app\Kodi\system\libssl32.dll
MOD - [2010/10/02 08:21:50 | 000,077,824 | ---- | M] () -- F:\Program Files\app\Kodi\zlib1.dll
MOD - [2010/03/30 16:29:40 | 000,279,955 | ---- | M] () -- F:\Program Files\app\Kodi\system\libidn-11.dll
MOD - [2009/01/31 18:42:36 | 000,143,096 | ---- | M] () -- F:\Program Files\app\Kodi\system\libexpat.dll
MOD - [2005/04/19 14:26:36 | 000,352,256 | ---- | M] () -- C:\Program Files (x86)\NextUp-Acapela\BabTTS\bin\BrightSpeech.dll


[color=#E56717]========== Services (SafeList) ==========[/color]

SRV:[b]64bit:[/b] - [2015/06/20 16:34:46 | 000,114,688 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:[b]64bit:[/b] - [2015/05/25 15:19:13 | 001,255,424 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\diagtrack.dll -- (DiagTrack)
SRV:[b]64bit:[/b] - [2014/07/10 05:53:24 | 000,018,016 | ---- | M] (Olof Lagerkvist) [Auto | Running] -- C:\Windows\SysNative\imdsksvc.exe -- (ImDskSvc)
SRV - [2015/07/15 00:30:16 | 000,268,976 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2015/07/14 20:49:39 | 001,045,256 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2015/07/04 16:43:30 | 000,148,136 | ---- | M] (Mozilla Foundation) [Disabled | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2015/06/18 21:13:12 | 000,448,304 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2015/06/18 21:11:50 | 000,996,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe -- (AntiVirWebService)
SRV - [2015/06/18 21:11:36 | 000,806,192 | ---- | M] (Avira Operations GmbH & Co. KG) [Disabled | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe -- (AntiVirMailService)
SRV - [2015/06/18 21:11:30 | 000,448,304 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2015/06/18 21:11:27 | 001,044,728 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe -- (AntiVirFirewallService)
SRV - [2015/06/04 22:21:38 | 000,280,680 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs)
SRV - [2015/06/03 16:42:38 | 000,327,296 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2015/05/06 04:23:18 | 000,418,968 | ---- | M] () [Auto | Running] -- C:\Arquivos de Programas\Nitro\Pro 10\Nitro_UpdateService.exe -- (NitroUpdateService)
SRV - [2015/05/06 04:23:14 | 000,324,760 | ---- | M] (Nitro PDF Software) [Auto | Running] -- C:\Arquivos de Programas\Nitro\Pro 10\NitroPDFDriverService10x64.exe -- (NitroDriverReadSpool10)
SRV - [2015/04/20 04:52:37 | 000,042,496 | ---- | M] (InstallShield®) [Auto | Stopped] -- C:\Program Files (x86)\InstallShield\isupdate.exe -- (isupdate.exe)
SRV - [2015/04/02 19:50:46 | 000,821,376 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\NoMachine\bin\nxservice64.exe -- (nxservice)
SRV - [2014/10/21 16:22:40 | 000,833,728 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2014/10/16 20:03:00 | 000,127,752 | ---- | M] (SurfRight B.V.) [Disabled | Stopped] -- C:\Arquivos de Programas\HitmanPro\hmpsched.exe -- (HitmanProScheduler)
SRV - [2014/10/08 18:18:56 | 000,211,104 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2014/10/08 18:18:50 | 000,534,184 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2014/10/01 11:09:30 | 000,968,504 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2014/10/01 11:09:28 | 001,871,160 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2014/06/12 18:23:08 | 000,359,128 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnetdhcp.exe -- (VMnetDHCP)
SRV - [2014/06/12 18:22:40 | 000,437,976 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Windows\SysWOW64\vmnat.exe -- (VMware NAT Service)
SRV - [2014/06/12 17:44:08 | 014,407,384 | ---- | M] () [Auto | Running] -- F:\Program Files\vmware-hostd.exe -- (VMwareHostd)
SRV - [2014/06/12 17:22:10 | 000,086,744 | ---- | M] (VMware, Inc.) [Auto | Running] -- F:\Program Files\vmware-authd.exe -- (VMAuthdService)
SRV - [2014/04/11 22:08:08 | 000,103,608 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2014/03/20 19:49:18 | 000,067,224 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2014/02/27 18:40:46 | 000,906,432 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe -- (VMUSBArbService)
SRV - [2013/11/22 08:50:14 | 000,449,592 | ---- | M] (GAS Tecnologia) [Auto | Running] -- C:\PROGRA~2\GbPlugin\GbpSv.exe -- (GbpSv)
SRV - [2013/11/15 11:24:50 | 000,137,528 | ---- | M] (Motorola Mobility LLC) [Disabled | Stopped] -- C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe -- (Motorola Device Manager)
SRV - [2012/07/17 14:14:44 | 002,292,480 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Arquivos de Programas\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2012/04/24 14:37:56 | 000,169,752 | ---- | M] (Intel Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe -- (ICCS)
SRV - [2011/09/02 15:06:38 | 000,065,657 | ---- | M] (Motorola) [Disabled | Stopped] -- C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe -- (PST Service)
SRV - [2010/11/20 09:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010/11/20 09:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2010/11/20 09:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2010/10/20 08:32:26 | 000,013,336 | ---- | M] (Intel Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010/10/05 11:08:46 | 002,655,768 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2010/10/05 11:08:42 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010/02/19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010/01/09 20:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Arquivos de Programas\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2007/05/31 16:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007/05/31 16:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
SRV - [2007/01/11 04:02:00 | 000,126,464 | ---- | M] (SEIKO EPSON CORPORATION) [On_Demand | Stopped] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE -- (EPSON_PM_RPCV4_01)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV:[b]64bit:[/b] - [2015/07/25 03:25:14 | 000,129,752 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys -- (MBAMSwissArmy)
DRV:[b]64bit:[/b] - [2015/06/18 21:11:33 | 000,132,656 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:[b]64bit:[/b] - [2015/06/18 21:11:29 | 000,153,256 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:[b]64bit:[/b] - [2015/06/11 23:00:58 | 000,197,616 | ---- | M] (Tonec Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\idmwfp.sys -- (IDMWFP)
DRV:[b]64bit:[/b] - [2015/05/26 21:02:50 | 005,375,448 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:[b]64bit:[/b] - [2015/04/07 23:05:03 | 000,077,112 | ---- | M] (eagleGet) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\eagleGet.sys -- (eagleGet)
DRV:[b]64bit:[/b] - [2015/03/04 09:16:37 | 000,044,088 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\avnetflt.sys -- (avnetflt)
DRV:[b]64bit:[/b] - [2015/03/02 13:39:58 | 000,087,216 | ---- | M] (NoMachine) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\nxusbf.sys -- (nxusbf)
DRV:[b]64bit:[/b] - [2015/03/02 13:39:58 | 000,068,096 | ---- | M] (NoMachine) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nxusbh.sys -- (nxusbh)
DRV:[b]64bit:[/b] - [2015/03/02 13:39:58 | 000,010,240 | ---- | M] (NoMachine) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nxusbs.sys -- (nxusbs)
DRV:[b]64bit:[/b] - [2014/11/24 11:07:02 | 000,141,440 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV:[b]64bit:[/b] - [2014/10/16 22:01:41 | 000,034,808 | ---- | M] () [Kernel | On_Demand | Unknown] -- C:\Windows\SysNative\drivers\TrueSight.sys -- (TrueSight)
DRV:[b]64bit:[/b] - [2014/10/08 18:18:54 | 000,273,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:[b]64bit:[/b] - [2014/10/08 18:18:54 | 000,029,352 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:[b]64bit:[/b] - [2014/10/08 18:18:54 | 000,023,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:[b]64bit:[/b] - [2014/10/08 18:18:50 | 000,766,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:[b]64bit:[/b] - [2014/10/01 11:11:26 | 000,063,704 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mwac.sys -- (MBAMWebAccessControl)
DRV:[b]64bit:[/b] - [2014/10/01 11:11:12 | 000,025,816 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:[b]64bit:[/b] - [2014/08/15 22:35:00 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:[b]64bit:[/b] - [2014/07/26 20:39:29 | 000,030,424 | ---- | M] (Sony Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggsomc.sys -- (ggsomc)
DRV:[b]64bit:[/b] - [2014/07/26 20:39:29 | 000,016,088 | ---- | M] (Sony Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggflt.sys -- (ggflt)
DRV:[b]64bit:[/b] - [2014/07/10 05:54:07 | 000,042,560 | ---- | M] (Olof Lagerkvist) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\imdisk.sys -- (ImDisk)
DRV:[b]64bit:[/b] - [2014/06/12 18:23:04 | 000,064,728 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmx86.sys -- (vmx86)
DRV:[b]64bit:[/b] - [2014/06/12 18:22:50 | 000,031,448 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetuserif.sys -- (VMnetuserif)
DRV:[b]64bit:[/b] - [2014/06/12 18:22:02 | 000,046,160 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\vmnetbridge.sys -- (VMnetBridge)
DRV:[b]64bit:[/b] - [2014/06/12 18:22:02 | 000,020,560 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmnetadapter.sys -- (VMnetAdapter)
DRV:[b]64bit:[/b] - [2014/06/12 18:21:58 | 000,033,496 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMkbd.sys -- (vmkbd)
DRV:[b]64bit:[/b] - [2014/06/03 09:58:06 | 000,020,536 | ---- | M] (Olof Lagerkvist) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\awealloc.sys -- (AWEAlloc)
DRV:[b]64bit:[/b] - [2014/04/22 15:07:46 | 000,017,920 | ---- | M] (NoMachine) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\nxaudio.sys -- (nxaudio)
DRV:[b]64bit:[/b] - [2014/02/27 18:40:32 | 000,054,464 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\hcmon.sys -- (hcmon)
DRV:[b]64bit:[/b] - [2014/02/27 18:40:28 | 000,038,720 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmusb.sys -- (vmusb)
DRV:[b]64bit:[/b] - [2013/12/04 22:12:53 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:[b]64bit:[/b] - [2013/10/08 18:21:10 | 000,073,296 | ---- | M] (VMware, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vsock.sys -- (vsock)
DRV:[b]64bit:[/b] - [2013/10/08 18:21:06 | 000,085,584 | ---- | M] (VMware, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\vmci.sys -- (vmci)
DRV:[b]64bit:[/b] - [2013/10/01 23:22:20 | 000,056,832 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:[b]64bit:[/b] - [2013/09/30 16:26:50 | 000,019,152 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdrvio.sys -- (pwdrvio)
DRV:[b]64bit:[/b] - [2013/09/30 16:26:48 | 000,012,504 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdspio.sys -- (pwdspio)
DRV:[b]64bit:[/b] - [2013/08/13 01:01:22 | 000,027,608 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ICCWDT.sys -- (ICCWDT)
DRV:[b]64bit:[/b] - [2013/07/24 12:02:55 | 000,034,816 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:[b]64bit:[/b] - [2013/05/08 16:13:51 | 000,030,112 | ---- | M] (REALiX(tm)) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\HWiNFO64A.SYS -- (HWiNFO32)
DRV:[b]64bit:[/b] - [2013/03/25 15:44:38 | 000,141,376 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avfwot.sys -- (avfwot)
DRV:[b]64bit:[/b] - [2013/03/25 15:44:38 | 000,114,608 | ---- | M] (Avira GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\avfwim.sys -- (avfwim)
DRV:[b]64bit:[/b] - [2013/03/04 09:24:27 | 000,040,344 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:[b]64bit:[/b] - [2013/01/07 13:14:56 | 000,029,696 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\IpopTap.sys -- (IpopTap)
DRV:[b]64bit:[/b] - [2012/10/02 09:34:28 | 000,342,528 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:[b]64bit:[/b] - [2012/08/23 11:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:[b]64bit:[/b] - [2012/08/21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:[b]64bit:[/b] - [2012/03/01 03:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:[b]64bit:[/b] - [2011/03/11 03:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:[b]64bit:[/b] - [2011/03/11 03:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:[b]64bit:[/b] - [2010/11/20 10:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:[b]64bit:[/b] - [2010/10/26 01:08:08 | 000,406,632 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:[b]64bit:[/b] - [2010/10/20 08:23:46 | 000,438,296 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:[b]64bit:[/b] - [2010/09/20 23:59:38 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:[b]64bit:[/b] - [2010/06/10 23:32:22 | 000,012,224 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\tpsacpi.sys -- (tpsacpi)
DRV:[b]64bit:[/b] - [2010/01/19 17:25:34 | 001,088,544 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rtl8192se.sys -- (rtl8192se)
DRV:[b]64bit:[/b] - [2009/12/30 11:21:26 | 000,031,800 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\revoflt.sys -- (Revoflt)
DRV:[b]64bit:[/b] - [2009/10/05 09:34:00 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:[b]64bit:[/b] - [2009/08/21 01:52:10 | 000,079,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:[b]64bit:[/b] - [2009/07/13 22:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:[b]64bit:[/b] - [2009/07/13 22:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:[b]64bit:[/b] - [2009/07/13 22:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:[b]64bit:[/b] - [2009/06/10 17:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:[b]64bit:[/b] - [2009/06/10 17:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:[b]64bit:[/b] - [2009/06/10 17:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:[b]64bit:[/b] - [2009/06/10 17:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2015/03/26 21:10:52 | 000,122,432 | ---- | M] (Tonec Inc.) [Kernel | Auto | Running] -- C:\Windows\SysWOW64\drivers\idmwfp.sys -- (IDMWFP)
DRV - [2014/10/20 17:51:28 | 000,057,008 | ---- | M] (NoMachine) [File_System | Auto | Running] -- C:\Program Files (x86)\NoMachine\bin\drivers\nxdisk\amd64\nxfs.sys -- (nxfs)
DRV - [2010/07/01 14:11:24 | 000,012,352 | ---- | M] () [Kernel | Unavailable | Unknown] -- C:\Arquivos de Programas\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)
DRV - [2009/07/13 22:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{E6C1B02B-026C-46A7-BF29-152A4A1C60F8}: "URL" = http://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBox
IE:[b]64bit:[/b] - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE:[b]64bit:[/b] - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE:[b]64bit:[/b] - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{667A750D-5D97-49AD-A876-A07EB5C95AB9}: "URL" = http://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBox
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" =


IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-4199600838-2634245172-1625614988-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://nmd.msn.com
IE - HKU\S-1-5-21-4199600838-2634245172-1625614988-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.cceinfo.com.br [binary data]
IE - HKU\S-1-5-21-4199600838-2634245172-1625614988-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
IE - HKU\S-1-5-21-4199600838-2634245172-1625614988-1001\..\SearchScopes,DefaultScope = {E6C1B02B-026C-46A7-BF29-152A4A1C60F8}
IE - HKU\S-1-5-21-4199600838-2634245172-1625614988-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02
IE - HKU\S-1-5-21-4199600838-2634245172-1625614988-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-4199600838-2634245172-1625614988-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.search.countryCode: "BR"
FF - prefs.js..browser.search.defaultenginename: "DuckDuckGo"
FF - prefs.js..browser.search.hiddenOneOffs: "Yahoo,Bing,BuscaPé,MercadoLivre,Twitter,Wikipedia (pt)"
FF - prefs.js..browser.search.isUS: false
FF - prefs.js..browser.search.region: "BR"
FF - prefs.js..browser.search.selectedEngine: "DuckDuckGo"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledAddons: yespopupsV1%40patheticcockroach.com:0.9.8b
FF - prefs.js..extensions.enabledAddons: %7B87F8774F-B485-47E2-A755-A40A8A5E8873%7D:3.10.0.1
FF - prefs.js..extensions.enabledAddons: mozilla_cc%40internetdownloadmanager.com:7.3.100
FF - prefs.js..extensions.enabledAddons: %7Bd40f5e7b-d2cf-4856-b441-cc613eeffbe3%7D:1.68.1-signed
FF - prefs.js..extensions.enabledAddons: %7B19503e42-ca3c-4c27-b1e2-9cdb2170ee34%7D:1.5.6.12.1-signed
FF - prefs.js..extensions.enabledAddons: %7Be4a8a97b-f2ed-450b-b12d-ee082ba24781%7D:3.2
FF - prefs.js..extensions.enabledAddons: ramback%40pavlov.net:1.0.1-signed
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.9.31
FF - prefs.js..extensions.enabledAddons: mozilla_cc2%40internetdownloadmanager.com:6.23.16
FF - prefs.js..extensions.enabledAddons: %7Be7c7d1b3-5984-410e-9f1e-54e3f8490e8e%7D:39.1
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_209.dll File not found
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll ( Microsoft Corporation)
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.2.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3528.0331: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@mytalkpal.com/ffplugin: C:\Program Files (x86)\Talkpal\Speech Plugin For EF\npTalkpalPlugin.dll (Shanghai Qitai Tech. Co., Ltd.)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@raidcall.en/RCplugin: C:\Users\eduardo\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.3: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\eduardo\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\eduardo\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\gastecnologia.com.br/sf/uni: C:\Users\eduardo\AppData\Local\GAS Tecnologia\GBBD\npsf_uni.dll (GAS Tecnologia)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 39.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 39.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2015/07/20 18:05:50 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{87F8774F-B485-47E2-A755-A40A8A5E8873}: C:\Users\eduardo\AppData\Local\GAS Tecnologia\GBBD\uni\xpi [2014/08/26 03:03:18 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\fdm_ffext@freedownloadmanager.org: C:\Program Files (x86)\Free Download Manager\Firefox\Extension
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\mozilla_cc2@internetdownloadmanager.com: C:\Users\eduardo\AppData\Roaming\IDM\idmmzcc7 [2015/07/22 21:08:24 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\SeaMonkey\Extensions\\mozilla_cc@internetdownloadmanager.com: C:\Users\eduardo\AppData\Roaming\IDM\idmmzcc5 [2015/07/22 21:08:25 | 000,000,000 | ---D | M]

[2013/05/08 16:26:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\Extensions
[2015/06/20 00:56:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\Firefox\Profiles\qo3evdts.default\extension-data
[2015/07/24 14:15:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\Firefox\Profiles\qo3evdts.default\extensions
[2015/06/07 22:39:30 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\eduardo\AppData\Roaming\mozilla\Firefox\Profiles\qo3evdts.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2015/05/29 13:40:42 | 000,000,000 | ---D | M] (Flashblock) -- C:\Users\eduardo\AppData\Roaming\mozilla\Firefox\Profiles\qo3evdts.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2015/05/28 23:39:06 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\eduardo\AppData\Roaming\mozilla\Firefox\Profiles\qo3evdts.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
[2015/06/22 16:53:21 | 000,000,000 | ---D | M] (Memory Fox) -- C:\Users\eduardo\AppData\Roaming\mozilla\Firefox\Profiles\qo3evdts.default\extensions\{E173B749-DB5B-4fd2-BA0E-94ECEA0CA55B}
[2015/05/22 00:54:02 | 000,000,000 | ---D | M] (IDM CC) -- C:\Users\eduardo\AppData\Roaming\mozilla\Firefox\Profiles\qo3evdts.default\extensions\mozilla_cc@internetdownloadmanager.com
[2015/07/24 23:52:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\Firefox\Profiles\qo3evdts.default\extensions\staged
[2015/05/29 13:40:42 | 000,071,085 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\bloodyvikings@ffs.bplaced.net.xpi
[2015/05/28 23:38:42 | 000,394,089 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\client@anonymox.net.xpi
[2015/05/28 23:38:42 | 000,059,306 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\come.back.block.image.from@cat-in-136.blogspot.com.xpi
[2015/05/28 23:38:43 | 000,117,790 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\elemhidehelper@adblockplus.org.xpi
[2015/07/21 23:50:08 | 001,482,019 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\firefox@ghostery.com.xpi
[2015/07/24 03:47:00 | 006,714,638 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\firefox@mega.co.nz.xpi
[2015/05/28 23:38:40 | 000,028,744 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\jid0-k75TfRGfOXPHfEZmJ9cKu5eCgLc@jetpack.xpi
[2015/06/05 00:31:31 | 000,091,591 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\jid1-sNL73VCI4UB0Fw@jetpack.xpi
[2015/06/04 15:03:46 | 000,082,254 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\jid1-yIDO6R3DGl4u2Q@jetpack.xpi
[2015/07/01 00:58:24 | 000,012,256 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\ramback@pavlov.net.xpi
[2015/05/28 23:38:41 | 000,029,160 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\the-addon-bar@GeekInTraining-GiT.xpi
[2015/06/30 23:48:28 | 000,074,654 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\translator@zoli.bod.xpi
[2015/07/18 23:50:10 | 003,625,399 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\uBlock0@raymondhill.net.xpi
[2013/05/09 02:21:27 | 000,056,364 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\yespopupsV1@patheticcockroach.com.xpi
[2015/05/29 13:40:42 | 000,400,336 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi
[2015/07/05 14:13:49 | 003,922,938 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\{3d2ee42e-a6d9-4888-bd17-2148dc7928d7}.xpi
[2015/07/22 13:17:10 | 000,561,097 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2015/05/28 23:38:45 | 000,589,166 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi
[2015/05/28 23:38:44 | 000,946,636 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2015/05/29 13:40:42 | 000,144,873 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
[2015/05/26 23:38:41 | 000,665,944 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi
[2015/06/01 15:30:39 | 000,344,550 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2015/07/22 13:17:10 | 004,245,324 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\{e7c7d1b3-5984-410e-9f1e-54e3f8490e8e}.xpi
[2015/07/24 23:52:26 | 000,349,849 | ---- | M] () (No name found) -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\extensions\staged\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2014/05/06 18:10:13 | 000,001,874 | ---- | M] () -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\searchplugins\duckduckgo.xml
[2015/04/11 21:43:48 | 000,004,655 | ---- | M] () -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\searchplugins\legendas-zone.xml
[2015/03/17 17:28:24 | 000,001,770 | ---- | M] () -- C:\Users\eduardo\AppData\Roaming\mozilla\firefox\profiles\qo3evdts.default\searchplugins\linguee-pt-en.xml
[2014/10/31 00:06:05 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2015/07/04 16:43:32 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2014/08/26 03:03:18 | 000,000,000 | ---D | M] (Guardião - Itaú 30 horas) -- C:\USERS\EDUARDO\APPDATA\LOCAL\GAS TECNOLOGIA\GBBD\UNI\XPI
[2015/07/22 21:08:24 | 000,000,000 | ---D | M] (IDM integration) -- C:\USERS\EDUARDO\APPDATA\ROAMING\IDM\IDMMZCC7

[color=#E56717]========== Chrome ==========[/color]

CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiahmijlpehemcpleichkcokhegllfjl\1.0.13_0\
CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhjmjkdknjeokcmgjmdpkccpmahfmiib\4.3_0\
CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\boadgeojelhgndaghljhdicfkmllpafd\15.623.0.6_0\
CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpphkkgodbfncbcpgopijlfakfgmclao\42.5.25_0\
CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.9.1_0\
CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm\0.9.9.3_0\
CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnciopoikihiagdjbjpnocolokfelagl\2.15.723.0_0\
CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\daoghdmcjpjomfalbgjonallnfkhdccg\3.0_0\
CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo\3.11_0\
CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekhagklcjbdpajgpjgmbionohlpdbjgc\4.0.26_0\
CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgiidlnejdlfoacoeleopkljhbckmlko\3.0_0\
CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\hiajdlfgbgnnjakkbnpdhmhfhklkbiol\1.2.6_0\
CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\kgoiecbcpnodglnehemdbnkdmelhonec\1.12.0.0_0\
CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg\0.3.0.5_0\
CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\lfmhcpmkbdkbgbmkjoiopeeegenkdikp\6.6.5_0\
CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij\5.4.6_0\
CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngpampappnmepgilojfohadhhmbhlaek\6.23.15_0\
CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.1.2.0_0\
CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\nogedeefikjnjbblgilelijaddaniekn\3.4_0\
CHR - Extension: No name found = C:\Users\eduardo\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiigbmnaadbkfbmpbfijlflahbdbdgdf\1.0.6.18_0\

O1 HOSTS File: ([2015/06/05 12:27:15 | 000,002,263 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activation.cloud.techsmith.com
O1 - Hosts: 127.0.0.1 oscount.techsmith.com
O1 - Hosts: 127.0.0.1 updater.techsmith.com
O1 - Hosts: 127.0.0.1 camtasiatudi.techsmith.com
O1 - Hosts: 127.0.0.1 tsccloud.cloudapp.net
O1 - Hosts: 127.0.0.1 assets.cloud.techsmith.com
O1 - Hosts: 127.0.0.1 3dns-1.adobe.com 3dns-2.adobe.com 3dns-3.adobe.com 3dns-4.adobe.com 3dns.adobe.com activate-sea.adobe.com activate-sjc0.adobe.com activate.adobe.com activate.wip.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip1.adobe.com activate.wip2.adobe.com activate.wip3.adobe.com activate.wip4.adobe.com adobe-dns-1.adobe.com adobe-dns-2.adobe.com adobe-dns-3.adobe.com adobe-dns-4.adobe.com adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com crl.verisign.net ereg.adobe.com ereg.wip.adobe.com ereg.wip1.adobe.com ereg.wip2.adobe.com ereg.wip3.adobe.com ereg.wip4.adobe.com hl2rcv.adobe.com
O1 - Hosts: 127.0.0.1 lm.licenses.adobe.com lmlicenses.wip4.adobe.com na2m-pr.licenses.adobe.com ood.opsource.net practivate.adobe practivate.adobe.com practivate.adobe.ipp practivate.adobe.newoa practivate.adobe.ntp
O1 - Hosts: 127.0.0.1 wip.adobe.com wip1.adobe.com wip2.adobe.com wip3.adobe.com wip4.adobe.com wwis-dubc1-vip60.adobe.com www.adobeereg.com www.wip.adobe.com www.wip1.adobe.com
O1 - Hosts: 127.0.0.1 www.wip2.adobe.com www.wip3.adobe.com www.wip4.adobe.com cmdls.adobe.com na1r.services.adobe.com prod-rel-ffc-ccm.oobesaas.adobe.com
O2:[b]64bit:[/b] - BHO: (IDM integration (IDMIEHlprObj Class)) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll (Internet Download Manager, Tonec Inc.)
O2:[b]64bit:[/b] - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Arquivos de Programas\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:[b]64bit:[/b] - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Arquivos de Programas\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:[b]64bit:[/b] - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Arquivos de Programas\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (IDM integration (IDMIEHlprObj Class)) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Evernote extension) - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (GbIehObj Class) - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\Program Files (x86)\GbPlugin\gbiehuni.dll (Banco Itaú Unibanco)
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:[b]64bit:[/b] - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-4199600838-2634245172-1625614988-1001..\Run: [AdobeBridge] File not found
O4 - HKU\.DEFAULT..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 File not found
O4 - HKU\S-1-5-18..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-4199600838-2634245172-1625614988-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives1 = 65544
O8:[b]64bit:[/b] - Extra context menu item: Capturar esta página - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=1 File not found
O8:[b]64bit:[/b] - Extra context menu item: Capturar favorito - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=0 File not found
O8:[b]64bit:[/b] - Extra context menu item: Capturar imagem - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=4 File not found
O8:[b]64bit:[/b] - Extra context menu item: Capturar seleção - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=3 File not found
O8:[b]64bit:[/b] - Extra context menu item: Capturar URL - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=0 File not found
O8:[b]64bit:[/b] - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~2\MICROS~4\Office14\EXCEL.EXE/3000 File not found
O8:[b]64bit:[/b] - Extra context menu item: Nova nota - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\NewNote.html ()
O8 - Extra context menu item: Capturar esta página - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=1 File not found
O8 - Extra context menu item: Capturar favorito - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=0 File not found
O8 - Extra context menu item: Capturar imagem - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=4 File not found
O8 - Extra context menu item: Capturar seleção - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=3 File not found
O8 - Extra context menu item: Capturar URL - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=0 File not found
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\PROGRA~2\MICROS~4\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nova nota - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\NewNote.html ()
O9:[b]64bit:[/b] - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\OLIEResource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\AddNote.html ()
O9:[b]64bit:[/b] - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\OLIEResource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIERes\AddNote.html ()
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files (x86)\Evernote\Evernote\OLIEResource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\AddNote.html ()
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Evernote\Evernote\OLIEResource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\\EvernoteIERes\AddNote.html ()
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Arquivos de Programas\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Arquivos de Programas\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Arquivos de Programas\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13[b]64bit:[/b] - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-4199600838-2634245172-1625614988-1001\..Trusted Domains: itau.com.br ([]* in Trusted sites)
O15 - HKU\S-1-5-21-4199600838-2634245172-1625614988-1001\..Trusted Domains: itau.com.br ([bankline] * in Trusted sites)
O15 - HKU\S-1-5-21-4199600838-2634245172-1625614988-1001\..Trusted Domains: itau.com.br ([clickbanking] * in Trusted sites)
O15 - HKU\S-1-5-21-4199600838-2634245172-1625614988-1001\..Trusted Domains: itau.com.br ([guardiao] * in Trusted sites)
O15 - HKU\S-1-5-21-4199600838-2634245172-1625614988-1001\..Trusted Domains: itau.com.br ([www] * in Trusted sites)
O15 - HKU\S-1-5-21-4199600838-2634245172-1625614988-1001\..Trusted Domains: public_html ([]* in Trusted sites)
O15 - HKU\S-1-5-21-4199600838-2634245172-1625614988-1001\..Trusted Domains: public_html ([]CreatedByWinginx in Local intranet)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 189.7.8.34 189.7.8.39 201.6.4.116
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0159A443-52CF-43BC-96CA-C1DAE87B4441}: DhcpNameServer = 189.7.8.34 189.7.8.39 201.6.4.116
O18:[b]64bit:[/b] - Protocol\Handler\ms-help - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\wlpg - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Arquivos de Programas\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\System32\Userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\ GbPluginUni: DllName - (C:\Program Files (x86)\GbPlugin\gbiehUni.dll) - C:\Program Files (x86)\GbPlugin\gbiehUni.dll (Banco Itaú Unibanco)
O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:[b]64bit:[/b] - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Arquivos de Programas\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {E37CB5F0-51F5-4395-A808-5FA49E399008} - C:\Program Files (x86)\GbPlugin\gbiehuni.dll (Banco Itaú Unibanco)
O30:[b]64bit:[/b] - LSA: Authentication Packages - (nxlsa) - C:\Windows\SysNative\nxlsa.dll ()
O30 - LSA: Authentication Packages - (nxlsa) - File not found
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{58386ed7-5dd0-11e3-b0ea-00e04c3f52d8}\Shell - "" = AutoRun
O33 - MountPoints2\{58386ed7-5dd0-11e3-b0ea-00e04c3f52d8}\Shell\AutoRun\command - "" = G:\LGAutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2015/07/20 22:18:32 | 000,000,000 | ---D | C] -- C:\Users\eduardo\AppData\Roaming\Nitro
[2015/07/20 22:11:50 | 000,031,896 | ---- | C] (Nitro PDF Software) -- C:\Windows\SysNative\nitrolocalmon10.dll
[2015/07/20 22:11:50 | 000,020,120 | ---- | C] (Nitro PDF Software) -- C:\Windows\SysNative\nitrolocalui10.dll
[2015/07/20 22:11:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Nitro
[2015/07/20 22:11:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Nitro
[2015/07/20 22:11:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Nitro
[2015/07/20 22:11:33 | 000,000,000 | ---D | C] -- C:\Program Files\Nitro
[2015/07/20 22:11:33 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Nitro
[2015/07/20 22:10:09 | 000,000,000 | ---D | C] -- C:\Users\eduardo\AppData\Roaming\Downloaded Installations
[2015/07/15 07:22:53 | 000,197,616 | ---- | C] (Tonec Inc.) -- C:\Windows\SysNative\drivers\idmwfp.sys
[2015/07/15 00:39:41 | 000,000,000 | ---D | C] -- C:\Users\eduardo\AppData\Roaming\Kodi
[2015/07/15 00:37:31 | 000,000,000 | ---D | C] -- C:\Users\eduardo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kodi
[2015/07/14 20:27:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Rosetta Stone Backups
[2015/07/14 20:27:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Rosetta Stone
[2015/07/14 20:26:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\InstallShield
[2015/07/09 15:15:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NextUp-Acapela
[2015/07/09 14:55:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Naturalsoft
[2015/07/09 14:55:44 | 000,000,000 | ---D | C] -- C:\Users\eduardo\AppData\Roaming\Naturalsoft
[2015/07/09 14:55:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Naturalsoft
[2015/07/09 14:55:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Naturalsoft
[2015/07/09 14:55:08 | 000,000,000 | ---D | C] -- C:\Users\eduardo\Documents\Naturalsoft
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2015/07/25 03:28:02 | 000,000,964 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player PPAPI Notifier.job
[2015/07/25 03:25:14 | 000,129,752 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2015/07/25 03:00:00 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2015/07/25 02:56:00 | 000,001,070 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2015/07/24 22:01:43 | 000,023,056 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2015/07/24 22:01:43 | 000,023,056 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2015/07/24 20:56:00 | 000,001,066 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2015/07/24 14:00:08 | 000,000,470 | ---- | M] () -- C:\Windows\tasks\InstallShield Update Task.job
[2015/07/24 14:00:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2015/07/23 14:21:55 | 001,814,026 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2015/07/23 14:21:55 | 000,772,964 | ---- | M] () -- C:\Windows\SysNative\prfh0416.dat
[2015/07/23 14:21:55 | 000,716,468 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2015/07/23 14:21:55 | 000,171,304 | ---- | M] () -- C:\Windows\SysNative\prfc0416.dat
[2015/07/23 14:21:55 | 000,144,068 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2015/07/22 13:12:17 | 005,042,800 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2015/07/22 13:11:30 | 000,031,088 | ---- | M] (GbPlugin NDIS Device Driver) -- C:\Windows\SysWow64\drivers\gbpndisrd.sys
[2015/07/22 13:11:30 | 000,010,266 | ---- | M] () -- C:\Windows\SysWow64\drivers\ndisrd.cat
[2015/07/22 13:11:30 | 000,003,641 | ---- | M] () -- C:\Windows\SysWow64\drivers\ndisrd.inf
[2015/07/22 13:11:30 | 000,001,814 | ---- | M] () -- C:\Windows\SysWow64\drivers\ndisrd_m.inf
[2015/07/22 13:11:30 | 000,001,402 | ---- | M] () -- C:\Windows\SysWow64\drivers\gas.cer
[2015/07/20 22:11:40 | 000,001,935 | ---- | M] () -- C:\Users\Public\Desktop\Nitro Pro 10.lnk
[2015/07/17 17:17:44 | 000,001,408 | ---- | M] () -- C:\Users\eduardo\Documents\Skype - Atalho.lnk
[2015/07/15 00:37:31 | 000,000,818 | ---- | M] () -- C:\Users\eduardo\Desktop\Kodi.lnk
[2015/07/09 14:55:45 | 000,002,050 | ---- | M] () -- C:\Users\Public\Desktop\NaturalReader Free.lnk
[2015/06/25 14:09:40 | 000,125,130 | ---- | M] () -- C:\Users\eduardo\Documents\Templeite Fatura.pdf
[1 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2015/07/22 13:11:09 | 005,042,800 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2015/07/20 22:11:40 | 000,001,947 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nitro Pro 10.lnk
[2015/07/20 22:11:39 | 000,001,935 | ---- | C] () -- C:\Users\Public\Desktop\Nitro Pro 10.lnk
[2015/07/17 17:17:44 | 000,001,408 | ---- | C] () -- C:\Users\eduardo\Documents\Skype - Atalho.lnk
[2015/07/15 00:37:31 | 000,000,818 | ---- | C] () -- C:\Users\eduardo\Desktop\Kodi.lnk
[2015/07/14 20:26:26 | 000,000,470 | ---- | C] () -- C:\Windows\tasks\InstallShield Update Task.job
[2015/07/09 14:55:45 | 000,002,050 | ---- | C] () -- C:\Users\Public\Desktop\NaturalReader Free.lnk
[2015/06/25 14:09:38 | 000,125,130 | ---- | C] () -- C:\Users\eduardo\Documents\Templeite Fatura.pdf
[2015/05/26 20:53:32 | 000,081,408 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2015/05/25 14:56:59 | 000,001,874 | ---- | C] () -- C:\Users\eduardo\AppData\Roaming\SAS7_000.DAT
[2015/05/02 16:12:07 | 000,000,082 | ---- | C] () -- C:\Windows\SysWow64\winsevr.dat
[2015/04/12 23:40:43 | 000,000,701 | ---- | C] () -- C:\Users\eduardo\AppData\Local\recently-used.xbel
[2015/01/30 19:15:37 | 000,000,286 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2015/01/19 15:36:57 | 000,000,600 | ---- | C] () -- C:\Users\eduardo\AppData\Local\PUTTY.RND
[2015/01/18 13:37:44 | 000,000,005 | ---- | C] () -- C:\Users\eduardo\.bash_history
[2014/10/10 01:09:47 | 000,088,064 | ---- | C] () -- C:\Users\eduardo\AppData\Roaming\RZR_00204b684e859a2a0e739fe6af92.db
[2014/09/11 13:07:18 | 000,041,984 | ---- | C] () -- C:\Windows\DLL.dll
[2014/08/16 01:13:42 | 000,001,499 | ---- | C] () -- C:\Users\eduardo\OpenP2M.cfg
[2014/08/02 22:55:37 | 000,008,704 | ---- | C] () -- C:\Users\eduardo\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2014/02/06 20:21:55 | 000,720,594 | ---- | C] () -- C:\Users\eduardo\AppData\Roaming\unins000.exe
[2014/02/06 20:21:55 | 000,016,962 | ---- | C] () -- C:\Users\eduardo\AppData\Roaming\unins000.dat
[2013/12/06 15:11:03 | 001,830,784 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013/11/21 23:01:59 | 000,000,132 | ---- | C] () -- C:\Users\eduardo\AppData\Roaming\Preferências do Formato PNG do Adobe CS6
[2013/10/31 10:24:22 | 000,963,452 | ---- | C] () -- C:\Windows\SysWow64\igcodeckrng600.bin
[2013/10/31 10:24:22 | 000,272,928 | ---- | C] () -- C:\Windows\SysWow64\igvpkrng600.bin
[2013/05/13 13:10:35 | 000,001,456 | ---- | C] () -- C:\Users\eduardo\AppData\Local\Adobe Salvar para Web 13.0 Prefs

[color=#E56717]========== ZeroAccess Check ==========[/color]

[2009/07/14 01:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2015/02/13 02:22:33 | 014,177,280 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2015/02/13 02:26:18 | 012,875,264 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 22:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 09:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 22:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

[color=#E56717]========== Purity Check ==========[/color]



[color=#E56717]========== Custom Scans ==========[/color]

[color=#A23BEC]< HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections >[/color]
"DefaultConnectionSettings" = 46 00 00 00 64 03 00 00 01 00 00 00 00 00 00 00 13 00 00 00 2A 2E 6C 6F 63 61 6C 3B 31 39 32 2E 31 36 38 2E 2A 2E 2A 00 00 00 00 00 00 00 00 00 00 00 00 8F E4 31 7D F6 8E CE 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 C0 A8 38 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 C0 A8 01 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [Binary data over 200 bytes]
"SavedLegacySettings" = 46 00 00 00 D7 0B 00 00 01 00 00 00 00 00 00 00 13 00 00 00 2A 2E 6C 6F 63 61 6C 3B 31 39 32 2E 31 36 38 2E 2A 2E 2A 00 00 00 00 00 00 00 00 00 00 00 00 8F E4 31 7D F6 8E CE 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 02 00 00 00 C0 A8 38 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 C0 A8 01 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [Binary data over 200 bytes]

[color=#E56717]========== Files - Unicode (All) ==========[/color]
[2013/11/16 00:06:42 | 104,513,208 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\{ØõølŽ™
[2013/11/16 00:06:42 | 104,513,208 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\{ØõølŽ™

[color=#E56717]========== Alternate Data Streams ==========[/color]

@Alternate Data Stream - 169 bytes -> C:\ProgramData\TEMP:0FF263E8
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:A303874F

< End of report >