Publicité
Publicité
Format du document : text/plain
Prévisualisation
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-02-2017
Ran by Anderson (22-02-2017 20:19:05)
Running from C:\Users\Anderson\Downloads
Windows 10 Pro Version 1607 (X64) (2016-12-16 23:28:15)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
adano (S-1-5-21-1298314804-3398324407-510087451-1008 - Limited - Disabled)
Administrator (S-1-5-21-1298314804-3398324407-510087451-500 - Administrator - Disabled)
Anderson (S-1-5-21-1298314804-3398324407-510087451-1001 - Administrator - Enabled) => C:\Users\Anderson
DefaultAccount (S-1-5-21-1298314804-3398324407-510087451-503 - Limited - Disabled)
Guest (S-1-5-21-1298314804-3398324407-510087451-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1298314804-3398324407-510087451-1005 - Limited - Enabled)
iris_ (S-1-5-21-1298314804-3398324407-510087451-1007 - Limited - Disabled)
thale (S-1-5-21-1298314804-3398324407-510087451-1009 - Administrator - Enabled) => C:\Users\thale
thali (S-1-5-21-1298314804-3398324407-510087451-1006 - Limited - Enabled) => C:\Users\thali
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
BlueStacks App Player (HKLM-x32\...\BlueStacks) (Version: 2.5.83.6332 - BlueStack Systems, Inc.)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.4229 - Intel Corporation)
Java 8 Update 121 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180121F0}) (Version: 8.0.1210.13 - Oracle Corporation)
Microsoft Office Professional Plus 2016 - en-us (HKLM\...\ProplusRetail - en-us) (Version: 16.0.7766.2047 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1298314804-3398324407-510087451-1001\...\OneDriveSetup.exe) (Version: 17.3.6743.1212 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Mozilla Firefox 51.0.1 (x86 pt-BR) (HKLM-x32\...\Mozilla Firefox 51.0.1 (x86 pt-BR)) (Version: 51.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 51.0.1.6234 - Mozilla)
Office 16 Click-to-Run Extensibility Component (Version: 16.0.7766.2047 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.7766.2047 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (Version: 16.0.7766.2039 - Microsoft Corporation) Hidden
Traffic Exchange (x32 Version: 2.1.0 - Microleaves) Hidden <==== ATTENTION
VCE Exam Simulator Demo (HKLM-x32\...\VCE Exam Simulator Demo_is1) (Version: - Avanset)
Windows 10 Upgrade Assistant (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.17364 - Microsoft Corporation)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {05889832-8D78-4B18-B9D0-58E7798EE703} - \WPD\SqmUpload_S-1-5-21-1298314804-3398324407-510087451-1001 -> No File <==== ATTENTION
Task: {28A2D3F4-D390-4A08-8582-E046132C5544} - System32\Tasks\Droheseruces Configuration => C:\Program Files (x86)\Witlyanipipy\darerwas.exe [2017-02-21] (Glarysoft Ltd)
Task: {404E9588-0C12-49C7-A450-477099641A2A} - System32\Tasks\Traffic Exchange Guard => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian.exe [2016-08-17] (Microleaves LTD) <==== ATTENTION
Task: {4706A31C-2BCC-4F50-8BA6-A9CCC4873F8D} - System32\Tasks\RunAtStartup => C:\Users\Anderson\AppData\Roaming\Event Monitor\em.exe [2017-01-05] () <==== ATTENTION
Task: {47504286-16CD-4288-B4A3-F0C3FD7C2E4C} - System32\Tasks\Traffic Exchange v2 - 2 => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe [2016-11-22] (Microleaves LTD) <==== ATTENTION
Task: {5C4E35A6-4CDA-4E65-AB12-9CEAA18D6325} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-01-29] (Microsoft Corporation)
Task: {66EC31AD-6B65-4DA7-A157-6E9D7237C7A3} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [2017-02-06] (Microsoft Corporation)
Task: {6D6A2916-BA22-442C-9A9F-975BB2FEA4DA} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [2017-02-06] (Microsoft Corporation)
Task: {73C0B28E-CEDC-4E58-9448-8DEA668BF6AB} - System32\Tasks\Traffic Exchange v2 - 3 => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe [2016-11-22] (Microleaves LTD) <==== ATTENTION
Task: {799CAD14-778B-4213-858F-E948EFE17F03} - System32\Tasks\{753DB872-71B3-4AEC-8614-5524748E3117} => pcalua.exe -a "C:\Program Files (x86)\Common Files\CanNix\uninstall.exe" -c shuz -f "C:\Program Files (x86)\Common Files\CanNix\uninstall.dat" -a uninstallme 8C653626-7EC6-4CC2-A73B-577A9F048933 DeviceId=61363725-0716-4898-1d51-d1e7987ea3e6 BarcodeId=51117003 ChannelId=3 DistributerName=APSFL2Apps
Task: {7F4A4090-7CD4-4C32-B357-3CA7D5D96C02} - System32\Tasks\apqTet5AQU => C:\Program Files (x86)\Jw9pwwRWvo\updengine.exe [2017-02-21] () <==== ATTENTION
Task: {8029FE62-5CAF-4B71-B0AA-AF879AA04BB6} - System32\Tasks\Traffic Exchange v209 - 3 => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe [2017-02-07] (Microleaves LTD) <==== ATTENTION
Task: {878D7FF4-47AA-4049-9E72-BE2F46833D1C} - System32\Tasks\Traffic Exchange Guardian => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian.exe [2016-08-17] (Microleaves LTD) <==== ATTENTION
Task: {932FADB3-4ACD-46F0-BFA5-E33DAEEA78B9} - System32\Tasks\Therlitain => "msiexec" /i hxxp://d2buh1bf1g584w.cloudfront.net/msi/rel.php?u=ST3250318AS_Z2A45TTAXXXXZ2A45TTA&v=2017221 /q
Task: {99110016-56F9-4A79-A061-D8CD62DDA404} - System32\Tasks\Traffic Exchange => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian.exe [2016-08-17] (Microleaves LTD) <==== ATTENTION
Task: {9A77F751-8600-4601-9756-2722712E2617} - System32\Tasks\Traffic Exchange v209 - 1 => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe [2017-02-07] (Microleaves LTD) <==== ATTENTION
Task: {D7A8C95A-B255-4CBA-9EB1-CAA0DA89B55C} - System32\Tasks\Traffic Exchange v209 - 2 => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe [2017-02-07] (Microleaves LTD) <==== ATTENTION
Task: {E31EBD42-E93E-4396-BFF9-E3834A400163} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-01-29] (Microsoft Corporation)
Task: {E6C7D3C5-11CC-45BF-A0EC-95F1D9DF5646} - System32\Tasks\Ittckoherly Core => C:\Program Files (x86)\Plowiseprunoght\jilaward.exe [2017-02-22] (Glarysoft Ltd)
Task: {F61CE123-AB77-40EE-BC89-6B5494572091} - System32\Tasks\Traffic Exchange v2 - 1 => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe [2016-11-22] (Microleaves LTD) <==== ATTENTION
Task: {F90DB8B3-FDF1-4F1D-B022-DABB1F151CD2} - System32\Tasks\Traffic Exchange Updater => C:\Program Files (x86)\Microleaves\Traffic Exchange\Traffic Exchange Updater.exe [2017-02-15] (Microleaves) <==== ATTENTION
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\Traffic Exchange Updater.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\Traffic Exchange Updater.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Traffic Exchange v2 - 1.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Traffic Exchange v2 - 2.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Traffic Exchange v2 - 3.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Traffic Exchange v209 - 1.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Traffic Exchange v209 - 2.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Traffic Exchange v209 - 3.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe <==== ATTENTION
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
ShortcutWithArgument: C:\Users\Anderson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> %SNP%
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> %SNF%
ShortcutWithArgument: C:\Users\Public\Desktop\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> %SNF%
==================== Loaded Modules (Whitelisted) ==============
2016-07-16 08:42 - 2016-07-16 08:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-12-16 22:06 - 2016-12-09 07:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2017-02-21 21:45 - 2017-02-21 21:45 - 00308736 _____ () C:\Program Files (x86)\Droheseruces Configuration\local64spl.dll
2017-02-22 19:44 - 2017-02-23 00:35 - 00043520 _____ () C:\ProgramData\NetworkPacketManitor\Nettrans.exe
2017-02-21 21:45 - 2016-11-10 04:19 - 05091840 _____ () C:\Users\Anderson\AppData\Roaming\WMPNetworkAcSvc\WMPNetworkAcSvc.exe
2017-02-22 19:45 - 2017-02-22 19:37 - 03786752 _____ () C:\ProgramData\Logic Handler\set.exe
2016-12-16 22:06 - 2016-12-09 07:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2017-02-22 19:42 - 2017-01-05 18:45 - 03292608 _____ () C:\Users\Anderson\AppData\Roaming\Event Monitor\em.exe
2016-12-16 22:05 - 2016-09-07 01:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-10 22:16 - 2016-12-21 04:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-01-10 22:15 - 2016-12-21 03:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-10 22:16 - 2016-12-21 03:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-10 22:15 - 2016-12-21 03:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-10 22:15 - 2016-12-21 03:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-10 22:15 - 2016-12-21 03:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-10 22:16 - 2016-12-21 03:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-06-01 20:00 - 2015-06-01 20:00 - 00102912 _____ () C:\Windows\System32\IccLibDll_x64.dll
2017-02-22 20:13 - 2017-02-23 01:03 - 00981504 _____ () C:\ProgramData\AppxelfmuzyaH\AppxelfmuzyaH.exe
2017-02-21 21:45 - 2016-03-06 04:40 - 00083456 _____ () C:\Users\Anderson\AppData\Roaming\WMPNetworkAcSvc\Interface.dll
2017-02-21 05:38 - 2017-02-21 05:38 - 00467456 _____ () C:\Program Files (x86)\Jw9pwwRWvo\kl.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 10:25 - 2017-02-22 19:58 - 00002424 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 cpm.paneladmin.pro
127.0.0.1 publisher.hmdiadmingate.xyz
127.0.0.1 distribution.hmdiadmingate.xyz
127.0.0.1 hmdicrewtracksystem.xyz
127.0.0.1 linkmate.space
127.0.0.1 beautifllink.xyz
127.0.0.1 cpm.paneladmin.pro
127.0.0.1 publisher.hmdiadmingate.xyz
127.0.0.1 distribution.hmdiadmingate.xyz
127.0.0.1 hmdicrewtracksystem.xyz
127.0.0.1 linkmate.space
127.0.0.1 beautifllink.xyz
127.0.0.1 cpm.paneladmin.pro
127.0.0.1 publisher.hmdiadmingate.xyz
127.0.0.1 distribution.hmdiadmingate.xyz
127.0.0.1 hmdicrewtracksystem.xyz
127.0.0.1 linkmate.space
127.0.0.1 beautifllink.xyz
127.0.0.1 cpm.paneladmin.pro
127.0.0.1 publisher.hmdiadmingate.xyz
127.0.0.1 distribution.hmdiadmingate.xyz
127.0.0.1 hmdicrewtracksystem.xyz
127.0.0.1 linkmate.space
127.0.0.1 beautifllink.xyz
127.0.0.1 cpm.paneladmin.pro
127.0.0.1 publisher.hmdiadmingate.xyz
127.0.0.1 distribution.hmdiadmingate.xyz
127.0.0.1 hmdicrewtracksystem.xyz
127.0.0.1 linkmate.space
127.0.0.1 beautifllink.xyz
There are 17 more lines.
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1298314804-3398324407-510087451-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Anderson\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\img0.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is disabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{C6C0DAA9-5F98-4E04-BAE9-8F5C12310D8E}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{6EEA70A5-506B-4963-A842-2E7E0FDB5EB5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{C5142335-D99C-44D6-B74F-7FAD822C0279}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{8DFFB474-99C9-42D5-A7CF-FB62F4F73FED}] => (Allow) C:\Users\thale\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{5222D6C2-E171-4E5B-9EEF-7949AD4426ED}] => (Allow) C:\Users\thale\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{DEE9FB8E-F506-469D-A652-CB9AD1215B7A}] => (Allow) C:\Users\thale\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{73381FF4-A092-4F9E-AC6B-40668E654B32}] => (Allow) C:\Users\thale\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{A1723E4D-E26F-4E72-B829-F29628C71445}] => (Allow) C:\Users\thale\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{F7E12782-8F62-488B-8188-A1AEEC2641DF}] => (Allow) C:\Users\thale\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{80A1F54A-35E2-4C4A-BC24-70F7D439C556}] => (Allow) C:\ProgramData\Microsoft\Network\Dsq\network\sysnetwk.exe
==================== Restore Points =========================
30-01-2017 08:56:57 Ponto de Verificação Agendado
09-02-2017 09:06:56 Windows Update
19-02-2017 10:54:12 Ponto de Verificação Agendado
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/22/2017 08:03:58 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Falha na Ativação de Licença (slui.exe). Código de erro:
hr=0xC004C003
Argumento de linha de comando:
RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=49cd895b-53b2-4dc4-a5f7-b18aa019ad37;NotificationInterval=1440;Trigger=UserLogon;SessionId=1
Error: (02/22/2017 08:03:58 PM) (Source: Software Protection Platform Service) (EventID: 1014) (User: )
Description: Falha na aquisição da Licença de Usuário Final. hr=0xC004C003
Sku Id=49cd895b-53b2-4dc4-a5f7-b18aa019ad37
Error: (02/22/2017 08:03:58 PM) (Source: Software Protection Platform Service) (EventID: 8200) (User: )
Description: Detalhes da falha na aquisição de licença.
hr=0xC004C003
Error: (02/22/2017 08:03:53 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Falha na Ativação de Licença (slui.exe). Código de erro:
hr=0xC004C003
Argumento de linha de comando:
RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=49cd895b-53b2-4dc4-a5f7-b18aa019ad37;NotificationInterval=1440;Trigger=NetworkAvailable
Error: (02/22/2017 08:03:52 PM) (Source: Software Protection Platform Service) (EventID: 1014) (User: )
Description: Falha na aquisição da Licença de Usuário Final. hr=0xC004C003
Sku Id=49cd895b-53b2-4dc4-a5f7-b18aa019ad37
Error: (02/22/2017 08:03:52 PM) (Source: Software Protection Platform Service) (EventID: 8200) (User: )
Description: Detalhes da falha na aquisição de licença.
hr=0xC004C003
Error: (02/22/2017 08:03:50 PM) (Source: Software Protection Platform Service) (EventID: 1014) (User: )
Description: Falha na aquisição da Licença de Usuário Final. hr=0xC004C003
Sku Id=49cd895b-53b2-4dc4-a5f7-b18aa019ad37
Error: (02/22/2017 08:03:50 PM) (Source: Software Protection Platform Service) (EventID: 8200) (User: )
Description: Detalhes da falha na aquisição de licença.
hr=0xC004C003
Error: (02/22/2017 07:49:13 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Falha na Ativação de Licença (slui.exe). Código de erro:
hr=0xC004C003
Argumento de linha de comando:
RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=49cd895b-53b2-4dc4-a5f7-b18aa019ad37;NotificationInterval=1440;Trigger=NetworkAvailable
Error: (02/22/2017 07:49:12 PM) (Source: Software Protection Platform Service) (EventID: 1014) (User: )
Description: Falha na aquisição da Licença de Usuário Final. hr=0xC004C003
Sku Id=49cd895b-53b2-4dc4-a5f7-b18aa019ad37
System errors:
=============
Error: (02/22/2017 08:03:47 PM) (Source: DCOM) (EventID: 10016) (User: AUTORIDADE NT)
Description: As configurações de permissão específico do aplicativo não concedem permissão Local Ativação para o aplicativo de Servidor COM com CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
e APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
ao usuário AUTORIDADE NT\SERVIÇO DE REDE SID (S-1-5-20) do endereço LocalHost (Usando LRPC) que está sendo executado no contêiner de aplicativos Não Disponível SID (Não Disponível). Essa permissão de segurança pode ser modificada com a ferramenta administrativa Serviços de Componentes.
Error: (02/22/2017 08:03:22 PM) (Source: DCOM) (EventID: 10016) (User: AUTORIDADE NT)
Description: As configurações de permissão específico do aplicativo não concedem permissão Local Ativação para o aplicativo de Servidor COM com CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
e APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
ao usuário AUTORIDADE NT\SISTEMA SID (S-1-5-18) do endereço LocalHost (Usando LRPC) que está sendo executado no contêiner de aplicativos Não Disponível SID (Não Disponível). Essa permissão de segurança pode ser modificada com a ferramenta administrativa Serviços de Componentes.
Error: (02/22/2017 08:02:08 PM) (Source: DCOM) (EventID: 10016) (User: AUTORIDADE NT)
Description: As configurações de permissão específico do aplicativo não concedem permissão Local Ativação para o aplicativo de Servidor COM com CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
e APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
ao usuário AUTORIDADE NT\SISTEMA SID (S-1-5-18) do endereço LocalHost (Usando LRPC) que está sendo executado no contêiner de aplicativos Não Disponível SID (Não Disponível). Essa permissão de segurança pode ser modificada com a ferramenta administrativa Serviços de Componentes.
Error: (02/22/2017 07:48:53 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: O serviço Background Logic Handler foi encerrado inesperadamente. Isso aconteceu 1 vez(es).
Error: (02/22/2017 07:47:57 PM) (Source: DCOM) (EventID: 10016) (User: AUTORIDADE NT)
Description: As configurações de permissão específico do aplicativo não concedem permissão Local Ativação para o aplicativo de Servidor COM com CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
e APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
ao usuário AUTORIDADE NT\SISTEMA SID (S-1-5-18) do endereço LocalHost (Usando LRPC) que está sendo executado no contêiner de aplicativos Não Disponível SID (Não Disponível). Essa permissão de segurança pode ser modificada com a ferramenta administrativa Serviços de Componentes.
Error: (02/22/2017 07:46:28 PM) (Source: DCOM) (EventID: 10016) (User: AUTORIDADE NT)
Description: As configurações de permissão específico do aplicativo não concedem permissão Local Ativação para o aplicativo de Servidor COM com CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
e APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
ao usuário AUTORIDADE NT\SISTEMA SID (S-1-5-18) do endereço LocalHost (Usando LRPC) que está sendo executado no contêiner de aplicativos Não Disponível SID (Não Disponível). Essa permissão de segurança pode ser modificada com a ferramenta administrativa Serviços de Componentes.
Error: (02/22/2017 07:45:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: O serviço Hayzumflex foi encerrado inesperadamente. Isso aconteceu 1 vez(es).
Error: (02/22/2017 07:39:42 PM) (Source: DCOM) (EventID: 10016) (User: AUTORIDADE NT)
Description: As configurações de permissão específico do aplicativo não concedem permissão Local Ativação para o aplicativo de Servidor COM com CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
e APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
ao usuário AUTORIDADE NT\SISTEMA SID (S-1-5-18) do endereço LocalHost (Usando LRPC) que está sendo executado no contêiner de aplicativos Não Disponível SID (Não Disponível). Essa permissão de segurança pode ser modificada com a ferramenta administrativa Serviços de Componentes.
Error: (02/22/2017 11:15:10 AM) (Source: DCOM) (EventID: 10016) (User: AUTORIDADE NT)
Description: As configurações de permissão específico do aplicativo não concedem permissão Local Ativação para o aplicativo de Servidor COM com CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
e APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
ao usuário AUTORIDADE NT\SISTEMA SID (S-1-5-18) do endereço LocalHost (Usando LRPC) que está sendo executado no contêiner de aplicativos Não Disponível SID (Não Disponível). Essa permissão de segurança pode ser modificada com a ferramenta administrativa Serviços de Componentes.
Error: (02/22/2017 08:40:43 AM) (Source: DCOM) (EventID: 10016) (User: AUTORIDADE NT)
Description: As configurações de permissão específico do aplicativo não concedem permissão Local Ativação para o aplicativo de Servidor COM com CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
e APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
ao usuário AUTORIDADE NT\SISTEMA SID (S-1-5-18) do endereço LocalHost (Usando LRPC) que está sendo executado no contêiner de aplicativos Não Disponível SID (Não Disponível). Essa permissão de segurança pode ser modificada com a ferramenta administrativa Serviços de Componentes.
CodeIntegrity:
===================================
Date: 2017-02-09 12:26:07.512
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atiumd64.dll that did not meet the Store signing level requirements.
Date: 2017-02-09 12:25:51.291
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atiumd64.dll that did not meet the Store signing level requirements.
Date: 2017-02-08 21:23:15.643
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atiumd64.dll that did not meet the Store signing level requirements.
Date: 2017-02-08 21:23:00.468
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atiumd64.dll that did not meet the Store signing level requirements.
Date: 2017-02-08 17:59:14.346
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atiumd64.dll that did not meet the Store signing level requirements.
Date: 2017-02-08 17:59:14.335
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atiumd64.dll that did not meet the Store signing level requirements.
Date: 2017-02-08 17:59:14.331
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atiumd64.dll that did not meet the Store signing level requirements.
Date: 2017-02-08 17:59:14.329
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atiumd64.dll that did not meet the Store signing level requirements.
Date: 2016-12-16 22:36:24.722
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\aepic.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-12-16 22:36:24.632
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\aepic.dll because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz
Percentage of memory in use: 65%
Total physical RAM: 3977.01 MB
Available physical RAM: 1387.98 MB
Total Virtual: 5769.01 MB
Available Virtual: 2989.7 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:232.05 GB) (Free:187.38 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.8 GB) (Disk ID: FB45F347)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=450 MB) - (Type=27)
==================== End of Addition.txt ============================
Ran by Anderson (22-02-2017 20:19:05)
Running from C:\Users\Anderson\Downloads
Windows 10 Pro Version 1607 (X64) (2016-12-16 23:28:15)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
adano (S-1-5-21-1298314804-3398324407-510087451-1008 - Limited - Disabled)
Administrator (S-1-5-21-1298314804-3398324407-510087451-500 - Administrator - Disabled)
Anderson (S-1-5-21-1298314804-3398324407-510087451-1001 - Administrator - Enabled) => C:\Users\Anderson
DefaultAccount (S-1-5-21-1298314804-3398324407-510087451-503 - Limited - Disabled)
Guest (S-1-5-21-1298314804-3398324407-510087451-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1298314804-3398324407-510087451-1005 - Limited - Enabled)
iris_ (S-1-5-21-1298314804-3398324407-510087451-1007 - Limited - Disabled)
thale (S-1-5-21-1298314804-3398324407-510087451-1009 - Administrator - Enabled) => C:\Users\thale
thali (S-1-5-21-1298314804-3398324407-510087451-1006 - Limited - Enabled) => C:\Users\thali
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
BlueStacks App Player (HKLM-x32\...\BlueStacks) (Version: 2.5.83.6332 - BlueStack Systems, Inc.)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.4229 - Intel Corporation)
Java 8 Update 121 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180121F0}) (Version: 8.0.1210.13 - Oracle Corporation)
Microsoft Office Professional Plus 2016 - en-us (HKLM\...\ProplusRetail - en-us) (Version: 16.0.7766.2047 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1298314804-3398324407-510087451-1001\...\OneDriveSetup.exe) (Version: 17.3.6743.1212 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Mozilla Firefox 51.0.1 (x86 pt-BR) (HKLM-x32\...\Mozilla Firefox 51.0.1 (x86 pt-BR)) (Version: 51.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 51.0.1.6234 - Mozilla)
Office 16 Click-to-Run Extensibility Component (Version: 16.0.7766.2047 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.7766.2047 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (Version: 16.0.7766.2039 - Microsoft Corporation) Hidden
Traffic Exchange (x32 Version: 2.1.0 - Microleaves) Hidden <==== ATTENTION
VCE Exam Simulator Demo (HKLM-x32\...\VCE Exam Simulator Demo_is1) (Version: - Avanset)
Windows 10 Upgrade Assistant (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.17364 - Microsoft Corporation)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {05889832-8D78-4B18-B9D0-58E7798EE703} - \WPD\SqmUpload_S-1-5-21-1298314804-3398324407-510087451-1001 -> No File <==== ATTENTION
Task: {28A2D3F4-D390-4A08-8582-E046132C5544} - System32\Tasks\Droheseruces Configuration => C:\Program Files (x86)\Witlyanipipy\darerwas.exe [2017-02-21] (Glarysoft Ltd)
Task: {404E9588-0C12-49C7-A450-477099641A2A} - System32\Tasks\Traffic Exchange Guard => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian.exe [2016-08-17] (Microleaves LTD) <==== ATTENTION
Task: {4706A31C-2BCC-4F50-8BA6-A9CCC4873F8D} - System32\Tasks\RunAtStartup => C:\Users\Anderson\AppData\Roaming\Event Monitor\em.exe [2017-01-05] () <==== ATTENTION
Task: {47504286-16CD-4288-B4A3-F0C3FD7C2E4C} - System32\Tasks\Traffic Exchange v2 - 2 => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe [2016-11-22] (Microleaves LTD) <==== ATTENTION
Task: {5C4E35A6-4CDA-4E65-AB12-9CEAA18D6325} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-01-29] (Microsoft Corporation)
Task: {66EC31AD-6B65-4DA7-A157-6E9D7237C7A3} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [2017-02-06] (Microsoft Corporation)
Task: {6D6A2916-BA22-442C-9A9F-975BB2FEA4DA} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [2017-02-06] (Microsoft Corporation)
Task: {73C0B28E-CEDC-4E58-9448-8DEA668BF6AB} - System32\Tasks\Traffic Exchange v2 - 3 => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe [2016-11-22] (Microleaves LTD) <==== ATTENTION
Task: {799CAD14-778B-4213-858F-E948EFE17F03} - System32\Tasks\{753DB872-71B3-4AEC-8614-5524748E3117} => pcalua.exe -a "C:\Program Files (x86)\Common Files\CanNix\uninstall.exe" -c shuz -f "C:\Program Files (x86)\Common Files\CanNix\uninstall.dat" -a uninstallme 8C653626-7EC6-4CC2-A73B-577A9F048933 DeviceId=61363725-0716-4898-1d51-d1e7987ea3e6 BarcodeId=51117003 ChannelId=3 DistributerName=APSFL2Apps
Task: {7F4A4090-7CD4-4C32-B357-3CA7D5D96C02} - System32\Tasks\apqTet5AQU => C:\Program Files (x86)\Jw9pwwRWvo\updengine.exe [2017-02-21] () <==== ATTENTION
Task: {8029FE62-5CAF-4B71-B0AA-AF879AA04BB6} - System32\Tasks\Traffic Exchange v209 - 3 => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe [2017-02-07] (Microleaves LTD) <==== ATTENTION
Task: {878D7FF4-47AA-4049-9E72-BE2F46833D1C} - System32\Tasks\Traffic Exchange Guardian => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian.exe [2016-08-17] (Microleaves LTD) <==== ATTENTION
Task: {932FADB3-4ACD-46F0-BFA5-E33DAEEA78B9} - System32\Tasks\Therlitain => "msiexec" /i hxxp://d2buh1bf1g584w.cloudfront.net/msi/rel.php?u=ST3250318AS_Z2A45TTAXXXXZ2A45TTA&v=2017221 /q
Task: {99110016-56F9-4A79-A061-D8CD62DDA404} - System32\Tasks\Traffic Exchange => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian.exe [2016-08-17] (Microleaves LTD) <==== ATTENTION
Task: {9A77F751-8600-4601-9756-2722712E2617} - System32\Tasks\Traffic Exchange v209 - 1 => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe [2017-02-07] (Microleaves LTD) <==== ATTENTION
Task: {D7A8C95A-B255-4CBA-9EB1-CAA0DA89B55C} - System32\Tasks\Traffic Exchange v209 - 2 => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe [2017-02-07] (Microleaves LTD) <==== ATTENTION
Task: {E31EBD42-E93E-4396-BFF9-E3834A400163} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2017-01-29] (Microsoft Corporation)
Task: {E6C7D3C5-11CC-45BF-A0EC-95F1D9DF5646} - System32\Tasks\Ittckoherly Core => C:\Program Files (x86)\Plowiseprunoght\jilaward.exe [2017-02-22] (Glarysoft Ltd)
Task: {F61CE123-AB77-40EE-BC89-6B5494572091} - System32\Tasks\Traffic Exchange v2 - 1 => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe [2016-11-22] (Microleaves LTD) <==== ATTENTION
Task: {F90DB8B3-FDF1-4F1D-B022-DABB1F151CD2} - System32\Tasks\Traffic Exchange Updater => C:\Program Files (x86)\Microleaves\Traffic Exchange\Traffic Exchange Updater.exe [2017-02-15] (Microleaves) <==== ATTENTION
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\WINDOWS\Tasks\Traffic Exchange Updater.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\Traffic Exchange Updater.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Traffic Exchange v2 - 1.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Traffic Exchange v2 - 2.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Traffic Exchange v2 - 3.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Traffic Exchange v209 - 1.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Traffic Exchange v209 - 2.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\Traffic Exchange v209 - 3.job => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe <==== ATTENTION
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)
ShortcutWithArgument: C:\Users\Anderson\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> %SNP%
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> %SNF%
ShortcutWithArgument: C:\Users\Public\Desktop\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> %SNF%
==================== Loaded Modules (Whitelisted) ==============
2016-07-16 08:42 - 2016-07-16 08:42 - 00231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-12-16 22:06 - 2016-12-09 07:29 - 02681200 _____ () C:\WINDOWS\system32\CoreUIComponents.dll
2017-02-21 21:45 - 2017-02-21 21:45 - 00308736 _____ () C:\Program Files (x86)\Droheseruces Configuration\local64spl.dll
2017-02-22 19:44 - 2017-02-23 00:35 - 00043520 _____ () C:\ProgramData\NetworkPacketManitor\Nettrans.exe
2017-02-21 21:45 - 2016-11-10 04:19 - 05091840 _____ () C:\Users\Anderson\AppData\Roaming\WMPNetworkAcSvc\WMPNetworkAcSvc.exe
2017-02-22 19:45 - 2017-02-22 19:37 - 03786752 _____ () C:\ProgramData\Logic Handler\set.exe
2016-12-16 22:06 - 2016-12-09 07:29 - 02681200 _____ () C:\WINDOWS\SYSTEM32\CoreUIComponents.dll
2017-02-22 19:42 - 2017-01-05 18:45 - 03292608 _____ () C:\Users\Anderson\AppData\Roaming\Event Monitor\em.exe
2016-12-16 22:05 - 2016-09-07 01:56 - 00134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2017-01-10 22:16 - 2016-12-21 04:09 - 00474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2017-01-10 22:15 - 2016-12-21 03:54 - 09760768 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2017-01-10 22:16 - 2016-12-21 03:48 - 01401856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2017-01-10 22:15 - 2016-12-21 03:48 - 00757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2017-01-10 22:15 - 2016-12-21 03:48 - 01033216 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Actions.dll
2017-01-10 22:15 - 2016-12-21 03:48 - 02424320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2017-01-10 22:16 - 2016-12-21 03:53 - 04853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2015-06-01 20:00 - 2015-06-01 20:00 - 00102912 _____ () C:\Windows\System32\IccLibDll_x64.dll
2017-02-22 20:13 - 2017-02-23 01:03 - 00981504 _____ () C:\ProgramData\AppxelfmuzyaH\AppxelfmuzyaH.exe
2017-02-21 21:45 - 2016-03-06 04:40 - 00083456 _____ () C:\Users\Anderson\AppData\Roaming\WMPNetworkAcSvc\Interface.dll
2017-02-21 05:38 - 2017-02-21 05:38 - 00467456 _____ () C:\Program Files (x86)\Jw9pwwRWvo\kl.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 10:25 - 2017-02-22 19:58 - 00002424 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 cpm.paneladmin.pro
127.0.0.1 publisher.hmdiadmingate.xyz
127.0.0.1 distribution.hmdiadmingate.xyz
127.0.0.1 hmdicrewtracksystem.xyz
127.0.0.1 linkmate.space
127.0.0.1 beautifllink.xyz
127.0.0.1 cpm.paneladmin.pro
127.0.0.1 publisher.hmdiadmingate.xyz
127.0.0.1 distribution.hmdiadmingate.xyz
127.0.0.1 hmdicrewtracksystem.xyz
127.0.0.1 linkmate.space
127.0.0.1 beautifllink.xyz
127.0.0.1 cpm.paneladmin.pro
127.0.0.1 publisher.hmdiadmingate.xyz
127.0.0.1 distribution.hmdiadmingate.xyz
127.0.0.1 hmdicrewtracksystem.xyz
127.0.0.1 linkmate.space
127.0.0.1 beautifllink.xyz
127.0.0.1 cpm.paneladmin.pro
127.0.0.1 publisher.hmdiadmingate.xyz
127.0.0.1 distribution.hmdiadmingate.xyz
127.0.0.1 hmdicrewtracksystem.xyz
127.0.0.1 linkmate.space
127.0.0.1 beautifllink.xyz
127.0.0.1 cpm.paneladmin.pro
127.0.0.1 publisher.hmdiadmingate.xyz
127.0.0.1 distribution.hmdiadmingate.xyz
127.0.0.1 hmdicrewtracksystem.xyz
127.0.0.1 linkmate.space
127.0.0.1 beautifllink.xyz
There are 17 more lines.
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1298314804-3398324407-510087451-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Anderson\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\img0.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is disabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{C6C0DAA9-5F98-4E04-BAE9-8F5C12310D8E}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{6EEA70A5-506B-4963-A842-2E7E0FDB5EB5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{C5142335-D99C-44D6-B74F-7FAD822C0279}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{8DFFB474-99C9-42D5-A7CF-FB62F4F73FED}] => (Allow) C:\Users\thale\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{5222D6C2-E171-4E5B-9EEF-7949AD4426ED}] => (Allow) C:\Users\thale\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{DEE9FB8E-F506-469D-A652-CB9AD1215B7A}] => (Allow) C:\Users\thale\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{73381FF4-A092-4F9E-AC6B-40668E654B32}] => (Allow) C:\Users\thale\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{A1723E4D-E26F-4E72-B829-F29628C71445}] => (Allow) C:\Users\thale\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{F7E12782-8F62-488B-8188-A1AEEC2641DF}] => (Allow) C:\Users\thale\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{80A1F54A-35E2-4C4A-BC24-70F7D439C556}] => (Allow) C:\ProgramData\Microsoft\Network\Dsq\network\sysnetwk.exe
==================== Restore Points =========================
30-01-2017 08:56:57 Ponto de Verificação Agendado
09-02-2017 09:06:56 Windows Update
19-02-2017 10:54:12 Ponto de Verificação Agendado
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/22/2017 08:03:58 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Falha na Ativação de Licença (slui.exe). Código de erro:
hr=0xC004C003
Argumento de linha de comando:
RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=49cd895b-53b2-4dc4-a5f7-b18aa019ad37;NotificationInterval=1440;Trigger=UserLogon;SessionId=1
Error: (02/22/2017 08:03:58 PM) (Source: Software Protection Platform Service) (EventID: 1014) (User: )
Description: Falha na aquisição da Licença de Usuário Final. hr=0xC004C003
Sku Id=49cd895b-53b2-4dc4-a5f7-b18aa019ad37
Error: (02/22/2017 08:03:58 PM) (Source: Software Protection Platform Service) (EventID: 8200) (User: )
Description: Detalhes da falha na aquisição de licença.
hr=0xC004C003
Error: (02/22/2017 08:03:53 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Falha na Ativação de Licença (slui.exe). Código de erro:
hr=0xC004C003
Argumento de linha de comando:
RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=49cd895b-53b2-4dc4-a5f7-b18aa019ad37;NotificationInterval=1440;Trigger=NetworkAvailable
Error: (02/22/2017 08:03:52 PM) (Source: Software Protection Platform Service) (EventID: 1014) (User: )
Description: Falha na aquisição da Licença de Usuário Final. hr=0xC004C003
Sku Id=49cd895b-53b2-4dc4-a5f7-b18aa019ad37
Error: (02/22/2017 08:03:52 PM) (Source: Software Protection Platform Service) (EventID: 8200) (User: )
Description: Detalhes da falha na aquisição de licença.
hr=0xC004C003
Error: (02/22/2017 08:03:50 PM) (Source: Software Protection Platform Service) (EventID: 1014) (User: )
Description: Falha na aquisição da Licença de Usuário Final. hr=0xC004C003
Sku Id=49cd895b-53b2-4dc4-a5f7-b18aa019ad37
Error: (02/22/2017 08:03:50 PM) (Source: Software Protection Platform Service) (EventID: 8200) (User: )
Description: Detalhes da falha na aquisição de licença.
hr=0xC004C003
Error: (02/22/2017 07:49:13 PM) (Source: Software Protection Platform Service) (EventID: 8198) (User: )
Description: Falha na Ativação de Licença (slui.exe). Código de erro:
hr=0xC004C003
Argumento de linha de comando:
RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=49cd895b-53b2-4dc4-a5f7-b18aa019ad37;NotificationInterval=1440;Trigger=NetworkAvailable
Error: (02/22/2017 07:49:12 PM) (Source: Software Protection Platform Service) (EventID: 1014) (User: )
Description: Falha na aquisição da Licença de Usuário Final. hr=0xC004C003
Sku Id=49cd895b-53b2-4dc4-a5f7-b18aa019ad37
System errors:
=============
Error: (02/22/2017 08:03:47 PM) (Source: DCOM) (EventID: 10016) (User: AUTORIDADE NT)
Description: As configurações de permissão específico do aplicativo não concedem permissão Local Ativação para o aplicativo de Servidor COM com CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
e APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
ao usuário AUTORIDADE NT\SERVIÇO DE REDE SID (S-1-5-20) do endereço LocalHost (Usando LRPC) que está sendo executado no contêiner de aplicativos Não Disponível SID (Não Disponível). Essa permissão de segurança pode ser modificada com a ferramenta administrativa Serviços de Componentes.
Error: (02/22/2017 08:03:22 PM) (Source: DCOM) (EventID: 10016) (User: AUTORIDADE NT)
Description: As configurações de permissão específico do aplicativo não concedem permissão Local Ativação para o aplicativo de Servidor COM com CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
e APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
ao usuário AUTORIDADE NT\SISTEMA SID (S-1-5-18) do endereço LocalHost (Usando LRPC) que está sendo executado no contêiner de aplicativos Não Disponível SID (Não Disponível). Essa permissão de segurança pode ser modificada com a ferramenta administrativa Serviços de Componentes.
Error: (02/22/2017 08:02:08 PM) (Source: DCOM) (EventID: 10016) (User: AUTORIDADE NT)
Description: As configurações de permissão específico do aplicativo não concedem permissão Local Ativação para o aplicativo de Servidor COM com CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
e APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
ao usuário AUTORIDADE NT\SISTEMA SID (S-1-5-18) do endereço LocalHost (Usando LRPC) que está sendo executado no contêiner de aplicativos Não Disponível SID (Não Disponível). Essa permissão de segurança pode ser modificada com a ferramenta administrativa Serviços de Componentes.
Error: (02/22/2017 07:48:53 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: O serviço Background Logic Handler foi encerrado inesperadamente. Isso aconteceu 1 vez(es).
Error: (02/22/2017 07:47:57 PM) (Source: DCOM) (EventID: 10016) (User: AUTORIDADE NT)
Description: As configurações de permissão específico do aplicativo não concedem permissão Local Ativação para o aplicativo de Servidor COM com CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
e APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
ao usuário AUTORIDADE NT\SISTEMA SID (S-1-5-18) do endereço LocalHost (Usando LRPC) que está sendo executado no contêiner de aplicativos Não Disponível SID (Não Disponível). Essa permissão de segurança pode ser modificada com a ferramenta administrativa Serviços de Componentes.
Error: (02/22/2017 07:46:28 PM) (Source: DCOM) (EventID: 10016) (User: AUTORIDADE NT)
Description: As configurações de permissão específico do aplicativo não concedem permissão Local Ativação para o aplicativo de Servidor COM com CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
e APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
ao usuário AUTORIDADE NT\SISTEMA SID (S-1-5-18) do endereço LocalHost (Usando LRPC) que está sendo executado no contêiner de aplicativos Não Disponível SID (Não Disponível). Essa permissão de segurança pode ser modificada com a ferramenta administrativa Serviços de Componentes.
Error: (02/22/2017 07:45:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: O serviço Hayzumflex foi encerrado inesperadamente. Isso aconteceu 1 vez(es).
Error: (02/22/2017 07:39:42 PM) (Source: DCOM) (EventID: 10016) (User: AUTORIDADE NT)
Description: As configurações de permissão específico do aplicativo não concedem permissão Local Ativação para o aplicativo de Servidor COM com CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
e APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
ao usuário AUTORIDADE NT\SISTEMA SID (S-1-5-18) do endereço LocalHost (Usando LRPC) que está sendo executado no contêiner de aplicativos Não Disponível SID (Não Disponível). Essa permissão de segurança pode ser modificada com a ferramenta administrativa Serviços de Componentes.
Error: (02/22/2017 11:15:10 AM) (Source: DCOM) (EventID: 10016) (User: AUTORIDADE NT)
Description: As configurações de permissão específico do aplicativo não concedem permissão Local Ativação para o aplicativo de Servidor COM com CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
e APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
ao usuário AUTORIDADE NT\SISTEMA SID (S-1-5-18) do endereço LocalHost (Usando LRPC) que está sendo executado no contêiner de aplicativos Não Disponível SID (Não Disponível). Essa permissão de segurança pode ser modificada com a ferramenta administrativa Serviços de Componentes.
Error: (02/22/2017 08:40:43 AM) (Source: DCOM) (EventID: 10016) (User: AUTORIDADE NT)
Description: As configurações de permissão específico do aplicativo não concedem permissão Local Ativação para o aplicativo de Servidor COM com CLSID
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
e APPID
{F72671A9-012C-4725-9D2F-2A4D32D65169}
ao usuário AUTORIDADE NT\SISTEMA SID (S-1-5-18) do endereço LocalHost (Usando LRPC) que está sendo executado no contêiner de aplicativos Não Disponível SID (Não Disponível). Essa permissão de segurança pode ser modificada com a ferramenta administrativa Serviços de Componentes.
CodeIntegrity:
===================================
Date: 2017-02-09 12:26:07.512
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atiumd64.dll that did not meet the Store signing level requirements.
Date: 2017-02-09 12:25:51.291
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atiumd64.dll that did not meet the Store signing level requirements.
Date: 2017-02-08 21:23:15.643
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atiumd64.dll that did not meet the Store signing level requirements.
Date: 2017-02-08 21:23:00.468
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atiumd64.dll that did not meet the Store signing level requirements.
Date: 2017-02-08 17:59:14.346
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atiumd64.dll that did not meet the Store signing level requirements.
Date: 2017-02-08 17:59:14.335
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atiumd64.dll that did not meet the Store signing level requirements.
Date: 2017-02-08 17:59:14.331
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atiumd64.dll that did not meet the Store signing level requirements.
Date: 2017-02-08 17:59:14.329
Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume2\Windows\System32\atiumd64.dll that did not meet the Store signing level requirements.
Date: 2016-12-16 22:36:24.722
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\aepic.dll because the set of per-page image hashes could not be found on the system.
Date: 2016-12-16 22:36:24.632
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\aepic.dll because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz
Percentage of memory in use: 65%
Total physical RAM: 3977.01 MB
Available physical RAM: 1387.98 MB
Total Virtual: 5769.01 MB
Available Virtual: 2989.7 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:232.05 GB) (Free:187.38 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.8 GB) (Disk ID: FB45F347)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=450 MB) - (Type=27)
==================== End of Addition.txt ============================