Publicité
Publicité
Format du document : text/plain
Prévisualisation
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-08-2015
Ran by User (administrator) on USER-PC (14-08-2015 09:57:00)
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available Profiles: User)
Platform: Windows 7 Ultimate (X64) Language: Português (Brasil)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(QNT) C:\Users\User\AppData\Roaming\Netlog\Netlog.exe
(QNT) C:\Users\User\AppData\Roaming\NetService\netservice.exe
() C:\Program Files (x86)\Pingzapper\PZService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
(Nota Inc.) C:\Program Files (x86)\Gyazo\GyStation.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [CmPCIaudio] => C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\CMICNFG3.dll,CMICtrlWnd
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6109776 2015-08-04] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKU\S-1-5-21-894723369-241239887-2077736728-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-894723369-241239887-2077736728-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7930136 2015-08-04] (SUPERAntiSpyware)
HKU\S-1-5-21-894723369-241239887-2077736728-1000\...\Run: [Gyazo] => C:\Program Files (x86)\Gyazo\GyStation.exe [3097912 2015-07-22] (Nota Inc.)
HKU\S-1-5-21-894723369-241239887-2077736728-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53288576 2015-06-30] (Skype Technologies S.A.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-08-04] (AVAST Software)
ShellIconOverlayIdentifiers: [BaiduAntivirusIconLock] -> {0A93904A-BB1E-4a0c-9753-B57B9AE272CC} => No File
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-894723369-241239887-2077736728-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.321oyun.com?oem=smtov3&uid=S1RLJ50S476824_SAMSUNGHD322HJ&tm=1438863357
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.321oyun.com?oem=smtov3&uid=S1RLJ50S476824_SAMSUNGHD322HJ&tm=1438863357
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.321oyun.com?oem=smtov3&uid=S1RLJ50S476824_SAMSUNGHD322HJ&tm=1438863357
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.321oyun.com?oem=smtov3&uid=S1RLJ50S476824_SAMSUNGHD322HJ&tm=1438863357
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-894723369-241239887-2077736728-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pt-br/?ocid=iehp
HKU\S-1-5-21-894723369-241239887-2077736728-1000\Software\Microsoft\Internet Explorer\Main,Start Page = www.321oyun.com?oem=smtov3&uid=S1RLJ50S476824_SAMSUNGHD322HJ&tm=1438863357
HKU\S-1-5-21-894723369-241239887-2077736728-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.321oyun.com?oem=smtov3&uid=S1RLJ50S476824_SAMSUNGHD322HJ&tm=1438863357
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-08-04] (AVAST Software)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-26] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-02-08] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-08-04] (AVAST Software)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-08] (Oracle Corporation)
DPF: HKLM-x32 {98FFD412-1A12-4BCE-8AB2-247C78E22227} hxxps://static.ncsoft.jp/js/login/activex/NCLoader.8.cab
DPF: HKLM-x32 {AA07EBD2-EBDD-4BD6-9F8F-114BD513492C} hxxp://dist.cdnetworks.co.jp/cdndist/neffy/NeffyLauncher_v1013.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Winsock: Catalog9 01 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-04-30] (Initex)
Winsock: Catalog9 02 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-04-30] (Initex)
Winsock: Catalog9 03 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-04-30] (Initex)
Winsock: Catalog9 04 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-04-30] (Initex)
Winsock: Catalog9 15 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-04-30] (Initex)
Winsock: Catalog9-x64 01 C:\Windows\system32\WTFastDrv.dll [79464 2015-04-30] (Initex)
Winsock: Catalog9-x64 02 C:\Windows\system32\WTFastDrv.dll [79464 2015-04-30] (Initex)
Winsock: Catalog9-x64 03 C:\Windows\system32\WTFastDrv.dll [79464 2015-04-30] (Initex)
Winsock: Catalog9-x64 04 C:\Windows\system32\WTFastDrv.dll [79464 2015-04-30] (Initex)
Winsock: Catalog9-x64 15 C:\Windows\system32\WTFastDrv.dll [79464 2015-04-30] (Initex)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{4AF8E9AE-929A-4EFA-8BED-63964240C12F}: [DhcpNameServer] 192.168.1.1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe www.123rede.com?oem=smtov3&uid=S1RLJ50S476824_SAMSUNGHD322HJ&tm=1429019565
FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\k16rg7rw.default-1437996387708
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-08] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-08] (Oracle Corporation)
FF Plugin-x32: @raidcall.en/RCplugin -> C:\Users\User\AppData\Roaming\raidcall\plugins\nprcplugin.dll [2014-12-23] (Raidcall)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-15] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File]
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-894723369-241239887-2077736728-1000: @my.com/Games -> C:\Users\User\AppData\Local\MyComGames\NPMyComDetector.dll [2015-07-15] (My.com, Inc)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\buscape.xml [2014-11-26]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\mercadolivre.xml [2014-11-26]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-08-07]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-12-31]
Chrome:
=======
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-31]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-31]
CHR Extension: (Adblock Plus) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-04-06]
CHR Extension: (Google Search) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-31]
CHR Extension: (Avast SafePrice) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2015-01-05]
CHR Extension: (Avast Online Security) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-12-31]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-17]
CHR Extension: (Chrome Web Store Payments) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-12-31]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-31]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2015-04-21]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-21]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-07-22] (SUPERAntiSpyware.com)
S2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-11-20] (Advanced Micro Devices, Inc.) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [146600 2015-08-04] (AVAST Software)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 NetLogHandler; C:\Users\User\AppData\Roaming\Netlog\Netlog.exe [167704 2015-06-08] (QNT)
R2 NetTcpHandler; C:\Users\User\AppData\Roaming\NetService\netservice.exe [211824 2015-03-20] (QNT)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3071632 2014-05-06] (INCA Internet Co., Ltd.)
R2 PingzapperSvc; C:\Program Files (x86)\Pingzapper\PZService.exe [679424 2012-06-11] () [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation)
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2015-08-04] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [90968 2015-08-04] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-08-04] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-08-04] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1048344 2015-08-13] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [447944 2015-08-04] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [150672 2015-08-04] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [274808 2015-08-04] (AVAST Software)
R3 cmuda3; C:\Windows\System32\drivers\cmudax3.sys [1029120 2010-08-24] (C-Media Inc)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-08-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S2 AODDriver4.2.0; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]
S3 MUCABRASIL; \??\C:\Program Files (x86)\MUCABRASIL\AntiCheat64.sys [X]
S3 RTHDMIAzAudService; system32\drivers\RtHDMIVX.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-08-14 09:57 - 2015-08-14 09:57 - 00017267 _____ C:\Users\User\Desktop\FRST.txt
2015-08-14 09:56 - 2015-08-14 09:57 - 00000000 ____D C:\FRST
2015-08-14 09:56 - 2015-08-14 09:56 - 02173952 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2015-08-14 09:41 - 2015-08-14 09:46 - 00000000 ____D C:\Users\User\AppData\Roaming\RunDir
2015-08-13 17:18 - 2015-08-13 17:18 - 00001265 _____ C:\Windows\system32\3226 - 1boy 1girl artist_name bag black_hair blush breasts earrings green_eyes hetero high_resolution idolmaster idolmaster_cinderella_girls jewelry kappipe_(brd0520) kiss kneehighs large_filesize .jpg.lnk
2015-08-13 14:40 - 2015-08-13 15:02 - 154986997 _____ C:\Users\User\Desktop\[AnimaKai] Jitsu wa Watashi wa - 6 [480p].mkv
2015-08-13 14:12 - 2015-08-13 14:27 - 108903908 _____ C:\Users\User\Desktop\[AnimaKai] Akagami no Shirayukihime - 06.mp4
2015-08-13 12:57 - 2015-08-13 12:57 - 00023664 _____ C:\ZA-Scan.txt
2015-08-13 12:57 - 2015-08-13 12:56 - 00024213 _____ C:\zoek-results2015-08-13-155604.log
2015-08-13 12:56 - 2015-08-13 12:57 - 00023664 _____ C:\Users\User\Desktop\ZA-Scan.txt
2015-08-13 12:54 - 2015-08-13 12:54 - 00000000 ____D C:\zoek_backup
2015-08-13 12:43 - 2015-08-13 12:44 - 01368576 _____ C:\Users\User\Desktop\ZA-Scan.exe
2015-08-13 12:29 - 2015-08-13 12:29 - 00042444 _____ C:\Users\User\Desktop\MbrScan.log
2015-08-13 12:29 - 2015-08-13 12:29 - 00000512 _____ C:\Users\User\Desktop\Dump_Hdd0_DR0.mbr
2015-08-13 12:28 - 2015-08-13 12:28 - 00147456 _____ (Eric_71) C:\Users\User\Desktop\MbrScan.exe
2015-08-13 11:40 - 2015-08-14 09:40 - 00000868 _____ C:\Windows\PFRO.log
2015-08-13 11:20 - 2015-08-13 11:38 - 00000129 _____ C:\Users\User\Desktop\remoção do trojan.txt
2015-08-13 10:33 - 2015-08-14 09:41 - 00000224 _____ C:\Windows\setupact.log
2015-08-13 10:33 - 2015-08-13 10:33 - 00000000 _____ C:\Windows\setuperr.log
2015-08-13 10:03 - 2015-08-14 09:46 - 00015279 _____ C:\Windows\WindowsUpdate.log
2015-08-08 03:27 - 2015-08-08 03:29 - 00000217 _____ C:\Users\User\Documents\himekano.txt
2015-08-07 14:17 - 2015-08-08 13:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-08-04 16:56 - 2015-08-04 16:56 - 00378880 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-08-04 16:56 - 2015-08-04 16:56 - 00043112 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-08-04 15:09 - 2015-08-04 15:09 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-07-27 06:33 - 2015-07-27 06:33 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\1C404606.sys
2015-07-22 17:57 - 2015-07-22 17:57 - 00000000 ____D C:\Users\User\AppData\Local\CEF
2015-07-22 15:50 - 2015-08-14 09:42 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-22 15:50 - 2015-07-22 15:50 - 00000000 ____D C:\Users\Todos os Usuários\Malwarebytes
2015-07-22 15:50 - 2015-07-22 15:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-07-22 15:50 - 2015-07-22 15:50 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-22 15:50 - 2015-07-22 15:50 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-07-22 15:50 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-07-22 15:50 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-07-22 15:50 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-07-22 15:46 - 2015-07-22 15:50 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-2.1.8.1057.exe
2015-07-22 15:43 - 2015-07-22 15:43 - 00000134 _____ C:\Users\User\Downloads\debug.log
2015-07-20 18:39 - 2015-08-01 23:43 - 00001437 _____ C:\Users\User\Desktop\Prime.lnk
2015-07-20 03:35 - 2015-07-20 03:36 - 04309854 _____ C:\Users\User\Downloads\PrimeMuS9.exe.part
2015-07-15 23:25 - 2015-07-16 18:19 - 00000000 ____D C:\MyGames
2015-07-15 23:25 - 2015-07-15 23:25 - 00000000 ____D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\My.com Games
2015-07-15 23:24 - 2015-08-13 10:34 - 00000000 ____D C:\Users\User\AppData\Local\MyComGames
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-08-14 09:56 - 2014-12-31 16:01 - 00000000 ____D C:\Users\User\AppData\Roaming\Skype
2015-08-14 09:51 - 2009-07-14 01:45 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-14 09:51 - 2009-07-14 01:45 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-14 09:41 - 2014-12-31 14:22 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2015-08-14 09:41 - 2014-12-31 14:13 - 00001066 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-08-14 09:41 - 2009-07-14 02:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-14 00:31 - 2015-06-25 19:03 - 00000000 ____D C:\Program Files (x86)\PrimeMu
2015-08-13 23:36 - 2014-12-31 14:13 - 00001070 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-08-13 16:57 - 2014-12-31 14:22 - 01048344 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2015-08-13 16:12 - 2014-12-31 16:55 - 00000000 ____D C:\Program Files (x86)\Steam
2015-08-13 10:03 - 2015-01-16 21:36 - 00000000 ____D C:\Users\User\AppData\Roaming\uTorrent
2015-08-12 15:24 - 2015-01-09 11:50 - 00001094 _____ C:\Windows\Cmicnfg3.ini.imi
2015-08-10 19:51 - 2015-07-04 13:29 - 00000000 ____D C:\Users\User\AppData\Roaming\TS3Client
2015-08-10 14:13 - 2015-03-17 12:46 - 00000000 ____D C:\Users\User\Desktop\Animes - Temporadas Variadas
2015-08-08 19:16 - 2015-01-04 14:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-08-06 09:04 - 2009-07-14 02:08 - 00032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-08-04 20:23 - 2015-07-08 07:05 - 00003402 _____ C:\Windows\System32\Tasks\GyazoUpdateTaskMachineDaily
2015-08-04 20:23 - 2015-01-08 16:03 - 00003276 _____ C:\Windows\System32\Tasks\GyazoUpdateTaskMachine
2015-08-04 20:23 - 2015-01-08 16:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gyazo
2015-08-04 20:23 - 2015-01-08 16:03 - 00000000 ____D C:\Program Files (x86)\Gyazo
2015-08-04 20:02 - 2009-07-14 04:46 - 00000000 __SHD C:\Windows\BitLockerDiscoveryVolumeContents
2015-08-04 16:56 - 2014-12-31 14:22 - 00447944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-08-04 16:56 - 2014-12-31 14:22 - 00274808 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2015-08-04 16:56 - 2014-12-31 14:22 - 00150672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-08-04 16:56 - 2014-12-31 14:22 - 00093528 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-08-04 16:56 - 2014-12-31 14:22 - 00090968 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-08-04 16:56 - 2014-12-31 14:22 - 00065224 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2015-08-04 16:56 - 2014-12-31 14:22 - 00028656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2015-08-04 15:10 - 2015-01-07 17:54 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-08-04 08:44 - 2015-04-16 10:27 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2015-07-29 18:48 - 2015-05-01 19:02 - 00000000 ____D C:\Users\User\Documents\Bandicam
2015-07-23 20:16 - 2015-01-05 16:38 - 00000000 ____D C:\Windows\Minidump
2015-07-22 16:01 - 2009-07-14 00:20 - 00000000 ____D C:\Windows\Resources
2015-07-22 15:43 - 2014-12-31 14:13 - 00000000 ____D C:\Users\User\AppData\Local\Google
2015-07-20 01:22 - 2015-05-20 08:56 - 00000000 ____D C:\Users\User\Documents\orcsoft
2015-07-15 21:31 - 2014-12-31 14:13 - 00004066 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-15 21:31 - 2014-12-31 14:13 - 00003814 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-07-15 12:07 - 2015-03-08 12:28 - 00000000 ____D C:\Users\User\AppData\Local\Battle.net
2015-07-15 11:56 - 2015-03-08 12:27 - 00000000 ____D C:\Program Files (x86)\Battle.net
==================== Files in the root of some directories =======
2015-01-15 13:17 - 2015-01-15 22:52 - 0000132 _____ () C:\Users\User\AppData\Roaming\Adobe PNG Format CS5 Prefs
2015-03-20 22:57 - 2015-03-20 22:57 - 0000038 ___SH () C:\Users\User\AppData\Local\1754111884ee9ab5277ca00.95260103
2015-03-20 23:01 - 2015-03-20 23:01 - 0000600 _____ () C:\Users\User\AppData\Local\PUTTY.RND
2015-06-22 20:17 - 2015-06-22 20:17 - 0000016 _____ () C:\ProgramData\mntemp
Some files in TEMP:
====================
C:\Users\User\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-08-12 00:33
==================== End of log ============================
Ran by User (administrator) on USER-PC (14-08-2015 09:57:00)
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available Profiles: User)
Platform: Windows 7 Ultimate (X64) Language: Português (Brasil)
Internet Explorer Version 9 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(QNT) C:\Users\User\AppData\Roaming\Netlog\Netlog.exe
(QNT) C:\Users\User\AppData\Roaming\NetService\netservice.exe
() C:\Program Files (x86)\Pingzapper\PZService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
(Nota Inc.) C:\Program Files (x86)\Gyazo\GyStation.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [CmPCIaudio] => C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\CMICNFG3.dll,CMICtrlWnd
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6109776 2015-08-04] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKU\S-1-5-21-894723369-241239887-2077736728-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-894723369-241239887-2077736728-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7930136 2015-08-04] (SUPERAntiSpyware)
HKU\S-1-5-21-894723369-241239887-2077736728-1000\...\Run: [Gyazo] => C:\Program Files (x86)\Gyazo\GyStation.exe [3097912 2015-07-22] (Nota Inc.)
HKU\S-1-5-21-894723369-241239887-2077736728-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53288576 2015-06-30] (Skype Technologies S.A.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-08-04] (AVAST Software)
ShellIconOverlayIdentifiers: [BaiduAntivirusIconLock] -> {0A93904A-BB1E-4a0c-9753-B57B9AE272CC} => No File
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-894723369-241239887-2077736728-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.321oyun.com?oem=smtov3&uid=S1RLJ50S476824_SAMSUNGHD322HJ&tm=1438863357
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.321oyun.com?oem=smtov3&uid=S1RLJ50S476824_SAMSUNGHD322HJ&tm=1438863357
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.321oyun.com?oem=smtov3&uid=S1RLJ50S476824_SAMSUNGHD322HJ&tm=1438863357
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.321oyun.com?oem=smtov3&uid=S1RLJ50S476824_SAMSUNGHD322HJ&tm=1438863357
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-894723369-241239887-2077736728-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pt-br/?ocid=iehp
HKU\S-1-5-21-894723369-241239887-2077736728-1000\Software\Microsoft\Internet Explorer\Main,Start Page = www.321oyun.com?oem=smtov3&uid=S1RLJ50S476824_SAMSUNGHD322HJ&tm=1438863357
HKU\S-1-5-21-894723369-241239887-2077736728-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.321oyun.com?oem=smtov3&uid=S1RLJ50S476824_SAMSUNGHD322HJ&tm=1438863357
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-08-04] (AVAST Software)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-26] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-02-08] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-08-04] (AVAST Software)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-08] (Oracle Corporation)
DPF: HKLM-x32 {98FFD412-1A12-4BCE-8AB2-247C78E22227} hxxps://static.ncsoft.jp/js/login/activex/NCLoader.8.cab
DPF: HKLM-x32 {AA07EBD2-EBDD-4BD6-9F8F-114BD513492C} hxxp://dist.cdnetworks.co.jp/cdndist/neffy/NeffyLauncher_v1013.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Winsock: Catalog9 01 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-04-30] (Initex)
Winsock: Catalog9 02 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-04-30] (Initex)
Winsock: Catalog9 03 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-04-30] (Initex)
Winsock: Catalog9 04 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-04-30] (Initex)
Winsock: Catalog9 15 C:\Windows\SysWOW64\WTFastDrv.dll [72296 2015-04-30] (Initex)
Winsock: Catalog9-x64 01 C:\Windows\system32\WTFastDrv.dll [79464 2015-04-30] (Initex)
Winsock: Catalog9-x64 02 C:\Windows\system32\WTFastDrv.dll [79464 2015-04-30] (Initex)
Winsock: Catalog9-x64 03 C:\Windows\system32\WTFastDrv.dll [79464 2015-04-30] (Initex)
Winsock: Catalog9-x64 04 C:\Windows\system32\WTFastDrv.dll [79464 2015-04-30] (Initex)
Winsock: Catalog9-x64 15 C:\Windows\system32\WTFastDrv.dll [79464 2015-04-30] (Initex)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{4AF8E9AE-929A-4EFA-8BED-63964240C12F}: [DhcpNameServer] 192.168.1.1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe www.123rede.com?oem=smtov3&uid=S1RLJ50S476824_SAMSUNGHD322HJ&tm=1429019565
FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\k16rg7rw.default-1437996387708
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-08] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-08] (Oracle Corporation)
FF Plugin-x32: @raidcall.en/RCplugin -> C:\Users\User\AppData\Roaming\raidcall\plugins\nprcplugin.dll [2014-12-23] (Raidcall)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-15] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [No File]
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-894723369-241239887-2077736728-1000: @my.com/Games -> C:\Users\User\AppData\Local\MyComGames\NPMyComDetector.dll [2015-07-15] (My.com, Inc)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\buscape.xml [2014-11-26]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\mercadolivre.xml [2014-11-26]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-08-07]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-12-31]
Chrome:
=======
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-12-31]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-31]
CHR Extension: (Adblock Plus) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-04-06]
CHR Extension: (Google Search) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-31]
CHR Extension: (Avast SafePrice) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2015-01-05]
CHR Extension: (Avast Online Security) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-12-31]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-04-17]
CHR Extension: (Chrome Web Store Payments) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-12-31]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-31]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2015-04-21]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-21]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-07-22] (SUPERAntiSpyware.com)
S2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-11-20] (Advanced Micro Devices, Inc.) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [146600 2015-08-04] (AVAST Software)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 NetLogHandler; C:\Users\User\AppData\Roaming\Netlog\Netlog.exe [167704 2015-06-08] (QNT)
R2 NetTcpHandler; C:\Users\User\AppData\Roaming\NetService\netservice.exe [211824 2015-03-20] (QNT)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3071632 2014-05-06] (INCA Internet Co., Ltd.)
R2 PingzapperSvc; C:\Program Files (x86)\Pingzapper\PZService.exe [679424 2012-06-11] () [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation)
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [28656 2015-08-04] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [90968 2015-08-04] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-08-04] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65224 2015-08-04] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1048344 2015-08-13] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [447944 2015-08-04] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [150672 2015-08-04] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [274808 2015-08-04] (AVAST Software)
R3 cmuda3; C:\Windows\System32\drivers\cmudax3.sys [1029120 2010-08-24] (C-Media Inc)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-08-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S2 AODDriver4.2.0; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]
S3 MUCABRASIL; \??\C:\Program Files (x86)\MUCABRASIL\AntiCheat64.sys [X]
S3 RTHDMIAzAudService; system32\drivers\RtHDMIVX.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-08-14 09:57 - 2015-08-14 09:57 - 00017267 _____ C:\Users\User\Desktop\FRST.txt
2015-08-14 09:56 - 2015-08-14 09:57 - 00000000 ____D C:\FRST
2015-08-14 09:56 - 2015-08-14 09:56 - 02173952 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2015-08-14 09:41 - 2015-08-14 09:46 - 00000000 ____D C:\Users\User\AppData\Roaming\RunDir
2015-08-13 17:18 - 2015-08-13 17:18 - 00001265 _____ C:\Windows\system32\3226 - 1boy 1girl artist_name bag black_hair blush breasts earrings green_eyes hetero high_resolution idolmaster idolmaster_cinderella_girls jewelry kappipe_(brd0520) kiss kneehighs large_filesize .jpg.lnk
2015-08-13 14:40 - 2015-08-13 15:02 - 154986997 _____ C:\Users\User\Desktop\[AnimaKai] Jitsu wa Watashi wa - 6 [480p].mkv
2015-08-13 14:12 - 2015-08-13 14:27 - 108903908 _____ C:\Users\User\Desktop\[AnimaKai] Akagami no Shirayukihime - 06.mp4
2015-08-13 12:57 - 2015-08-13 12:57 - 00023664 _____ C:\ZA-Scan.txt
2015-08-13 12:57 - 2015-08-13 12:56 - 00024213 _____ C:\zoek-results2015-08-13-155604.log
2015-08-13 12:56 - 2015-08-13 12:57 - 00023664 _____ C:\Users\User\Desktop\ZA-Scan.txt
2015-08-13 12:54 - 2015-08-13 12:54 - 00000000 ____D C:\zoek_backup
2015-08-13 12:43 - 2015-08-13 12:44 - 01368576 _____ C:\Users\User\Desktop\ZA-Scan.exe
2015-08-13 12:29 - 2015-08-13 12:29 - 00042444 _____ C:\Users\User\Desktop\MbrScan.log
2015-08-13 12:29 - 2015-08-13 12:29 - 00000512 _____ C:\Users\User\Desktop\Dump_Hdd0_DR0.mbr
2015-08-13 12:28 - 2015-08-13 12:28 - 00147456 _____ (Eric_71) C:\Users\User\Desktop\MbrScan.exe
2015-08-13 11:40 - 2015-08-14 09:40 - 00000868 _____ C:\Windows\PFRO.log
2015-08-13 11:20 - 2015-08-13 11:38 - 00000129 _____ C:\Users\User\Desktop\remoção do trojan.txt
2015-08-13 10:33 - 2015-08-14 09:41 - 00000224 _____ C:\Windows\setupact.log
2015-08-13 10:33 - 2015-08-13 10:33 - 00000000 _____ C:\Windows\setuperr.log
2015-08-13 10:03 - 2015-08-14 09:46 - 00015279 _____ C:\Windows\WindowsUpdate.log
2015-08-08 03:27 - 2015-08-08 03:29 - 00000217 _____ C:\Users\User\Documents\himekano.txt
2015-08-07 14:17 - 2015-08-08 13:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-08-04 16:56 - 2015-08-04 16:56 - 00378880 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2015-08-04 16:56 - 2015-08-04 16:56 - 00043112 _____ (AVAST Software) C:\Windows\avastSS.scr
2015-08-04 15:09 - 2015-08-04 15:09 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-07-27 06:33 - 2015-07-27 06:33 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\1C404606.sys
2015-07-22 17:57 - 2015-07-22 17:57 - 00000000 ____D C:\Users\User\AppData\Local\CEF
2015-07-22 15:50 - 2015-08-14 09:42 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-22 15:50 - 2015-07-22 15:50 - 00000000 ____D C:\Users\Todos os Usuários\Malwarebytes
2015-07-22 15:50 - 2015-07-22 15:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-07-22 15:50 - 2015-07-22 15:50 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-22 15:50 - 2015-07-22 15:50 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-07-22 15:50 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-07-22 15:50 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-07-22 15:50 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-07-22 15:46 - 2015-07-22 15:50 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-2.1.8.1057.exe
2015-07-22 15:43 - 2015-07-22 15:43 - 00000134 _____ C:\Users\User\Downloads\debug.log
2015-07-20 18:39 - 2015-08-01 23:43 - 00001437 _____ C:\Users\User\Desktop\Prime.lnk
2015-07-20 03:35 - 2015-07-20 03:36 - 04309854 _____ C:\Users\User\Downloads\PrimeMuS9.exe.part
2015-07-15 23:25 - 2015-07-16 18:19 - 00000000 ____D C:\MyGames
2015-07-15 23:25 - 2015-07-15 23:25 - 00000000 ____D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\My.com Games
2015-07-15 23:24 - 2015-08-13 10:34 - 00000000 ____D C:\Users\User\AppData\Local\MyComGames
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-08-14 09:56 - 2014-12-31 16:01 - 00000000 ____D C:\Users\User\AppData\Roaming\Skype
2015-08-14 09:51 - 2009-07-14 01:45 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-14 09:51 - 2009-07-14 01:45 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-14 09:41 - 2014-12-31 14:22 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2015-08-14 09:41 - 2014-12-31 14:13 - 00001066 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-08-14 09:41 - 2009-07-14 02:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-14 00:31 - 2015-06-25 19:03 - 00000000 ____D C:\Program Files (x86)\PrimeMu
2015-08-13 23:36 - 2014-12-31 14:13 - 00001070 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-08-13 16:57 - 2014-12-31 14:22 - 01048344 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2015-08-13 16:12 - 2014-12-31 16:55 - 00000000 ____D C:\Program Files (x86)\Steam
2015-08-13 10:03 - 2015-01-16 21:36 - 00000000 ____D C:\Users\User\AppData\Roaming\uTorrent
2015-08-12 15:24 - 2015-01-09 11:50 - 00001094 _____ C:\Windows\Cmicnfg3.ini.imi
2015-08-10 19:51 - 2015-07-04 13:29 - 00000000 ____D C:\Users\User\AppData\Roaming\TS3Client
2015-08-10 14:13 - 2015-03-17 12:46 - 00000000 ____D C:\Users\User\Desktop\Animes - Temporadas Variadas
2015-08-08 19:16 - 2015-01-04 14:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-08-06 09:04 - 2009-07-14 02:08 - 00032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-08-04 20:23 - 2015-07-08 07:05 - 00003402 _____ C:\Windows\System32\Tasks\GyazoUpdateTaskMachineDaily
2015-08-04 20:23 - 2015-01-08 16:03 - 00003276 _____ C:\Windows\System32\Tasks\GyazoUpdateTaskMachine
2015-08-04 20:23 - 2015-01-08 16:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gyazo
2015-08-04 20:23 - 2015-01-08 16:03 - 00000000 ____D C:\Program Files (x86)\Gyazo
2015-08-04 20:02 - 2009-07-14 04:46 - 00000000 __SHD C:\Windows\BitLockerDiscoveryVolumeContents
2015-08-04 16:56 - 2014-12-31 14:22 - 00447944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2015-08-04 16:56 - 2014-12-31 14:22 - 00274808 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2015-08-04 16:56 - 2014-12-31 14:22 - 00150672 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2015-08-04 16:56 - 2014-12-31 14:22 - 00093528 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2015-08-04 16:56 - 2014-12-31 14:22 - 00090968 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-08-04 16:56 - 2014-12-31 14:22 - 00065224 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2015-08-04 16:56 - 2014-12-31 14:22 - 00028656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2015-08-04 15:10 - 2015-01-07 17:54 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-08-04 08:44 - 2015-04-16 10:27 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2015-07-29 18:48 - 2015-05-01 19:02 - 00000000 ____D C:\Users\User\Documents\Bandicam
2015-07-23 20:16 - 2015-01-05 16:38 - 00000000 ____D C:\Windows\Minidump
2015-07-22 16:01 - 2009-07-14 00:20 - 00000000 ____D C:\Windows\Resources
2015-07-22 15:43 - 2014-12-31 14:13 - 00000000 ____D C:\Users\User\AppData\Local\Google
2015-07-20 01:22 - 2015-05-20 08:56 - 00000000 ____D C:\Users\User\Documents\orcsoft
2015-07-15 21:31 - 2014-12-31 14:13 - 00004066 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-07-15 21:31 - 2014-12-31 14:13 - 00003814 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-07-15 12:07 - 2015-03-08 12:28 - 00000000 ____D C:\Users\User\AppData\Local\Battle.net
2015-07-15 11:56 - 2015-03-08 12:27 - 00000000 ____D C:\Program Files (x86)\Battle.net
==================== Files in the root of some directories =======
2015-01-15 13:17 - 2015-01-15 22:52 - 0000132 _____ () C:\Users\User\AppData\Roaming\Adobe PNG Format CS5 Prefs
2015-03-20 22:57 - 2015-03-20 22:57 - 0000038 ___SH () C:\Users\User\AppData\Local\1754111884ee9ab5277ca00.95260103
2015-03-20 23:01 - 2015-03-20 23:01 - 0000600 _____ () C:\Users\User\AppData\Local\PUTTY.RND
2015-06-22 20:17 - 2015-06-22 20:17 - 0000016 _____ () C:\ProgramData\mntemp
Some files in TEMP:
====================
C:\Users\User\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-08-12 00:33
==================== End of log ============================