Publicité
Publicité
Format du document : text/plain
Prévisualisation
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-03-2017
Ran by l (administrator) on L-PC (21-03-2017 20:55:06)
Running from C:\Users\l\Desktop
Loaded Profiles: l (Available Profiles: l)
Platform: Windows 7 Home Premium (X64) Language: Português (Portugal)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe
(GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe
(PSafe Total) C:\Program Files (x86)\PSafe\Total\safemon\QHActiveDefense.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Qihu Software Co. Limited) C:\Program Files (x86)\PSafe\Total\safemon\QHWatchdog.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
(ASUS) C:\Program Files\P4G\BatteryLife.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
() C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(syncables, LLC) C:\Program Files (x86)\syncables\syncables desktop\syncables.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\syncables\syncables desktop\jre\bin\javaw.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(PSafe Total) C:\Program Files (x86)\PSafe\Total\safemon\QHSafeTray.exe
() C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Filseclab Corporation Limited) C:\Program Files (x86)\ScreenShot\SSSvc.exe
(GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Electronic Arts) C:\Program Files (x86)\Origin\OriginWebHelperService.exe
() C:\Program Files (x86)\Origin\QtWebEngineProcess.exe
() C:\Program Files (x86)\Origin\QtWebEngineProcess.exe
(Electronic Arts) C:\Program Files (x86)\Origin\OriginClientService.exe
(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\PSafe\Total\PatchUp.exe
(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\PSafe\Total\360TsLiveUpd.exe
(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\PSafe\Total\360TsLiveUpd.exe
(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\PSafe\Total\360TsLiveUpd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe
(Igor Pavlov) C:\Users\l\Desktop\xpadder_gamepad_profiler.exe
() C:\Users\l\Desktop\xpadder_gamepad_profiler\Xpadder.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(BitTorrent Inc.) C:\Users\l\AppData\Roaming\uTorrent\uTorrent.exe
(BitTorrent Inc.) C:\Users\l\AppData\Roaming\uTorrent\updates\3.4.9_43388\utorrentie.exe
(BitTorrent Inc.) C:\Users\l\AppData\Roaming\uTorrent\updates\3.4.9_43388\utorrentie.exe
(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\PSafe\Total\360TsLiveUpd.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\osk.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [ASUS WebStorage] => C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [1754448 2010-03-15] ()
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2014-10-08] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2587944 2010-12-13] (ELAN Microelectronics Corp.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-12] (NVIDIA Corporation)
HKLM\...\Run: [Diebold - Warsaw] => C:\Program Files\Diebold\Warsaw\core.exe [927280 2016-11-11] (GAS Tecnologia LTDA)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [617120 2011-03-13] (Atheros Commnucations)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379552 2011-03-13] (Atheros Commnucations)
HKLM\...\Run: [IntelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-05-02] (Intel(R) Corporation)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2776528 2016-12-14] (Malwarebytes)
HKLM-x32\...\Run: [Nuance PDF Reader-reminder] => "C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini"
HKLM-x32\...\Run: [SonicMasterTray] => C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-09] (Virage Logic Corporation / Sonic Focus)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5732992 2010-08-17] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [904824 2015-08-19] (BlueStack Systems, Inc.)
HKLM-x32\...\Run: [QHSafeTray] => C:\Program Files (x86)\PSafe\Total\safemon\QHSafeTray.exe [1959744 2017-01-16] (PSafe Total)
HKLM-x32\...\Run: [ProductUpdater] => C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe [75776 2017-01-09] ()
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\ GbPluginBb: C:\Program Files (x86)\GbPlugin\gbieh.dll [2016-06-21] (Banco do Brasil)
Winlogon\Notify\ GbPluginCef: C:\Program Files (x86)\GbPlugin\gbiehCef.dll [2016-12-12] (Caixa Economica Federal)
Winlogon\Notify\ GbPluginUni: C:\Program Files (x86)\GbPlugin\gbiehUni.dll [2016-12-12] (Banco Itaú Unibanco)
HKU\S-1-5-21-75050290-1511656157-1570779026-1000\...\Run: [Syncables] => C:\Program Files (x86)\syncables\syncables desktop\Syncables.exe [370480 2010-07-19] (syncables, LLC)
HKU\S-1-5-21-75050290-1511656157-1570779026-1000\...\Run: [ares] => C:\Program Files (x86)\Ares\Ares.exe [2758656 2014-08-16] (Seekar Ltd)
HKU\S-1-5-21-75050290-1511656157-1570779026-1000\...\Run: [Chromium] => c:\users\l\appdata\local\chromium\application\chrome.exe [1068544 2016-03-18] (The Chromium Authors)
HKU\S-1-5-21-75050290-1511656157-1570779026-1000\...\Run: [uTorrent] => C:\Users\l\AppData\Roaming\uTorrent\uTorrent.exe [2147520 2017-03-17] (BitTorrent Inc.)
HKU\S-1-5-21-75050290-1511656157-1570779026-1000\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4468056 2015-06-18] (Disc Soft Ltd)
HKU\S-1-5-21-75050290-1511656157-1570779026-1000\...\MountPoints2: {24b83305-f52c-11e6-b3cb-14dae9020568} - F:\Setup.exe
HKU\S-1-5-21-75050290-1511656157-1570779026-1000\...\MountPoints2: {7c598518-7857-11e6-b6f8-c0fe6b30ac71} - G:\Startme.exe
HKU\S-1-5-18\...\Run: [Advanced SystemCare 9] => C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe [2022688 2016-04-26] (IObit)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [174856 2014-09-13] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [156840 2014-09-13] (NVIDIA Corporation)
ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399008} - C:\PROGRAM FILES (X86)\GbPlugin\gbiehuni.dll [1951968 2016-12-12] (Banco Itaú Unibanco)
ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\PROGRAM FILES (X86)\GbPlugin\gbieh.dll [1947872 2016-06-21] (Banco do Brasil)
ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399003} - C:\PROGRAM FILES (X86)\GbPlugin\gbiehcef.dll [1903328 2016-12-12] (Caixa Economica Federal)
ShellIconOverlayIdentifiers: [AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\ASUS WebStorage\service\AsusWSShellExt64.dll [2009-11-26] (eCareme Technologies, Inc.)
ShellIconOverlayIdentifiers: [AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\ASUS WebStorage\service\AsusWSShellExt64.dll [2009-11-26] (eCareme Technologies, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AsusVibeLauncher.lnk [2011-01-12]
ShortcutTarget: AsusVibeLauncher.lnk -> C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FancyStart daemon.lnk [2014-08-01]
ShortcutTarget: FancyStart daemon.lnk -> C:\Windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe ()
GroupPolicy: Restriction <======= ATTENTION
GroupPolicy\User: Restriction <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: 127.0.0.1 live.virtualdj.com
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{3125EA83-A355-4547-B477-9A05C12237F6}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{3125EA83-A355-4547-B477-9A05C12237F6}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{6402F980-A491-487B-8AF5-72E035428C3F}: [DhcpNameServer] 192.168.1.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKU\S-1-5-21-75050290-1511656157-1570779026-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wcg_fremkfs_17_03¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzzzytBzy0CtDzy0E0DyCzytAyCtB0DtN0D0Tzu0StCzzyEyBtN1L2XzutAtFtByDtFtCtFtCtDzztN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2SyByDzztA0AyEyEyBtGyB0F0D0BtGyBzz0CyDtGyDtD0D0BtGyEyB0BtByB0E0D0C0FyEzztC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyByC0EtB0B0EzyyBtG0A0A0FyCtGyEyC0E0AtGzyzztA0BtGyByEyCtD0CtBtBtDtCtByByD2QtN0A0LzutB%26cr%3D1663193140%26a%3Dwcg_fremkfs_17_03%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM -> {460C3D19-B3D4-4964-A550-77D263B0CCCB} URL = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wcg_fremkfs_17_03¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzzzytBzy0CtDzy0E0DyCzytAyCtB0DtN0D0Tzu0StCzzyEyBtN1L2XzutAtFtByDtFtCtFtCtDzztN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2SyByDzztA0AyEyEyBtGyB0F0D0BtGyBzz0CyDtGyDtD0D0BtGyEyB0BtByB0E0D0C0FyEzztC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyByC0EtB0B0EzyyBtG0A0A0FyCtGyEyC0E0AtGzyzztA0BtGyByEyCtD0CtBtBtDtCtByByD2QtN0A0LzutB%26cr%3D1663193140%26a%3Dwcg_fremkfs_17_03%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
SearchScopes: HKU\S-1-5-21-75050290-1511656157-1570779026-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.iminent.com/?appId=CBD88235-B775-4523-8BFC-066E21F343C2&ref=toolbox&q={searchTerms}
SearchScopes: HKU\S-1-5-21-75050290-1511656157-1570779026-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.iminent.com/?appId=CBD88235-B775-4523-8BFC-066E21F343C2&ref=toolbox&q={searchTerms}
SearchScopes: HKU\S-1-5-21-75050290-1511656157-1570779026-1000 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxp://search.iminent.com/?appId=CBD88235-B775-4523-8BFC-066E21F343C2&ref=toolbox&q={searchTerms}
SearchScopes: HKU\S-1-5-21-75050290-1511656157-1570779026-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL =
SearchScopes: HKU\S-1-5-21-75050290-1511656157-1570779026-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll [2015-11-12] (IObit)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: SafeMon Class -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> C:\Program Files (x86)\PSafe\Total\safemon\safemon64.dll [2017-01-16] (Qihu 360 Software Co., Ltd.)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2013-08-14] (RealDownloader)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2011-03-13] (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2010-09-23] (Microsoft Corporation)
BHO-x32: Advanced SystemCare Surfing Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files (x86)\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll [2015-07-09] (IObit)
BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540000} -> C:\PROGRAM FILES (X86)\GBPLUGIN\gbieh.dll [2016-06-21] (Banco do Brasil)
BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540003} -> C:\PROGRAM FILES (X86)\GBPLUGIN\gbiehcef.dll [2016-12-12] (Caixa Economica Federal)
BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540008} -> C:\PROGRAM FILES (X86)\GBPLUGIN\gbiehuni.dll [2016-12-12] (Banco Itaú Unibanco)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2013-03-02] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2013-03-02] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2013-03-02] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2013-03-02] (Microsoft Corporation)
FireFox:
========
FF DefaultProfile:
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: (RealDownloader) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-09-15] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32.dll [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-09-23] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-09-13] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-09-13] (NVIDIA Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll [2014-09-15] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2013-08-14] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2013-08-14] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2013-08-14] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll [2014-09-15] (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2013-08-14] (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: ZEON/PDF,version=2.0 -> C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll [2010-01-23] (Zeon Corporation)
FF Plugin HKU\S-1-5-21-75050290-1511656157-1570779026-1000: gastecnologia.com.br/sf/uni -> C:\Users\l\AppData\Local\GAS Tecnologia\GBBD\npsf_uni.dll [2014-07-15] (GAS Tecnologia)
Chrome:
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://start.iminent.com/__PARAM__
CHR DefaultSearchURL: Default -> hxxp://search.iminent.com/?appId=CBD88235-B775-4523-8BFC-066E21F343C2&ref=toolbox&q={searchTerms}
CHR DefaultSearchKeyword: Default -> search.iminent.com
CHR Profile: C:\Users\l\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2016-12-17] <==== ATTENTION
CHR Profile: C:\Users\l\AppData\Local\Google\Chrome\User Data\Default [2017-03-21]
CHR Extension: (Google Drive) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-13]
CHR Extension: (YouTube) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-26]
CHR Extension: (Google Search) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-13]
CHR Extension: (GBBD Guardião - Itaú 30 horas) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\kgmpojlddncminmkddkpoegdjhojjipg [2014-08-28]
CHR Extension: (Pagamentos via Chrome Web Store) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-13]
CHR Extension: (Gmail) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-09-05]
CHR Extension: (Chrome Media Router) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-14]
CHR HKLM\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-75050290-1511656157-1570779026-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdvancedSystemCareService9; C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe [446240 2016-01-05] (IObit)
S4 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
S4 ASNB4LDRSvc; C:\Program Files (x86)\ASUS\Wireless Console 3\ASNB4LDRSvc.exe [31864 2013-11-15] ()
S4 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-03-13] (Atheros) [File not signed]
S4 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [74912 2011-03-13] (Atheros Commnucations) [File not signed]
S4 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [437880 2015-08-19] (BlueStack Systems, Inc.)
S4 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [413304 2015-08-19] (BlueStack Systems, Inc.)
S4 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [839288 2015-08-19] (BlueStack Systems, Inc.)
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1268568 2015-06-18] (Disc Soft Ltd)
R2 GbpSv; C:\Program Files (x86)\GbPlugin\gbpsv.exe [631520 2017-02-17] (GAS Tecnologia)
S4 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-12] (NVIDIA Corporation)
S3 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2960672 2016-06-14] (IObit)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4317648 2016-11-29] (Malwarebytes)
S4 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-05-02] ()
S4 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-12] (NVIDIA Corporation)
S4 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-12] (NVIDIA Corporation)
S4 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2122248 2017-02-17] (Electronic Arts)
R2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [2184208 2017-02-17] (Electronic Arts)
R2 QHActiveDefense; C:\Program Files (x86)\PSafe\Total\safemon\QHActiveDefense.exe [858432 2017-01-16] (PSafe Total)
S4 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
S4 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2009-10-20] (CACE Technologies, Inc.)
R2 SSSvc; C:\Program Files (x86)\ScreenShot\SSSvc.exe [139744 2016-11-02] (Filseclab Corporation Limited)
R2 Warsaw Technology; C:\Program Files\Diebold\Warsaw\core.exe [927280 2016-11-11] (GAS Tecnologia LTDA)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation)
S4 wsaudio; C:\Windows\SysWOW64\wsaudio.dll [367104 2013-01-04] () [File not signed]
S4 ihctrl32; %SystemRoot%\System32\ihctrl32.dll [X]
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 360AntiHacker; C:\Windows\System32\Drivers\360AntiHacker64.sys [137808 2016-02-29] (360.cn)
R3 360AvFlt; C:\Windows\System32\DRIVERS\360AvFlt.sys [77904 2017-01-16] (360.cn)
R1 360Box64; C:\Windows\System32\DRIVERS\360Box64.sys [319568 2017-01-16] (360.cn)
S3 360Camera; C:\Windows\System32\Drivers\360Camera64.sys [40520 2016-02-29] (360.cn)
R1 360FsFlt; C:\Windows\System32\DRIVERS\360FsFlt.sys [363088 2016-02-29] (360.cn)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R1 ATKWMIACPIIO_; C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [17024 2010-07-26] (ASUS)
R1 BAPIDRV; C:\Windows\System32\DRIVERS\BAPIDRV64.sys [178776 2016-02-29] (Qihu 360 Software Co., Ltd.)
S2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [146040 2015-08-19] (BlueStack Systems)
R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2017-02-22] (Disc Soft Ltd)
R1 gbpddfac; C:\Windows\System32\drivers\gbpddfac64.sys [28888 2017-03-21] (GAS Tecnologia)
R1 gbpddfac; C:\Windows\SysWOW64\drivers\gbpddfac64.sys [28888 2015-08-12] (GAS Tecnologia)
R3 GBPRCM; C:\Program Files (x86)\GbPlugin\gbprcm64.sys [29912 2015-08-12] (GAS Tecnologia)
S3 hid7906; C:\Windows\SysWOW64\drivers\hid7906.sys [34963 2007-12-12] (Compuware Corporation) [File not signed]
S3 hid8101; C:\Windows\SysWOW64\drivers\hid8101.sys [37024 2007-12-03] (Compuware Corporation) [File not signed]
S3 hid8103; C:\Windows\SysWOW64\drivers\hid8103.sys [34587 2007-11-28] (Compuware Corporation) [File not signed]
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-09-09] (REALiX(tm))
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [42944 2010-07-28] (hxxp://libusb-win32.sourceforge.net)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [251840 2017-03-14] (Malwarebytes)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [100312 2014-10-08] (Intel Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [47632 2009-10-20] (CACE Technologies, Inc.)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-12] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [871408 2014-12-17] () [File not signed]
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13832 2010-04-16] ()
R3 Warsaw_PP; C:\Program Files (x86)\GbPlugin\wsftprp64.sys [24792 2015-08-12] (GAS Tecnologia LTDA)
R1 wsddfac; C:\Windows\System32\drivers\wsddfac.sys [28376 2017-02-17] (GAS Tecnologia)
R1 wsddntf; C:\Windows\System32\DRIVERS\wsddntf.sys [36984 2016-06-16] (GAS Tecnologia)
S1 wsddpp; C:\Windows\system32\drivers\wsddpp.sys [25184 2016-11-11] (GAS Tecnologia)
S3 wsddprm; C:\Windows\system32\drivers\wsddprm.sys [25184 2016-11-11] (GAS Tecnologia)
S0 gbpddreg; system32\drivers\gbpddreg64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Three Months Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-03-21 20:48 - 2017-03-21 20:52 - 00055711 _____ C:\Users\l\Desktop\Addition.txt
2017-03-21 20:45 - 2017-03-21 20:55 - 00029266 _____ C:\Users\l\Desktop\FRST.txt
2017-03-21 20:44 - 2017-03-21 20:55 - 00000000 ____D C:\FRST
2017-03-21 20:42 - 2017-03-21 20:42 - 02424832 _____ (Farbar) C:\Users\l\Desktop\FRST64.exe
2017-03-21 20:36 - 2017-03-21 20:38 - 00000000 ____D C:\Program Files (x86)\PCSX2 1.4.0
2017-03-21 20:36 - 2017-03-21 20:36 - 00001941 _____ C:\Users\Public\Desktop\PCSX2 1.4.0.lnk
2017-03-21 20:36 - 2017-03-21 20:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PCSX2
2017-03-21 20:35 - 2017-03-21 20:35 - 17837152 _____ C:\Users\l\Downloads\pcsx21-4-0.exe
2017-03-17 17:46 - 2017-03-17 17:46 - 00000000 ____D C:\Users\l\AppData\LocalLow\uTorrent
2017-03-13 21:16 - 2017-03-13 21:16 - 01160473 _____ C:\Users\l\Downloads\Fotos (1).zip
2017-03-13 18:52 - 2017-03-13 18:53 - 00000072 _____ C:\Users\l\Desktop\controle 64.jsf
2017-03-13 18:02 - 1997-08-22 05:01 - 16777216 _____ C:\Users\l\Desktop\GoldenEye_007_(U)_[o1].v64
2017-03-13 18:01 - 2017-03-13 18:04 - 00000000 ____D C:\Users\l\Desktop\Project64 1.6
2017-03-13 18:00 - 2017-03-13 18:01 - 10952444 _____ C:\Users\l\Downloads\007 N64 (1997).7z
2017-03-13 17:59 - 2017-03-13 17:59 - 01677234 _____ C:\Users\l\Downloads\Project64 1.6.rar
2017-02-24 19:10 - 2017-02-24 19:10 - 00003050 _____ C:\Windows\System32\Tasks\{2C0A4F8D-F9AC-46A4-A1ED-2100EC3A391F}
2017-02-24 19:07 - 2017-02-24 19:07 - 07190453 _____ C:\Users\l\Downloads\UNIWS Tutorial by TrevelXP.zip
2017-02-22 14:30 - 2017-02-22 14:30 - 00002960 _____ C:\Windows\System32\Tasks\{EB5023AF-5B30-4E37-9EC8-557B066CA145}
2017-02-22 14:28 - 2009-01-19 16:38 - 39013721 _____ (Igor Pavlov) C:\Users\l\Desktop\xpadder_gamepad_profiler.exe
2017-02-22 14:28 - 2008-10-15 06:09 - 00000000 ____D C:\Users\l\Desktop\xpadder_gamepad_profiler
2017-02-22 14:25 - 2017-02-22 14:27 - 38987820 _____ C:\Users\l\Downloads\xpadder_gamepad Fulldowngames.rar
2017-02-22 14:23 - 2017-02-22 14:23 - 00932864 _____ C:\Users\l\Desktop\Xpadder.exe
2017-02-22 14:10 - 2017-02-22 14:10 - 00000000 ____D C:\Users\l\AppData\Local\Disc_Soft_Ltd
2017-02-22 14:07 - 2006-01-19 21:00 - 01011712 _____ (nfsu2@spoofer.de) C:\Users\l\Desktop\NFSU2-ProfileCreator.exe
2017-02-22 14:02 - 2017-02-24 21:57 - 00000000 ____D C:\Users\l\AppData\Local\NFS Underground 2
2017-02-22 13:56 - 2015-07-05 14:46 - 00000000 ____D C:\Users\l\Desktop\BMGT - NFSU2 Tradução PT-BR + DirectX
2017-02-22 13:55 - 2017-02-22 14:02 - 00000000 ____D C:\Users\l\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2017-02-22 13:55 - 2017-02-22 13:55 - 00001294 _____ C:\Users\l\AppData\Roaming\Microsoft\Windows\Start Menu\Need for Speed Underground 2.lnk
2017-02-22 13:55 - 2017-02-22 13:55 - 00001270 _____ C:\Users\l\Desktop\Need for Speed Underground 2.lnk
2017-02-22 13:53 - 2017-02-22 13:53 - 00000000 ____D C:\Program Files (x86)\EA GAMES
2017-02-22 13:44 - 2017-02-22 13:50 - 00000000 ____D C:\Users\l\AppData\Roaming\DAEMON Tools Lite
2017-02-22 13:44 - 2017-02-22 13:46 - 00030264 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtlitescsibus.sys
2017-02-22 13:44 - 2017-02-22 13:45 - 00000000 ____D C:\Program Files\DAEMON Tools Lite
2017-02-22 13:44 - 2017-02-22 13:44 - 00001775 _____ C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
2017-02-22 13:44 - 2017-02-22 13:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
2017-02-22 13:43 - 2017-02-22 13:43 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2017-02-22 13:42 - 2017-02-22 13:42 - 19062303 _____ C:\Users\l\Downloads\DAEMON Tools Lite 10.1.0.74.rar
2017-02-22 13:25 - 2017-02-22 13:42 - 1207037952 ____R C:\Users\l\Desktop\Need for Speed Underground 2.iso
2017-02-22 13:24 - 2017-02-22 13:24 - 00011894 _____ C:\Users\l\Downloads\Need for Speed Underground 2 - V1.2 - Full Game-BeleuTutors.torrent
2017-02-20 21:09 - 2017-02-20 21:33 - 360329617 _____ C:\Users\l\Downloads\Syphon Filter 3 (Europe).7z
2017-02-20 17:22 - 2017-02-20 17:22 - 00000000 ____D C:\Users\l\AppData\Roaming\fltk.org
2017-02-20 17:20 - 2017-02-20 17:20 - 00000880 _____ C:\Users\l\Desktop\ePSXe.exe - Atalho.lnk
2017-02-20 17:15 - 2017-02-20 21:12 - 00000000 ____D C:\Users\l\Desktop\ps1
2017-02-20 16:54 - 2017-02-20 16:57 - 47996002 _____ C:\Users\l\Downloads\Nascar Rumble.rar
2017-02-17 14:28 - 2017-02-17 14:28 - 01051286 _____ C:\Users\l\Desktop\Placa de Video Virtual.exe
2017-02-17 14:28 - 2017-02-17 14:28 - 00976413 _____ C:\Users\l\Desktop\SweetFX.rar
2017-02-17 13:36 - 2017-02-17 13:36 - 00002958 _____ C:\Windows\System32\Tasks\{2DFD3CB0-096C-4C72-9FDE-CF36E9D40ADA}
2017-02-17 12:20 - 2017-02-17 12:20 - 00000000 ____D C:\Users\l\Desktop\FI-XV-MWMW750
2017-02-17 12:14 - 2017-02-17 12:14 - 97160290 _____ C:\Users\l\Desktop\FI-XV-MWMW750.rar
2017-02-14 14:21 - 2017-02-14 14:21 - 00387389 _____ C:\Users\l\Desktop\John Lennon Sousa Araújo.pdf
2017-01-21 15:31 - 2017-01-21 15:31 - 00001126 _____ C:\Users\l\Desktop\PSPVC (Server).lnk
2017-01-21 15:31 - 2017-01-21 15:31 - 00001077 _____ C:\Users\l\Desktop\PSP Video Converter.lnk
2017-01-21 15:31 - 2017-01-21 15:31 - 00000028 _____ C:\Windows\pspvc_path.ini
2017-01-21 15:31 - 2017-01-21 15:31 - 00000000 ____D C:\Users\l\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PSP Video Converter
2017-01-21 15:31 - 2017-01-21 15:31 - 00000000 ____D C:\Program Files (x86)\pspvc
2017-01-21 14:35 - 2017-01-21 14:35 - 00001464 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HowToRemove.html.lnk
2017-01-21 14:35 - 2017-01-21 14:35 - 00001322 _____ C:\Users\Public\Desktop\Freemake Video Converter.lnk
2017-01-21 14:35 - 2017-01-21 14:35 - 00000000 ____D C:\Users\l\Documents\Freemake
2017-01-21 14:35 - 2017-01-21 14:35 - 00000000 ____D C:\Users\l\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
2017-01-21 14:35 - 2017-01-21 14:35 - 00000000 ____D C:\Users\l\AppData\Local\FreemakeVideoConverter
2017-01-21 14:35 - 2017-01-21 14:35 - 00000000 ____D C:\Users\l\AppData\Local\{68875EDB-4C2F-3263-21B7-178B05DFEB13}
2017-01-21 14:35 - 2017-01-21 14:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freemake
2017-01-21 14:35 - 2017-01-21 14:35 - 00000000 ____D C:\ProgramData\Freemake
2017-01-21 14:34 - 2017-01-23 09:02 - 00000000 ____D C:\Users\l\AppData\Roaming\ScreenShot
2017-01-21 14:34 - 2017-01-21 14:35 - 00000000 ____D C:\Program Files (x86)\Freemake
2017-01-21 14:34 - 2017-01-21 14:34 - 00001857 _____ C:\ProgramData\Microsoft\Windows\Start Menu\ScreenShot.lnk
2017-01-21 14:34 - 2017-01-21 14:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScreenShot
2017-01-21 14:34 - 2017-01-21 14:34 - 00000000 ____D C:\Program Files (x86)\ScreenShot
2017-01-21 14:31 - 2017-01-21 14:31 - 01867192 _____ (Ellora Assets Corporation ) C:\Users\l\Downloads\FreemakeVideoConverterSetup.exe
2017-01-21 14:28 - 2017-01-21 14:28 - 01806672 _____ (App Lite ) C:\Users\l\Downloads\Baixaki_freemake-video-converter.exe
2017-01-21 14:28 - 2017-01-21 14:28 - 00008774 _____ C:\Users\l\Downloads\Baixaki_freemake-video-converter [1].exe
2017-01-21 13:59 - 2017-01-23 18:08 - 00000000 ____D C:\Users\l\Desktop\VC
2017-01-21 13:56 - 2017-01-21 15:31 - 00000000 ____D C:\Program Files (x86)\AviSynth 2.5
2017-01-21 13:56 - 2017-01-21 13:56 - 00000000 ____D C:\Users\l\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5
2017-01-21 13:56 - 2017-01-21 13:56 - 00000000 ____D C:\ProgramData\PSPVC
2017-01-21 13:56 - 2017-01-21 13:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PSP Video Converter
2017-01-21 13:56 - 2017-01-21 13:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5
2017-01-21 13:55 - 2017-01-21 13:56 - 12778674 _____ C:\Users\l\Downloads\PSPVC_v3.91_Setup.exe
2017-01-20 13:42 - 2017-02-17 13:16 - 00028376 _____ (GAS Tecnologia) C:\Windows\system32\Drivers\wsddfac.sys
2017-01-20 13:42 - 2016-11-11 14:41 - 00025184 ____N (GAS Tecnologia) C:\Windows\system32\Drivers\wsddpp.sys
2016-12-31 19:26 - 2016-11-11 14:41 - 00025184 ____N (GAS Tecnologia) C:\Windows\system32\Drivers\wsddprm.sys
2016-12-25 11:19 - 2017-01-31 09:54 - 01157533 ____H C:\Users\l\AppData\Local\IconCache.db
2016-12-25 10:33 - 2016-12-25 10:33 - 00269736 _____ C:\Windows\system32\FNTCACHE.DAT
==================== Three Months Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-03-21 20:55 - 2016-06-22 18:21 - 00000000 ____D C:\Users\l\AppData\Roaming\uTorrent
2017-03-21 20:55 - 2015-09-10 20:50 - 00028888 _____ (GAS Tecnologia) C:\Windows\system32\Drivers\gbpddfac64.sys
2017-03-21 20:39 - 2009-07-14 01:45 - 00015792 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-03-21 20:39 - 2009-07-14 01:45 - 00015792 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-03-21 20:38 - 2016-11-24 16:58 - 00000000 ____D C:\Windows\SysWOW64\directx
2017-03-21 20:37 - 2014-09-23 13:22 - 00000000 ____D C:\ProgramData\Package Cache
2017-03-21 20:32 - 2009-08-04 07:28 - 00730656 _____ C:\Windows\system32\prfh0816.dat
2017-03-21 20:32 - 2009-08-04 07:28 - 00155720 _____ C:\Windows\system32\prfc0816.dat
2017-03-21 20:32 - 2009-07-14 02:13 - 01681220 _____ C:\Windows\system32\PerfStringBackup.INI
2017-03-21 20:32 - 2009-07-14 00:20 - 00000000 ____D C:\Windows\inf
2017-03-21 20:28 - 2014-08-06 18:16 - 00000000 ____D C:\Users\l\AppData\Roaming\Origin
2017-03-18 19:08 - 2014-08-06 02:16 - 00000000 ____D C:\Windows\system32\MRT
2017-03-18 18:56 - 2014-08-06 02:16 - 138634176 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-03-18 18:55 - 2014-08-02 14:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2017-03-18 18:54 - 2014-08-02 14:51 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2017-03-18 18:54 - 2014-08-02 14:51 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2017-03-14 15:03 - 2016-12-17 14:04 - 00251840 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-03-14 15:02 - 2016-12-17 14:03 - 00077408 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-02-24 20:59 - 2016-11-07 10:01 - 00000000 ____D C:\Users\l\AppData\Local\CrashDumps
2017-02-22 14:22 - 2016-12-13 14:39 - 00000000 ____D C:\Users\l\Desktop\TocaEdit_Xinput_Emulador _de_Xbox_360_JoyPad_PlusConfigEmulatorx360ce_64Bits
==================== Files in the root of some directories =======
2014-09-23 13:23 - 2014-09-23 13:23 - 0015971 _____ () C:\Users\l\AppData\Roaming\unins000.dat
2014-09-23 13:23 - 2014-09-23 13:23 - 0720082 _____ () C:\Users\l\AppData\Roaming\unins000.exe
2015-09-05 04:58 - 2015-09-15 17:02 - 0007597 _____ () C:\Users\l\AppData\Local\Resmon.ResmonCfg
2016-09-13 20:09 - 2016-09-13 20:09 - 0024576 _____ () C:\Users\l\AppData\Local\uninst.tmp
2014-12-17 17:52 - 2014-12-17 17:52 - 0000020 _____ () C:\ProgramData\bc.ini
2011-01-12 13:02 - 2010-07-06 21:10 - 0131472 _____ () C:\ProgramData\FullRemove.exe
2009-07-29 02:21 - 2009-07-28 15:31 - 0000223 _____ () C:\ProgramData\setwallpaper.cmd
2009-07-29 02:21 - 2009-07-22 22:04 - 0024576 _____ () C:\ProgramData\SetWallpaper.exe
2011-01-12 12:48 - 2011-01-12 12:49 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2011-01-12 12:48 - 2011-01-12 12:48 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
Files to move or delete:
====================
C:\ProgramData\setwallpaper.cmd
C:\ProgramData\SetWallpaper.exe
Some files in TEMP:
====================
2017-01-21 14:32 - 2017-01-21 14:34 - 34138936 _____ (Ellora Assets Corporation ) C:\Users\l\AppData\Local\Temp\FreemakeVideoConverterFull.exe
2016-12-17 14:27 - 2016-11-13 07:57 - 0186280 _____ (RealNetworks, Inc.) C:\Users\l\AppData\Local\Temp\lowproc.exe
2016-12-23 10:36 - 2016-12-23 10:36 - 1191856 _____ (RealNetworks, Inc.) C:\Users\l\AppData\Local\Temp\rnsetup0.exe
2016-12-17 14:27 - 2016-11-13 07:58 - 0096496 _____ (RealNetworks, Inc.) C:\Users\l\AppData\Local\Temp\stubhelper.dll
2015-12-20 15:03 - 2015-12-20 15:03 - 13977352 _____ (Microsoft Corporation) C:\Users\l\AppData\Local\Temp\vcredist_2015_Update_1_x86.exe
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2017-03-17 14:03
==================== End of FRST.txt ============================
Ran by l (administrator) on L-PC (21-03-2017 20:55:06)
Running from C:\Users\l\Desktop
Loaded Profiles: l (Available Profiles: l)
Platform: Windows 7 Home Premium (X64) Language: Português (Portugal)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe
(GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe
(PSafe Total) C:\Program Files (x86)\PSafe\Total\safemon\QHActiveDefense.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Qihu Software Co. Limited) C:\Program Files (x86)\PSafe\Total\safemon\QHWatchdog.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
(ASUS) C:\Program Files\P4G\BatteryLife.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
() C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(syncables, LLC) C:\Program Files (x86)\syncables\syncables desktop\syncables.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\syncables\syncables desktop\jre\bin\javaw.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(PSafe Total) C:\Program Files (x86)\PSafe\Total\safemon\QHSafeTray.exe
() C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Filseclab Corporation Limited) C:\Program Files (x86)\ScreenShot\SSSvc.exe
(GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Electronic Arts) C:\Program Files (x86)\Origin\OriginWebHelperService.exe
() C:\Program Files (x86)\Origin\QtWebEngineProcess.exe
() C:\Program Files (x86)\Origin\QtWebEngineProcess.exe
(Electronic Arts) C:\Program Files (x86)\Origin\OriginClientService.exe
(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\PSafe\Total\PatchUp.exe
(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\PSafe\Total\360TsLiveUpd.exe
(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\PSafe\Total\360TsLiveUpd.exe
(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\PSafe\Total\360TsLiveUpd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe
(Igor Pavlov) C:\Users\l\Desktop\xpadder_gamepad_profiler.exe
() C:\Users\l\Desktop\xpadder_gamepad_profiler\Xpadder.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(BitTorrent Inc.) C:\Users\l\AppData\Roaming\uTorrent\uTorrent.exe
(BitTorrent Inc.) C:\Users\l\AppData\Roaming\uTorrent\updates\3.4.9_43388\utorrentie.exe
(BitTorrent Inc.) C:\Users\l\AppData\Roaming\uTorrent\updates\3.4.9_43388\utorrentie.exe
(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\PSafe\Total\360TsLiveUpd.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\osk.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [ASUS WebStorage] => C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [1754448 2010-03-15] ()
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1214608 2014-10-08] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2587944 2010-12-13] (ELAN Microelectronics Corp.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-12] (NVIDIA Corporation)
HKLM\...\Run: [Diebold - Warsaw] => C:\Program Files\Diebold\Warsaw\core.exe [927280 2016-11-11] (GAS Tecnologia LTDA)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [617120 2011-03-13] (Atheros Commnucations)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379552 2011-03-13] (Atheros Commnucations)
HKLM\...\Run: [IntelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-05-02] (Intel(R) Corporation)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2776528 2016-12-14] (Malwarebytes)
HKLM-x32\...\Run: [Nuance PDF Reader-reminder] => "C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini"
HKLM-x32\...\Run: [SonicMasterTray] => C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-09] (Virage Logic Corporation / Sonic Focus)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5732992 2010-08-17] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [904824 2015-08-19] (BlueStack Systems, Inc.)
HKLM-x32\...\Run: [QHSafeTray] => C:\Program Files (x86)\PSafe\Total\safemon\QHSafeTray.exe [1959744 2017-01-16] (PSafe Total)
HKLM-x32\...\Run: [ProductUpdater] => C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe [75776 2017-01-09] ()
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\ GbPluginBb: C:\Program Files (x86)\GbPlugin\gbieh.dll [2016-06-21] (Banco do Brasil)
Winlogon\Notify\ GbPluginCef: C:\Program Files (x86)\GbPlugin\gbiehCef.dll [2016-12-12] (Caixa Economica Federal)
Winlogon\Notify\ GbPluginUni: C:\Program Files (x86)\GbPlugin\gbiehUni.dll [2016-12-12] (Banco Itaú Unibanco)
HKU\S-1-5-21-75050290-1511656157-1570779026-1000\...\Run: [Syncables] => C:\Program Files (x86)\syncables\syncables desktop\Syncables.exe [370480 2010-07-19] (syncables, LLC)
HKU\S-1-5-21-75050290-1511656157-1570779026-1000\...\Run: [ares] => C:\Program Files (x86)\Ares\Ares.exe [2758656 2014-08-16] (Seekar Ltd)
HKU\S-1-5-21-75050290-1511656157-1570779026-1000\...\Run: [Chromium] => c:\users\l\appdata\local\chromium\application\chrome.exe [1068544 2016-03-18] (The Chromium Authors)
HKU\S-1-5-21-75050290-1511656157-1570779026-1000\...\Run: [uTorrent] => C:\Users\l\AppData\Roaming\uTorrent\uTorrent.exe [2147520 2017-03-17] (BitTorrent Inc.)
HKU\S-1-5-21-75050290-1511656157-1570779026-1000\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4468056 2015-06-18] (Disc Soft Ltd)
HKU\S-1-5-21-75050290-1511656157-1570779026-1000\...\MountPoints2: {24b83305-f52c-11e6-b3cb-14dae9020568} - F:\Setup.exe
HKU\S-1-5-21-75050290-1511656157-1570779026-1000\...\MountPoints2: {7c598518-7857-11e6-b6f8-c0fe6b30ac71} - G:\Startme.exe
HKU\S-1-5-18\...\Run: [Advanced SystemCare 9] => C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe [2022688 2016-04-26] (IObit)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [174856 2014-09-13] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [156840 2014-09-13] (NVIDIA Corporation)
ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399008} - C:\PROGRAM FILES (X86)\GbPlugin\gbiehuni.dll [1951968 2016-12-12] (Banco Itaú Unibanco)
ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\PROGRAM FILES (X86)\GbPlugin\gbieh.dll [1947872 2016-06-21] (Banco do Brasil)
ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399003} - C:\PROGRAM FILES (X86)\GbPlugin\gbiehcef.dll [1903328 2016-12-12] (Caixa Economica Federal)
ShellIconOverlayIdentifiers: [AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\ASUS WebStorage\service\AsusWSShellExt64.dll [2009-11-26] (eCareme Technologies, Inc.)
ShellIconOverlayIdentifiers: [AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\ASUS WebStorage\service\AsusWSShellExt64.dll [2009-11-26] (eCareme Technologies, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AsusVibeLauncher.lnk [2011-01-12]
ShortcutTarget: AsusVibeLauncher.lnk -> C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FancyStart daemon.lnk [2014-08-01]
ShortcutTarget: FancyStart daemon.lnk -> C:\Windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe ()
GroupPolicy: Restriction <======= ATTENTION
GroupPolicy\User: Restriction <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Hosts: 127.0.0.1 live.virtualdj.com
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{3125EA83-A355-4547-B477-9A05C12237F6}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{3125EA83-A355-4547-B477-9A05C12237F6}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{6402F980-A491-487B-8AF5-72E035428C3F}: [DhcpNameServer] 192.168.1.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKU\S-1-5-21-75050290-1511656157-1570779026-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wcg_fremkfs_17_03¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzzzytBzy0CtDzy0E0DyCzytAyCtB0DtN0D0Tzu0StCzzyEyBtN1L2XzutAtFtByDtFtCtFtCtDzztN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2SyByDzztA0AyEyEyBtGyB0F0D0BtGyBzz0CyDtGyDtD0D0BtGyEyB0BtByB0E0D0C0FyEzztC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyByC0EtB0B0EzyyBtG0A0A0FyCtGyEyC0E0AtGzyzztA0BtGyByEyCtD0CtBtBtDtCtByByD2QtN0A0LzutB%26cr%3D1663193140%26a%3Dwcg_fremkfs_17_03%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM -> {460C3D19-B3D4-4964-A550-77D263B0CCCB} URL = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wcg_fremkfs_17_03¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyBzzzytBzy0CtDzy0E0DyCzytAyCtB0DtN0D0Tzu0StCzzyEyBtN1L2XzutAtFtByDtFtCtFtCtDzztN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2SyByDzztA0AyEyEyBtGyB0F0D0BtGyBzz0CyDtGyDtD0D0BtGyEyB0BtByB0E0D0C0FyEzztC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyByC0EtB0B0EzyyBtG0A0A0FyCtGyEyC0E0AtGzyzztA0BtGyByEyCtD0CtBtBtDtCtByByD2QtN0A0LzutB%26cr%3D1663193140%26a%3Dwcg_fremkfs_17_03%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms}
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
SearchScopes: HKU\S-1-5-21-75050290-1511656157-1570779026-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.iminent.com/?appId=CBD88235-B775-4523-8BFC-066E21F343C2&ref=toolbox&q={searchTerms}
SearchScopes: HKU\S-1-5-21-75050290-1511656157-1570779026-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.iminent.com/?appId=CBD88235-B775-4523-8BFC-066E21F343C2&ref=toolbox&q={searchTerms}
SearchScopes: HKU\S-1-5-21-75050290-1511656157-1570779026-1000 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxp://search.iminent.com/?appId=CBD88235-B775-4523-8BFC-066E21F343C2&ref=toolbox&q={searchTerms}
SearchScopes: HKU\S-1-5-21-75050290-1511656157-1570779026-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL =
SearchScopes: HKU\S-1-5-21-75050290-1511656157-1570779026-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll [2015-11-12] (IObit)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: SafeMon Class -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> C:\Program Files (x86)\PSafe\Total\safemon\safemon64.dll [2017-01-16] (Qihu 360 Software Co., Ltd.)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2013-08-14] (RealDownloader)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2011-03-13] (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2010-09-23] (Microsoft Corporation)
BHO-x32: Advanced SystemCare Surfing Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files (x86)\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll [2015-07-09] (IObit)
BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540000} -> C:\PROGRAM FILES (X86)\GBPLUGIN\gbieh.dll [2016-06-21] (Banco do Brasil)
BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540003} -> C:\PROGRAM FILES (X86)\GBPLUGIN\gbiehcef.dll [2016-12-12] (Caixa Economica Federal)
BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540008} -> C:\PROGRAM FILES (X86)\GBPLUGIN\gbiehuni.dll [2016-12-12] (Banco Itaú Unibanco)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2013-03-02] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2013-03-02] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2013-03-02] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2013-03-02] (Microsoft Corporation)
FireFox:
========
FF DefaultProfile:
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: (RealDownloader) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-09-15] [not signed]
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32.dll [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-09-23] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-09-13] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-09-13] (NVIDIA Corporation)
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll [2014-09-15] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2013-08-14] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2013-08-14] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2013-08-14] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll [2014-09-15] (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2013-08-14] (RealDownloader)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: ZEON/PDF,version=2.0 -> C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll [2010-01-23] (Zeon Corporation)
FF Plugin HKU\S-1-5-21-75050290-1511656157-1570779026-1000: gastecnologia.com.br/sf/uni -> C:\Users\l\AppData\Local\GAS Tecnologia\GBBD\npsf_uni.dll [2014-07-15] (GAS Tecnologia)
Chrome:
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://start.iminent.com/__PARAM__
CHR DefaultSearchURL: Default -> hxxp://search.iminent.com/?appId=CBD88235-B775-4523-8BFC-066E21F343C2&ref=toolbox&q={searchTerms}
CHR DefaultSearchKeyword: Default -> search.iminent.com
CHR Profile: C:\Users\l\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2016-12-17] <==== ATTENTION
CHR Profile: C:\Users\l\AppData\Local\Google\Chrome\User Data\Default [2017-03-21]
CHR Extension: (Google Drive) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-13]
CHR Extension: (YouTube) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-26]
CHR Extension: (Google Search) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-13]
CHR Extension: (GBBD Guardião - Itaú 30 horas) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\kgmpojlddncminmkddkpoegdjhojjipg [2014-08-28]
CHR Extension: (Pagamentos via Chrome Web Store) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-13]
CHR Extension: (Gmail) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-09-05]
CHR Extension: (Chrome Media Router) - C:\Users\l\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-14]
CHR HKLM\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-75050290-1511656157-1570779026-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdvancedSystemCareService9; C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe [446240 2016-01-05] (IObit)
S4 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
S4 ASNB4LDRSvc; C:\Program Files (x86)\ASUS\Wireless Console 3\ASNB4LDRSvc.exe [31864 2013-11-15] ()
S4 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-03-13] (Atheros) [File not signed]
S4 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [74912 2011-03-13] (Atheros Commnucations) [File not signed]
S4 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [437880 2015-08-19] (BlueStack Systems, Inc.)
S4 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [413304 2015-08-19] (BlueStack Systems, Inc.)
S4 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [839288 2015-08-19] (BlueStack Systems, Inc.)
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1268568 2015-06-18] (Disc Soft Ltd)
R2 GbpSv; C:\Program Files (x86)\GbPlugin\gbpsv.exe [631520 2017-02-17] (GAS Tecnologia)
S4 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-12] (NVIDIA Corporation)
S3 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2960672 2016-06-14] (IObit)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4317648 2016-11-29] (Malwarebytes)
S4 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-05-02] ()
S4 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-12] (NVIDIA Corporation)
S4 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-12] (NVIDIA Corporation)
S4 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2122248 2017-02-17] (Electronic Arts)
R2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [2184208 2017-02-17] (Electronic Arts)
R2 QHActiveDefense; C:\Program Files (x86)\PSafe\Total\safemon\QHActiveDefense.exe [858432 2017-01-16] (PSafe Total)
S4 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
S4 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2009-10-20] (CACE Technologies, Inc.)
R2 SSSvc; C:\Program Files (x86)\ScreenShot\SSSvc.exe [139744 2016-11-02] (Filseclab Corporation Limited)
R2 Warsaw Technology; C:\Program Files\Diebold\Warsaw\core.exe [927280 2016-11-11] (GAS Tecnologia LTDA)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation)
S4 wsaudio; C:\Windows\SysWOW64\wsaudio.dll [367104 2013-01-04] () [File not signed]
S4 ihctrl32; %SystemRoot%\System32\ihctrl32.dll [X]
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R1 360AntiHacker; C:\Windows\System32\Drivers\360AntiHacker64.sys [137808 2016-02-29] (360.cn)
R3 360AvFlt; C:\Windows\System32\DRIVERS\360AvFlt.sys [77904 2017-01-16] (360.cn)
R1 360Box64; C:\Windows\System32\DRIVERS\360Box64.sys [319568 2017-01-16] (360.cn)
S3 360Camera; C:\Windows\System32\Drivers\360Camera64.sys [40520 2016-02-29] (360.cn)
R1 360FsFlt; C:\Windows\System32\DRIVERS\360FsFlt.sys [363088 2016-02-29] (360.cn)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R1 ATKWMIACPIIO_; C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [17024 2010-07-26] (ASUS)
R1 BAPIDRV; C:\Windows\System32\DRIVERS\BAPIDRV64.sys [178776 2016-02-29] (Qihu 360 Software Co., Ltd.)
S2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [146040 2015-08-19] (BlueStack Systems)
R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2017-02-22] (Disc Soft Ltd)
R1 gbpddfac; C:\Windows\System32\drivers\gbpddfac64.sys [28888 2017-03-21] (GAS Tecnologia)
R1 gbpddfac; C:\Windows\SysWOW64\drivers\gbpddfac64.sys [28888 2015-08-12] (GAS Tecnologia)
R3 GBPRCM; C:\Program Files (x86)\GbPlugin\gbprcm64.sys [29912 2015-08-12] (GAS Tecnologia)
S3 hid7906; C:\Windows\SysWOW64\drivers\hid7906.sys [34963 2007-12-12] (Compuware Corporation) [File not signed]
S3 hid8101; C:\Windows\SysWOW64\drivers\hid8101.sys [37024 2007-12-03] (Compuware Corporation) [File not signed]
S3 hid8103; C:\Windows\SysWOW64\drivers\hid8103.sys [34587 2007-11-28] (Compuware Corporation) [File not signed]
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-09-09] (REALiX(tm))
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [42944 2010-07-28] (hxxp://libusb-win32.sourceforge.net)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [251840 2017-03-14] (Malwarebytes)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [100312 2014-10-08] (Intel Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [47632 2009-10-20] (CACE Technologies, Inc.)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-12] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [871408 2014-12-17] () [File not signed]
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13832 2010-04-16] ()
R3 Warsaw_PP; C:\Program Files (x86)\GbPlugin\wsftprp64.sys [24792 2015-08-12] (GAS Tecnologia LTDA)
R1 wsddfac; C:\Windows\System32\drivers\wsddfac.sys [28376 2017-02-17] (GAS Tecnologia)
R1 wsddntf; C:\Windows\System32\DRIVERS\wsddntf.sys [36984 2016-06-16] (GAS Tecnologia)
S1 wsddpp; C:\Windows\system32\drivers\wsddpp.sys [25184 2016-11-11] (GAS Tecnologia)
S3 wsddprm; C:\Windows\system32\drivers\wsddprm.sys [25184 2016-11-11] (GAS Tecnologia)
S0 gbpddreg; system32\drivers\gbpddreg64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Three Months Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-03-21 20:48 - 2017-03-21 20:52 - 00055711 _____ C:\Users\l\Desktop\Addition.txt
2017-03-21 20:45 - 2017-03-21 20:55 - 00029266 _____ C:\Users\l\Desktop\FRST.txt
2017-03-21 20:44 - 2017-03-21 20:55 - 00000000 ____D C:\FRST
2017-03-21 20:42 - 2017-03-21 20:42 - 02424832 _____ (Farbar) C:\Users\l\Desktop\FRST64.exe
2017-03-21 20:36 - 2017-03-21 20:38 - 00000000 ____D C:\Program Files (x86)\PCSX2 1.4.0
2017-03-21 20:36 - 2017-03-21 20:36 - 00001941 _____ C:\Users\Public\Desktop\PCSX2 1.4.0.lnk
2017-03-21 20:36 - 2017-03-21 20:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PCSX2
2017-03-21 20:35 - 2017-03-21 20:35 - 17837152 _____ C:\Users\l\Downloads\pcsx21-4-0.exe
2017-03-17 17:46 - 2017-03-17 17:46 - 00000000 ____D C:\Users\l\AppData\LocalLow\uTorrent
2017-03-13 21:16 - 2017-03-13 21:16 - 01160473 _____ C:\Users\l\Downloads\Fotos (1).zip
2017-03-13 18:52 - 2017-03-13 18:53 - 00000072 _____ C:\Users\l\Desktop\controle 64.jsf
2017-03-13 18:02 - 1997-08-22 05:01 - 16777216 _____ C:\Users\l\Desktop\GoldenEye_007_(U)_[o1].v64
2017-03-13 18:01 - 2017-03-13 18:04 - 00000000 ____D C:\Users\l\Desktop\Project64 1.6
2017-03-13 18:00 - 2017-03-13 18:01 - 10952444 _____ C:\Users\l\Downloads\007 N64 (1997).7z
2017-03-13 17:59 - 2017-03-13 17:59 - 01677234 _____ C:\Users\l\Downloads\Project64 1.6.rar
2017-02-24 19:10 - 2017-02-24 19:10 - 00003050 _____ C:\Windows\System32\Tasks\{2C0A4F8D-F9AC-46A4-A1ED-2100EC3A391F}
2017-02-24 19:07 - 2017-02-24 19:07 - 07190453 _____ C:\Users\l\Downloads\UNIWS Tutorial by TrevelXP.zip
2017-02-22 14:30 - 2017-02-22 14:30 - 00002960 _____ C:\Windows\System32\Tasks\{EB5023AF-5B30-4E37-9EC8-557B066CA145}
2017-02-22 14:28 - 2009-01-19 16:38 - 39013721 _____ (Igor Pavlov) C:\Users\l\Desktop\xpadder_gamepad_profiler.exe
2017-02-22 14:28 - 2008-10-15 06:09 - 00000000 ____D C:\Users\l\Desktop\xpadder_gamepad_profiler
2017-02-22 14:25 - 2017-02-22 14:27 - 38987820 _____ C:\Users\l\Downloads\xpadder_gamepad Fulldowngames.rar
2017-02-22 14:23 - 2017-02-22 14:23 - 00932864 _____ C:\Users\l\Desktop\Xpadder.exe
2017-02-22 14:10 - 2017-02-22 14:10 - 00000000 ____D C:\Users\l\AppData\Local\Disc_Soft_Ltd
2017-02-22 14:07 - 2006-01-19 21:00 - 01011712 _____ (nfsu2@spoofer.de) C:\Users\l\Desktop\NFSU2-ProfileCreator.exe
2017-02-22 14:02 - 2017-02-24 21:57 - 00000000 ____D C:\Users\l\AppData\Local\NFS Underground 2
2017-02-22 13:56 - 2015-07-05 14:46 - 00000000 ____D C:\Users\l\Desktop\BMGT - NFSU2 Tradução PT-BR + DirectX
2017-02-22 13:55 - 2017-02-22 14:02 - 00000000 ____D C:\Users\l\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2017-02-22 13:55 - 2017-02-22 13:55 - 00001294 _____ C:\Users\l\AppData\Roaming\Microsoft\Windows\Start Menu\Need for Speed Underground 2.lnk
2017-02-22 13:55 - 2017-02-22 13:55 - 00001270 _____ C:\Users\l\Desktop\Need for Speed Underground 2.lnk
2017-02-22 13:53 - 2017-02-22 13:53 - 00000000 ____D C:\Program Files (x86)\EA GAMES
2017-02-22 13:44 - 2017-02-22 13:50 - 00000000 ____D C:\Users\l\AppData\Roaming\DAEMON Tools Lite
2017-02-22 13:44 - 2017-02-22 13:46 - 00030264 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtlitescsibus.sys
2017-02-22 13:44 - 2017-02-22 13:45 - 00000000 ____D C:\Program Files\DAEMON Tools Lite
2017-02-22 13:44 - 2017-02-22 13:44 - 00001775 _____ C:\Users\Public\Desktop\DAEMON Tools Lite.lnk
2017-02-22 13:44 - 2017-02-22 13:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
2017-02-22 13:43 - 2017-02-22 13:43 - 00000000 ____D C:\ProgramData\DAEMON Tools Lite
2017-02-22 13:42 - 2017-02-22 13:42 - 19062303 _____ C:\Users\l\Downloads\DAEMON Tools Lite 10.1.0.74.rar
2017-02-22 13:25 - 2017-02-22 13:42 - 1207037952 ____R C:\Users\l\Desktop\Need for Speed Underground 2.iso
2017-02-22 13:24 - 2017-02-22 13:24 - 00011894 _____ C:\Users\l\Downloads\Need for Speed Underground 2 - V1.2 - Full Game-BeleuTutors.torrent
2017-02-20 21:09 - 2017-02-20 21:33 - 360329617 _____ C:\Users\l\Downloads\Syphon Filter 3 (Europe).7z
2017-02-20 17:22 - 2017-02-20 17:22 - 00000000 ____D C:\Users\l\AppData\Roaming\fltk.org
2017-02-20 17:20 - 2017-02-20 17:20 - 00000880 _____ C:\Users\l\Desktop\ePSXe.exe - Atalho.lnk
2017-02-20 17:15 - 2017-02-20 21:12 - 00000000 ____D C:\Users\l\Desktop\ps1
2017-02-20 16:54 - 2017-02-20 16:57 - 47996002 _____ C:\Users\l\Downloads\Nascar Rumble.rar
2017-02-17 14:28 - 2017-02-17 14:28 - 01051286 _____ C:\Users\l\Desktop\Placa de Video Virtual.exe
2017-02-17 14:28 - 2017-02-17 14:28 - 00976413 _____ C:\Users\l\Desktop\SweetFX.rar
2017-02-17 13:36 - 2017-02-17 13:36 - 00002958 _____ C:\Windows\System32\Tasks\{2DFD3CB0-096C-4C72-9FDE-CF36E9D40ADA}
2017-02-17 12:20 - 2017-02-17 12:20 - 00000000 ____D C:\Users\l\Desktop\FI-XV-MWMW750
2017-02-17 12:14 - 2017-02-17 12:14 - 97160290 _____ C:\Users\l\Desktop\FI-XV-MWMW750.rar
2017-02-14 14:21 - 2017-02-14 14:21 - 00387389 _____ C:\Users\l\Desktop\John Lennon Sousa Araújo.pdf
2017-01-21 15:31 - 2017-01-21 15:31 - 00001126 _____ C:\Users\l\Desktop\PSPVC (Server).lnk
2017-01-21 15:31 - 2017-01-21 15:31 - 00001077 _____ C:\Users\l\Desktop\PSP Video Converter.lnk
2017-01-21 15:31 - 2017-01-21 15:31 - 00000028 _____ C:\Windows\pspvc_path.ini
2017-01-21 15:31 - 2017-01-21 15:31 - 00000000 ____D C:\Users\l\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PSP Video Converter
2017-01-21 15:31 - 2017-01-21 15:31 - 00000000 ____D C:\Program Files (x86)\pspvc
2017-01-21 14:35 - 2017-01-21 14:35 - 00001464 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HowToRemove.html.lnk
2017-01-21 14:35 - 2017-01-21 14:35 - 00001322 _____ C:\Users\Public\Desktop\Freemake Video Converter.lnk
2017-01-21 14:35 - 2017-01-21 14:35 - 00000000 ____D C:\Users\l\Documents\Freemake
2017-01-21 14:35 - 2017-01-21 14:35 - 00000000 ____D C:\Users\l\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
2017-01-21 14:35 - 2017-01-21 14:35 - 00000000 ____D C:\Users\l\AppData\Local\FreemakeVideoConverter
2017-01-21 14:35 - 2017-01-21 14:35 - 00000000 ____D C:\Users\l\AppData\Local\{68875EDB-4C2F-3263-21B7-178B05DFEB13}
2017-01-21 14:35 - 2017-01-21 14:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freemake
2017-01-21 14:35 - 2017-01-21 14:35 - 00000000 ____D C:\ProgramData\Freemake
2017-01-21 14:34 - 2017-01-23 09:02 - 00000000 ____D C:\Users\l\AppData\Roaming\ScreenShot
2017-01-21 14:34 - 2017-01-21 14:35 - 00000000 ____D C:\Program Files (x86)\Freemake
2017-01-21 14:34 - 2017-01-21 14:34 - 00001857 _____ C:\ProgramData\Microsoft\Windows\Start Menu\ScreenShot.lnk
2017-01-21 14:34 - 2017-01-21 14:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScreenShot
2017-01-21 14:34 - 2017-01-21 14:34 - 00000000 ____D C:\Program Files (x86)\ScreenShot
2017-01-21 14:31 - 2017-01-21 14:31 - 01867192 _____ (Ellora Assets Corporation ) C:\Users\l\Downloads\FreemakeVideoConverterSetup.exe
2017-01-21 14:28 - 2017-01-21 14:28 - 01806672 _____ (App Lite ) C:\Users\l\Downloads\Baixaki_freemake-video-converter.exe
2017-01-21 14:28 - 2017-01-21 14:28 - 00008774 _____ C:\Users\l\Downloads\Baixaki_freemake-video-converter [1].exe
2017-01-21 13:59 - 2017-01-23 18:08 - 00000000 ____D C:\Users\l\Desktop\VC
2017-01-21 13:56 - 2017-01-21 15:31 - 00000000 ____D C:\Program Files (x86)\AviSynth 2.5
2017-01-21 13:56 - 2017-01-21 13:56 - 00000000 ____D C:\Users\l\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5
2017-01-21 13:56 - 2017-01-21 13:56 - 00000000 ____D C:\ProgramData\PSPVC
2017-01-21 13:56 - 2017-01-21 13:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PSP Video Converter
2017-01-21 13:56 - 2017-01-21 13:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AviSynth 2.5
2017-01-21 13:55 - 2017-01-21 13:56 - 12778674 _____ C:\Users\l\Downloads\PSPVC_v3.91_Setup.exe
2017-01-20 13:42 - 2017-02-17 13:16 - 00028376 _____ (GAS Tecnologia) C:\Windows\system32\Drivers\wsddfac.sys
2017-01-20 13:42 - 2016-11-11 14:41 - 00025184 ____N (GAS Tecnologia) C:\Windows\system32\Drivers\wsddpp.sys
2016-12-31 19:26 - 2016-11-11 14:41 - 00025184 ____N (GAS Tecnologia) C:\Windows\system32\Drivers\wsddprm.sys
2016-12-25 11:19 - 2017-01-31 09:54 - 01157533 ____H C:\Users\l\AppData\Local\IconCache.db
2016-12-25 10:33 - 2016-12-25 10:33 - 00269736 _____ C:\Windows\system32\FNTCACHE.DAT
==================== Three Months Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-03-21 20:55 - 2016-06-22 18:21 - 00000000 ____D C:\Users\l\AppData\Roaming\uTorrent
2017-03-21 20:55 - 2015-09-10 20:50 - 00028888 _____ (GAS Tecnologia) C:\Windows\system32\Drivers\gbpddfac64.sys
2017-03-21 20:39 - 2009-07-14 01:45 - 00015792 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-03-21 20:39 - 2009-07-14 01:45 - 00015792 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-03-21 20:38 - 2016-11-24 16:58 - 00000000 ____D C:\Windows\SysWOW64\directx
2017-03-21 20:37 - 2014-09-23 13:22 - 00000000 ____D C:\ProgramData\Package Cache
2017-03-21 20:32 - 2009-08-04 07:28 - 00730656 _____ C:\Windows\system32\prfh0816.dat
2017-03-21 20:32 - 2009-08-04 07:28 - 00155720 _____ C:\Windows\system32\prfc0816.dat
2017-03-21 20:32 - 2009-07-14 02:13 - 01681220 _____ C:\Windows\system32\PerfStringBackup.INI
2017-03-21 20:32 - 2009-07-14 00:20 - 00000000 ____D C:\Windows\inf
2017-03-21 20:28 - 2014-08-06 18:16 - 00000000 ____D C:\Users\l\AppData\Roaming\Origin
2017-03-18 19:08 - 2014-08-06 02:16 - 00000000 ____D C:\Windows\system32\MRT
2017-03-18 18:56 - 2014-08-06 02:16 - 138634176 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-03-18 18:55 - 2014-08-02 14:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2017-03-18 18:54 - 2014-08-02 14:51 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2017-03-18 18:54 - 2014-08-02 14:51 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2017-03-14 15:03 - 2016-12-17 14:04 - 00251840 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-03-14 15:02 - 2016-12-17 14:03 - 00077408 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-02-24 20:59 - 2016-11-07 10:01 - 00000000 ____D C:\Users\l\AppData\Local\CrashDumps
2017-02-22 14:22 - 2016-12-13 14:39 - 00000000 ____D C:\Users\l\Desktop\TocaEdit_Xinput_Emulador _de_Xbox_360_JoyPad_PlusConfigEmulatorx360ce_64Bits
==================== Files in the root of some directories =======
2014-09-23 13:23 - 2014-09-23 13:23 - 0015971 _____ () C:\Users\l\AppData\Roaming\unins000.dat
2014-09-23 13:23 - 2014-09-23 13:23 - 0720082 _____ () C:\Users\l\AppData\Roaming\unins000.exe
2015-09-05 04:58 - 2015-09-15 17:02 - 0007597 _____ () C:\Users\l\AppData\Local\Resmon.ResmonCfg
2016-09-13 20:09 - 2016-09-13 20:09 - 0024576 _____ () C:\Users\l\AppData\Local\uninst.tmp
2014-12-17 17:52 - 2014-12-17 17:52 - 0000020 _____ () C:\ProgramData\bc.ini
2011-01-12 13:02 - 2010-07-06 21:10 - 0131472 _____ () C:\ProgramData\FullRemove.exe
2009-07-29 02:21 - 2009-07-28 15:31 - 0000223 _____ () C:\ProgramData\setwallpaper.cmd
2009-07-29 02:21 - 2009-07-22 22:04 - 0024576 _____ () C:\ProgramData\SetWallpaper.exe
2011-01-12 12:48 - 2011-01-12 12:49 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2011-01-12 12:48 - 2011-01-12 12:48 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
Files to move or delete:
====================
C:\ProgramData\setwallpaper.cmd
C:\ProgramData\SetWallpaper.exe
Some files in TEMP:
====================
2017-01-21 14:32 - 2017-01-21 14:34 - 34138936 _____ (Ellora Assets Corporation ) C:\Users\l\AppData\Local\Temp\FreemakeVideoConverterFull.exe
2016-12-17 14:27 - 2016-11-13 07:57 - 0186280 _____ (RealNetworks, Inc.) C:\Users\l\AppData\Local\Temp\lowproc.exe
2016-12-23 10:36 - 2016-12-23 10:36 - 1191856 _____ (RealNetworks, Inc.) C:\Users\l\AppData\Local\Temp\rnsetup0.exe
2016-12-17 14:27 - 2016-11-13 07:58 - 0096496 _____ (RealNetworks, Inc.) C:\Users\l\AppData\Local\Temp\stubhelper.dll
2015-12-20 15:03 - 2015-12-20 15:03 - 13977352 _____ (Microsoft Corporation) C:\Users\l\AppData\Local\Temp\vcredist_2015_Update_1_x86.exe
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2017-03-17 14:03
==================== End of FRST.txt ============================