Publicité
Publicité
Format du document : text/plain
Prévisualisation
Resultado do exame da Farbar Recovery Scan Tool (FRST) (x64) Versão: 16-10-2017
Executado por celia (administrador) em TESOURARIA-PC (17-10-2017 12:36:27)
Executando a partir de C:\Users\celia\Downloads
Perfis Carregados: celia (Perfis Disponíveis: celia & Tesouraria & adm)
Platform: Windows 7 Professional Service Pack 1 (X64) Idioma: Português (Brasil)
Internet Explorer Versão 11 (Navegador padrão: IE)
Modo da Inicialização: Normal
Tutorial da Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processos (Whitelisted) =================
(Se uma entrada for incluída na fixlist, o processo será fechado. O arquivo não será movido.)
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Antivirus\AVGSvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation) C:\Windows\SysWOW64\SYSTESOURARIAPC56.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Antivirus\avgui.exe
(Scopus Soluções em TI Ltda) C:\Program Files (x86)\scpbrad\scpbradserv.exe
(Scopus Soluções em TI Ltda) C:\Program Files (x86)\scpbrad\scpbradguard.exe
(GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Antivirus\x64\aswidsagenta.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registro (Whitelisted) ===========================
(Se uma entrada for incluída na fixlist, o ítem no Registro será restaurado para o padrão ou removido. O arquivo não será movido.)
HKLM\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [239592 2017-10-06] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [AVGUI.exe] => C:\Program Files (x86)\AVG\Antivirus\AvLaunch.exe [302744 2017-10-17] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-07-21] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restrição <==== ATENÇÃO
CHR HKLM\SOFTWARE\Policies\Google: Restrição <==== ATENÇÃO
==================== Internet (Whitelisted) ====================
(Se um ítem for incluído na fixlist, sendo um ítem do Registro, será removido ou restaurado para o padrão.)
ProxyEnable: [HKLM] => Proxy está habilitado.
ProxyServer: [HKLM] => 127.0.0.1:51671
ProxyEnable: [S-1-5-21-3190785766-676845858-1741376148-1153] => Proxy está habilitado.
ProxyServer: [S-1-5-21-3190785766-676845858-1741376148-1153] => 127.0.0.1:51671
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 4.2.2.2 192.168.0.2
Tcpip\..\Interfaces\{0BB6282D-E137-4719-9B66-FE75BE86680E}: [NameServer] 192.168.0.2,192.168.0.1
Tcpip\..\Interfaces\{0BB6282D-E137-4719-9B66-FE75BE86680E}: [DhcpNameServer] 8.8.8.8 4.2.2.2 192.168.0.2
Internet Explorer:
==================
HKU\S-1-5-21-3190785766-676845858-1741376148-1153\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
SearchScopes: HKU\S-1-5-21-3190785766-676845858-1741376148-1153 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2017-10-17] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_144\bin\ssv.dll [2017-10-17] (Oracle Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2017-04-05] (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\URLREDIR.DLL [2017-10-17] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2017-09-23] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_144\bin\jp2ssv.dll [2017-10-17] (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2017-09-23] (Microsoft Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2017-04-05] (Google Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\URLREDIR.DLL [2017-10-17] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2017-09-23] (Microsoft Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2017-04-05] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2017-04-05] (Google Inc.)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-23] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-23] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-23] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-23] (Microsoft Corporation)
FireFox:
========
FF Plugin: @java.com/DTPlugin,version=11.144.2 -> C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npDeployJava1.dll [2017-10-17] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.144.2 -> C:\Program Files\Java\jre1.8.0_144\bin\plugin2\npjp2.dll [2017-10-17] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2017-09-23] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-09-23] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-02] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\warsaw.cfg [2017-10-17] <==== ATENÇÃO
Chrome:
=======
CHR Profile: C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default [2017-10-17]
CHR Extension: (Sem Nome) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-17]
CHR Extension: (Sem Nome) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-17]
CHR Extension: (Sem Nome) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-10-17]
CHR Extension: (Sem Nome) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-10-17]
CHR Extension: (Sem Nome) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccbpbkebodcjkknkfkpmfeciinhidaeh [2017-10-17]
CHR Extension: (Sem Nome) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-17]
CHR Extension: (Sem Nome) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-10-17]
CHR Extension: (Chrome Web Store Payments) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-10-17]
CHR Extension: (Sem Nome) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-10-17]
CHR Extension: (Chrome Media Router) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-10-17]
CHR HKLM\...\Chrome\Extension: [ccbpbkebodcjkknkfkpmfeciinhidaeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ccbpbkebodcjkknkfkpmfeciinhidaeh] - hxxps://clients2.google.com/service/update2/crx
==================== Serviços (Whitelisted) ====================
(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)
S4 AnyDesk; C:\Program Files (x86)\AnyDesk\AnyDesk.exe [1535648 2016-12-17] ()
R2 AVG Antivirus; C:\Program Files (x86)\AVG\Antivirus\AVGSvc.exe [282536 2017-10-17] (AVG Technologies CZ, s.r.o.)
R3 avgbIDSAgent; C:\Program Files (x86)\AVG\Antivirus\x64\aswidsagenta.exe [7496672 2017-10-17] (AVG Technologies CZ, s.r.o.)
R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1428656 2017-10-06] (AVG Technologies CZ, s.r.o.)
S4 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [404816 2017-09-13] (Avira Operations GmbH & Co. KG)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [7761584 2017-10-04] (Microsoft Corporation)
R2 scpbradserv; C:\Program Files (x86)\scpbrad\scpbradserv.exe [1997792 2017-10-17] (Scopus Soluções em TI Ltda)
S4 SerasaUpdate; C:\Program Files (x86)\Serasa Experian\Service\SerasaUpdate.exe [400384 2016-12-09] (Serasa Experian) [Arquivo não assinado]
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [737984 2015-08-30] (@ByELDI) [Arquivo não assinado]
R2 Warsaw Technology; C:\Program Files\Diebold\Warsaw\core.exe [1056304 2017-08-30] (GAS Tecnologia LTDA)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation)
===================== Drivers (Whitelisted) ======================
(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)
R1 avgbdisk; C:\Windows\system32\drivers\avgbdiska.sys [166624 2017-10-17] (AVG Technologies CZ, s.r.o.)
R1 avgbidsdriver; C:\Windows\system32\drivers\avgbidsdrivera.sys [314640 2017-10-17] (AVG Technologies CZ, s.r.o.)
R0 avgbidsh; C:\Windows\system32\drivers\avgbidsha.sys [192584 2017-10-17] (AVG Technologies CZ, s.r.o.)
R0 avgblog; C:\Windows\system32\drivers\avgbloga.sys [336896 2017-10-17] (AVG Technologies CZ, s.r.o.)
R0 avgbuniv; C:\Windows\system32\drivers\avgbuniva.sys [51336 2017-10-17] (AVG Technologies CZ, s.r.o.)
S3 avgHwid; C:\Windows\system32\drivers\avgHwid.sys [39424 2017-10-17] (AVG Technologies CZ, s.r.o.)
R2 avgMonFlt; C:\Windows\system32\drivers\avgMonFlt.sys [140192 2017-10-17] (AVG Technologies CZ, s.r.o.)
R0 avgRvrt; C:\Windows\system32\drivers\avgRvrt.sys [76832 2017-10-17] (AVG Technologies CZ, s.r.o.)
R1 avgSnx; C:\Windows\system32\drivers\avgSnx.sys [1012952 2017-10-17] (AVG Technologies CZ, s.r.o.)
R1 avgSP; C:\Windows\system32\drivers\avgSP.sys [579584 2017-10-17] (AVG Technologies CZ, s.r.o.)
R0 avgVmm; C:\Windows\system32\drivers\avgVmm.sys [355856 2017-10-17] (AVG Technologies CZ, s.r.o.)
R1 wsddfac; C:\Windows\System32\drivers\wsddfac.sys [28376 2017-10-17] (GAS Tecnologia)
R1 wsddntf; C:\Windows\System32\DRIVERS\wsddntf.sys [36984 2016-06-16] (GAS Tecnologia)
R1 wsddpp; C:\Windows\system32\drivers\wsddpp.sys [25184 2016-06-08] (GAS Tecnologia)
R3 wsddprm; C:\Windows\system32\drivers\wsddprm.sys [25184 2016-11-07] (GAS Tecnologia)
==================== NetSvcs (Whitelisted) ===================
(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)
==================== Um Mês Criados arquivos e pastas ========
(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)
2017-10-17 11:38 - 2017-10-17 11:38 - 000579584 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgSP.sys
2017-10-17 11:38 - 2017-10-17 11:38 - 000402608 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\avgBoot.exe
2017-10-17 11:38 - 2017-10-17 11:38 - 000355856 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgVmm.sys
2017-10-17 11:38 - 2017-10-17 11:38 - 000140192 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgMonFlt.sys
2017-10-17 11:38 - 2017-10-17 11:38 - 000076832 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgRvrt.sys
2017-10-17 11:38 - 2017-10-17 11:38 - 000039424 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgHwid.sys
2017-10-17 11:38 - 2017-10-17 11:38 - 000003920 _____ C:\Windows\System32\Tasks\Antivirus Emergency Update
2017-10-17 11:38 - 2017-10-17 11:37 - 001012952 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgSnx.sys
2017-10-17 11:38 - 2017-10-17 11:35 - 000336896 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgbloga.sys
2017-10-17 11:38 - 2017-10-17 11:35 - 000314640 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgbidsdrivera.sys
2017-10-17 11:38 - 2017-10-17 11:35 - 000192584 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgbidsha.sys
2017-10-17 11:38 - 2017-10-17 11:35 - 000166624 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgbdiska.sys
2017-10-17 11:38 - 2017-10-17 11:35 - 000051336 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgbuniva.sys
2017-10-17 11:33 - 2017-10-17 11:33 - 000003600 _____ C:\Windows\System32\Tasks\AVG EUpdate Task
2017-10-17 10:50 - 2017-10-17 10:24 - 000024064 _____ C:\Windows\zoek-delete.exe
2017-10-17 10:24 - 2017-10-17 10:46 - 000000000 ____D C:\zoek_backup
2017-10-17 10:07 - 2017-10-17 12:25 - 000028376 _____ (GAS Tecnologia) C:\Windows\system32\Drivers\wsddfac.sys
2017-10-17 10:07 - 2017-10-17 10:07 - 000002912 _____ C:\Windows\System32\Tasks\Rerun Warsaw's CoreFixer
2017-10-17 10:07 - 2017-10-17 10:07 - 000000000 ___HD C:\Program Files (x86)\GAS Tecnologia
2017-10-17 10:07 - 2017-10-17 10:07 - 000000000 ___HD C:\Program Files (x86)\Diebold
2017-10-17 10:07 - 2016-11-07 14:54 - 000025184 ____N (GAS Tecnologia) C:\Windows\system32\Drivers\wsddprm.sys
2017-10-17 10:07 - 2016-06-16 18:43 - 000036984 _____ (GAS Tecnologia) C:\Windows\system32\Drivers\wsddntf.sys
2017-10-17 10:07 - 2016-06-16 18:43 - 000008811 _____ C:\Windows\system32\Drivers\wsddntf.cat
2017-10-17 10:07 - 2016-06-08 18:43 - 000025184 ____N (GAS Tecnologia) C:\Windows\system32\Drivers\wsddpp.sys
2017-10-17 10:06 - 2009-06-10 19:00 - 000000824 _____ C:\Windows\system32\Drivers\etc\hosts.tmp
2017-10-17 10:01 - 2017-10-17 12:36 - 000000000 ____D C:\FRST
2017-10-17 10:00 - 2017-10-17 10:00 - 000000000 ____D C:\Program Files (x86)\scpbrad
2017-10-10 10:01 - 2017-10-10 10:01 - 000000000 ____D C:\Sicoobnet
2017-10-10 09:56 - 2017-10-17 09:51 - 000192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-10-10 09:55 - 2017-10-10 09:55 - 000000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2017-10-10 09:55 - 2016-03-10 15:09 - 000064896 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2017-10-10 09:55 - 2016-03-10 15:08 - 000140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2017-10-10 09:55 - 2016-03-10 15:08 - 000027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-10-03 12:05 - 2017-10-17 10:14 - 000000000 ____D C:\Windows\pss
2017-09-29 14:57 - 2017-10-17 12:24 - 001690096 _____ (GlavSoft LLC.) C:\Windows\SysWOW64\crov.exe
2017-09-29 14:57 - 2017-10-17 12:24 - 000000905 _____ C:\Windows\SysWOW64\c.cer
2017-09-29 10:45 - 2017-09-29 10:45 - 000003350 _____ C:\Windows\System32\Tasks\SYSTESOURARIAPC56
2017-09-29 10:45 - 2017-09-29 10:45 - 000000376 _____ C:\Windows\SysWOW64\TESOURARIA-PCx.ocx
2017-09-29 10:45 - 2017-09-29 10:45 - 000000142 _____ C:\Windows\SysWOW64\vsppxzz5.12m.vbs
2017-09-29 10:45 - 2017-09-29 10:45 - 000000000 ____D C:\Windows\SysWOW64\Java
2017-09-29 10:45 - 2009-07-13 23:39 - 000473600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SYSTESOURARIAPC56.exe
2017-09-27 13:13 - 2017-10-16 09:34 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-09-27 13:13 - 2017-10-16 09:34 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-09-27 13:13 - 2017-10-16 09:34 - 000004544 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2017-09-27 13:13 - 2017-10-16 09:34 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2017-09-27 13:13 - 2017-10-16 09:34 - 000000000 ____D C:\Windows\system32\Macromed
2017-09-27 13:13 - 2017-10-16 09:28 - 000004396 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
==================== Um Mês Modificados arquivos e pastas ========
(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)
2017-10-17 12:32 - 2009-07-14 02:45 - 000025536 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-10-17 12:32 - 2009-07-14 02:45 - 000025536 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-10-17 12:29 - 2009-07-14 15:55 - 000705070 _____ C:\Windows\system32\prfh0416.dat
2017-10-17 12:29 - 2009-07-14 15:55 - 000146910 _____ C:\Windows\system32\prfc0416.dat
2017-10-17 12:29 - 2009-07-14 03:13 - 001633534 _____ C:\Windows\system32\PerfStringBackup.INI
2017-10-17 12:29 - 2009-07-14 01:20 - 000000000 ____D C:\Windows\inf
2017-10-17 12:23 - 2016-12-19 09:11 - 000000120 _____ C:\Windows\system32\config\netlogon.ftl
2017-10-17 12:23 - 2009-07-14 03:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-10-17 11:51 - 2017-09-14 12:51 - 000000000 ____D C:\Program Files (x86)\Avira
2017-10-17 11:37 - 2016-12-19 09:44 - 000000000 ____D C:\Program Files\Java
2017-10-17 11:36 - 2016-12-19 09:45 - 000110144 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2017-10-17 11:35 - 2016-12-19 08:20 - 000000000 ____D C:\Program Files (x86)\AVG
2017-10-17 10:45 - 2016-12-19 09:14 - 000000000 ____D C:\Users\celia
2017-10-17 10:45 - 2009-07-14 01:20 - 000000000 ___HD C:\Windows\system32\GroupPolicy
2017-10-17 10:09 - 2009-07-14 02:45 - 000434208 _____ C:\Windows\system32\FNTCACHE.DAT
2017-10-17 10:00 - 2016-12-17 11:37 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2017-10-06 12:56 - 2009-07-14 01:20 - 000000000 ____D C:\Windows\system32\NDF
2017-09-27 08:10 - 2017-09-14 13:02 - 000003122 _____ C:\Windows\System32\Tasks\Avira SystrayStartTrigger
2017-09-26 08:08 - 2016-11-09 11:01 - 000000000 ____D C:\Escolar_plus
2017-09-22 08:10 - 2009-07-14 03:09 - 000000000 ____D C:\Windows\System32\Tasks\WPD
==================== Arquivos na raiz de alguns diretórios =======
2016-12-19 09:30 - 2016-12-19 09:30 - 000000057 _____ () C:\ProgramData\Ament.ini
==================== Bamital & volsnap ======================
(Não há correção automática para arquivos que não passaram na verificação.)
C:\Windows\system32\winlogon.exe => O arquivo é assinado digitalmente
C:\Windows\system32\wininit.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\wininit.exe => O arquivo é assinado digitalmente
C:\Windows\explorer.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\explorer.exe => O arquivo é assinado digitalmente
C:\Windows\system32\svchost.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\svchost.exe => O arquivo é assinado digitalmente
C:\Windows\system32\services.exe => O arquivo é assinado digitalmente
C:\Windows\system32\User32.dll => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\User32.dll => O arquivo é assinado digitalmente
C:\Windows\system32\userinit.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\userinit.exe => O arquivo é assinado digitalmente
C:\Windows\system32\rpcss.dll => O arquivo é assinado digitalmente
C:\Windows\system32\dnsapi.dll => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\dnsapi.dll => O arquivo é assinado digitalmente
C:\Windows\system32\Drivers\volsnap.sys => O arquivo é assinado digitalmente
LastRegBack: 2017-10-10 11:13
==================== Fim de FRST.txt ============================
Executado por celia (administrador) em TESOURARIA-PC (17-10-2017 12:36:27)
Executando a partir de C:\Users\celia\Downloads
Perfis Carregados: celia (Perfis Disponíveis: celia & Tesouraria & adm)
Platform: Windows 7 Professional Service Pack 1 (X64) Idioma: Português (Brasil)
Internet Explorer Versão 11 (Navegador padrão: IE)
Modo da Inicialização: Normal
Tutorial da Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processos (Whitelisted) =================
(Se uma entrada for incluída na fixlist, o processo será fechado. O arquivo não será movido.)
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Antivirus\AVGSvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation) C:\Windows\SysWOW64\SYSTESOURARIAPC56.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Antivirus\avgui.exe
(Scopus Soluções em TI Ltda) C:\Program Files (x86)\scpbrad\scpbradserv.exe
(Scopus Soluções em TI Ltda) C:\Program Files (x86)\scpbrad\scpbradguard.exe
(GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Antivirus\x64\aswidsagenta.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registro (Whitelisted) ===========================
(Se uma entrada for incluída na fixlist, o ítem no Registro será restaurado para o padrão ou removido. O arquivo não será movido.)
HKLM\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [239592 2017-10-06] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [AVGUI.exe] => C:\Program Files (x86)\AVG\Antivirus\AvLaunch.exe [302744 2017-10-17] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-07-21] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restrição <==== ATENÇÃO
CHR HKLM\SOFTWARE\Policies\Google: Restrição <==== ATENÇÃO
==================== Internet (Whitelisted) ====================
(Se um ítem for incluído na fixlist, sendo um ítem do Registro, será removido ou restaurado para o padrão.)
ProxyEnable: [HKLM] => Proxy está habilitado.
ProxyServer: [HKLM] => 127.0.0.1:51671
ProxyEnable: [S-1-5-21-3190785766-676845858-1741376148-1153] => Proxy está habilitado.
ProxyServer: [S-1-5-21-3190785766-676845858-1741376148-1153] => 127.0.0.1:51671
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 4.2.2.2 192.168.0.2
Tcpip\..\Interfaces\{0BB6282D-E137-4719-9B66-FE75BE86680E}: [NameServer] 192.168.0.2,192.168.0.1
Tcpip\..\Interfaces\{0BB6282D-E137-4719-9B66-FE75BE86680E}: [DhcpNameServer] 8.8.8.8 4.2.2.2 192.168.0.2
Internet Explorer:
==================
HKU\S-1-5-21-3190785766-676845858-1741376148-1153\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
SearchScopes: HKU\S-1-5-21-3190785766-676845858-1741376148-1153 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2017-10-17] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_144\bin\ssv.dll [2017-10-17] (Oracle Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2017-04-05] (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\URLREDIR.DLL [2017-10-17] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2017-09-23] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_144\bin\jp2ssv.dll [2017-10-17] (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2017-09-23] (Microsoft Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2017-04-05] (Google Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\URLREDIR.DLL [2017-10-17] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2017-09-23] (Microsoft Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2017-04-05] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2017-04-05] (Google Inc.)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-23] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-23] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-23] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-09-23] (Microsoft Corporation)
FireFox:
========
FF Plugin: @java.com/DTPlugin,version=11.144.2 -> C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npDeployJava1.dll [2017-10-17] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.144.2 -> C:\Program Files\Java\jre1.8.0_144\bin\plugin2\npjp2.dll [2017-10-17] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2017-09-23] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-09-23] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-02] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\warsaw.cfg [2017-10-17] <==== ATENÇÃO
Chrome:
=======
CHR Profile: C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default [2017-10-17]
CHR Extension: (Sem Nome) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-17]
CHR Extension: (Sem Nome) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-17]
CHR Extension: (Sem Nome) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-10-17]
CHR Extension: (Sem Nome) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-10-17]
CHR Extension: (Sem Nome) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccbpbkebodcjkknkfkpmfeciinhidaeh [2017-10-17]
CHR Extension: (Sem Nome) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-17]
CHR Extension: (Sem Nome) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-10-17]
CHR Extension: (Chrome Web Store Payments) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-10-17]
CHR Extension: (Sem Nome) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-10-17]
CHR Extension: (Chrome Media Router) - C:\Users\celia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-10-17]
CHR HKLM\...\Chrome\Extension: [ccbpbkebodcjkknkfkpmfeciinhidaeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ccbpbkebodcjkknkfkpmfeciinhidaeh] - hxxps://clients2.google.com/service/update2/crx
==================== Serviços (Whitelisted) ====================
(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)
S4 AnyDesk; C:\Program Files (x86)\AnyDesk\AnyDesk.exe [1535648 2016-12-17] ()
R2 AVG Antivirus; C:\Program Files (x86)\AVG\Antivirus\AVGSvc.exe [282536 2017-10-17] (AVG Technologies CZ, s.r.o.)
R3 avgbIDSAgent; C:\Program Files (x86)\AVG\Antivirus\x64\aswidsagenta.exe [7496672 2017-10-17] (AVG Technologies CZ, s.r.o.)
R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1428656 2017-10-06] (AVG Technologies CZ, s.r.o.)
S4 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [404816 2017-09-13] (Avira Operations GmbH & Co. KG)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [7761584 2017-10-04] (Microsoft Corporation)
R2 scpbradserv; C:\Program Files (x86)\scpbrad\scpbradserv.exe [1997792 2017-10-17] (Scopus Soluções em TI Ltda)
S4 SerasaUpdate; C:\Program Files (x86)\Serasa Experian\Service\SerasaUpdate.exe [400384 2016-12-09] (Serasa Experian) [Arquivo não assinado]
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [737984 2015-08-30] (@ByELDI) [Arquivo não assinado]
R2 Warsaw Technology; C:\Program Files\Diebold\Warsaw\core.exe [1056304 2017-08-30] (GAS Tecnologia LTDA)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation)
===================== Drivers (Whitelisted) ======================
(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)
R1 avgbdisk; C:\Windows\system32\drivers\avgbdiska.sys [166624 2017-10-17] (AVG Technologies CZ, s.r.o.)
R1 avgbidsdriver; C:\Windows\system32\drivers\avgbidsdrivera.sys [314640 2017-10-17] (AVG Technologies CZ, s.r.o.)
R0 avgbidsh; C:\Windows\system32\drivers\avgbidsha.sys [192584 2017-10-17] (AVG Technologies CZ, s.r.o.)
R0 avgblog; C:\Windows\system32\drivers\avgbloga.sys [336896 2017-10-17] (AVG Technologies CZ, s.r.o.)
R0 avgbuniv; C:\Windows\system32\drivers\avgbuniva.sys [51336 2017-10-17] (AVG Technologies CZ, s.r.o.)
S3 avgHwid; C:\Windows\system32\drivers\avgHwid.sys [39424 2017-10-17] (AVG Technologies CZ, s.r.o.)
R2 avgMonFlt; C:\Windows\system32\drivers\avgMonFlt.sys [140192 2017-10-17] (AVG Technologies CZ, s.r.o.)
R0 avgRvrt; C:\Windows\system32\drivers\avgRvrt.sys [76832 2017-10-17] (AVG Technologies CZ, s.r.o.)
R1 avgSnx; C:\Windows\system32\drivers\avgSnx.sys [1012952 2017-10-17] (AVG Technologies CZ, s.r.o.)
R1 avgSP; C:\Windows\system32\drivers\avgSP.sys [579584 2017-10-17] (AVG Technologies CZ, s.r.o.)
R0 avgVmm; C:\Windows\system32\drivers\avgVmm.sys [355856 2017-10-17] (AVG Technologies CZ, s.r.o.)
R1 wsddfac; C:\Windows\System32\drivers\wsddfac.sys [28376 2017-10-17] (GAS Tecnologia)
R1 wsddntf; C:\Windows\System32\DRIVERS\wsddntf.sys [36984 2016-06-16] (GAS Tecnologia)
R1 wsddpp; C:\Windows\system32\drivers\wsddpp.sys [25184 2016-06-08] (GAS Tecnologia)
R3 wsddprm; C:\Windows\system32\drivers\wsddprm.sys [25184 2016-11-07] (GAS Tecnologia)
==================== NetSvcs (Whitelisted) ===================
(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)
==================== Um Mês Criados arquivos e pastas ========
(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)
2017-10-17 11:38 - 2017-10-17 11:38 - 000579584 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgSP.sys
2017-10-17 11:38 - 2017-10-17 11:38 - 000402608 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\avgBoot.exe
2017-10-17 11:38 - 2017-10-17 11:38 - 000355856 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgVmm.sys
2017-10-17 11:38 - 2017-10-17 11:38 - 000140192 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgMonFlt.sys
2017-10-17 11:38 - 2017-10-17 11:38 - 000076832 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgRvrt.sys
2017-10-17 11:38 - 2017-10-17 11:38 - 000039424 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgHwid.sys
2017-10-17 11:38 - 2017-10-17 11:38 - 000003920 _____ C:\Windows\System32\Tasks\Antivirus Emergency Update
2017-10-17 11:38 - 2017-10-17 11:37 - 001012952 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgSnx.sys
2017-10-17 11:38 - 2017-10-17 11:35 - 000336896 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgbloga.sys
2017-10-17 11:38 - 2017-10-17 11:35 - 000314640 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgbidsdrivera.sys
2017-10-17 11:38 - 2017-10-17 11:35 - 000192584 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgbidsha.sys
2017-10-17 11:38 - 2017-10-17 11:35 - 000166624 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgbdiska.sys
2017-10-17 11:38 - 2017-10-17 11:35 - 000051336 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgbuniva.sys
2017-10-17 11:33 - 2017-10-17 11:33 - 000003600 _____ C:\Windows\System32\Tasks\AVG EUpdate Task
2017-10-17 10:50 - 2017-10-17 10:24 - 000024064 _____ C:\Windows\zoek-delete.exe
2017-10-17 10:24 - 2017-10-17 10:46 - 000000000 ____D C:\zoek_backup
2017-10-17 10:07 - 2017-10-17 12:25 - 000028376 _____ (GAS Tecnologia) C:\Windows\system32\Drivers\wsddfac.sys
2017-10-17 10:07 - 2017-10-17 10:07 - 000002912 _____ C:\Windows\System32\Tasks\Rerun Warsaw's CoreFixer
2017-10-17 10:07 - 2017-10-17 10:07 - 000000000 ___HD C:\Program Files (x86)\GAS Tecnologia
2017-10-17 10:07 - 2017-10-17 10:07 - 000000000 ___HD C:\Program Files (x86)\Diebold
2017-10-17 10:07 - 2016-11-07 14:54 - 000025184 ____N (GAS Tecnologia) C:\Windows\system32\Drivers\wsddprm.sys
2017-10-17 10:07 - 2016-06-16 18:43 - 000036984 _____ (GAS Tecnologia) C:\Windows\system32\Drivers\wsddntf.sys
2017-10-17 10:07 - 2016-06-16 18:43 - 000008811 _____ C:\Windows\system32\Drivers\wsddntf.cat
2017-10-17 10:07 - 2016-06-08 18:43 - 000025184 ____N (GAS Tecnologia) C:\Windows\system32\Drivers\wsddpp.sys
2017-10-17 10:06 - 2009-06-10 19:00 - 000000824 _____ C:\Windows\system32\Drivers\etc\hosts.tmp
2017-10-17 10:01 - 2017-10-17 12:36 - 000000000 ____D C:\FRST
2017-10-17 10:00 - 2017-10-17 10:00 - 000000000 ____D C:\Program Files (x86)\scpbrad
2017-10-10 10:01 - 2017-10-10 10:01 - 000000000 ____D C:\Sicoobnet
2017-10-10 09:56 - 2017-10-17 09:51 - 000192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-10-10 09:55 - 2017-10-10 09:55 - 000000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2017-10-10 09:55 - 2016-03-10 15:09 - 000064896 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2017-10-10 09:55 - 2016-03-10 15:08 - 000140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2017-10-10 09:55 - 2016-03-10 15:08 - 000027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-10-03 12:05 - 2017-10-17 10:14 - 000000000 ____D C:\Windows\pss
2017-09-29 14:57 - 2017-10-17 12:24 - 001690096 _____ (GlavSoft LLC.) C:\Windows\SysWOW64\crov.exe
2017-09-29 14:57 - 2017-10-17 12:24 - 000000905 _____ C:\Windows\SysWOW64\c.cer
2017-09-29 10:45 - 2017-09-29 10:45 - 000003350 _____ C:\Windows\System32\Tasks\SYSTESOURARIAPC56
2017-09-29 10:45 - 2017-09-29 10:45 - 000000376 _____ C:\Windows\SysWOW64\TESOURARIA-PCx.ocx
2017-09-29 10:45 - 2017-09-29 10:45 - 000000142 _____ C:\Windows\SysWOW64\vsppxzz5.12m.vbs
2017-09-29 10:45 - 2017-09-29 10:45 - 000000000 ____D C:\Windows\SysWOW64\Java
2017-09-29 10:45 - 2009-07-13 23:39 - 000473600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SYSTESOURARIAPC56.exe
2017-09-27 13:13 - 2017-10-16 09:34 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-09-27 13:13 - 2017-10-16 09:34 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-09-27 13:13 - 2017-10-16 09:34 - 000004544 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2017-09-27 13:13 - 2017-10-16 09:34 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2017-09-27 13:13 - 2017-10-16 09:34 - 000000000 ____D C:\Windows\system32\Macromed
2017-09-27 13:13 - 2017-10-16 09:28 - 000004396 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
==================== Um Mês Modificados arquivos e pastas ========
(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)
2017-10-17 12:32 - 2009-07-14 02:45 - 000025536 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-10-17 12:32 - 2009-07-14 02:45 - 000025536 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-10-17 12:29 - 2009-07-14 15:55 - 000705070 _____ C:\Windows\system32\prfh0416.dat
2017-10-17 12:29 - 2009-07-14 15:55 - 000146910 _____ C:\Windows\system32\prfc0416.dat
2017-10-17 12:29 - 2009-07-14 03:13 - 001633534 _____ C:\Windows\system32\PerfStringBackup.INI
2017-10-17 12:29 - 2009-07-14 01:20 - 000000000 ____D C:\Windows\inf
2017-10-17 12:23 - 2016-12-19 09:11 - 000000120 _____ C:\Windows\system32\config\netlogon.ftl
2017-10-17 12:23 - 2009-07-14 03:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-10-17 11:51 - 2017-09-14 12:51 - 000000000 ____D C:\Program Files (x86)\Avira
2017-10-17 11:37 - 2016-12-19 09:44 - 000000000 ____D C:\Program Files\Java
2017-10-17 11:36 - 2016-12-19 09:45 - 000110144 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2017-10-17 11:35 - 2016-12-19 08:20 - 000000000 ____D C:\Program Files (x86)\AVG
2017-10-17 10:45 - 2016-12-19 09:14 - 000000000 ____D C:\Users\celia
2017-10-17 10:45 - 2009-07-14 01:20 - 000000000 ___HD C:\Windows\system32\GroupPolicy
2017-10-17 10:09 - 2009-07-14 02:45 - 000434208 _____ C:\Windows\system32\FNTCACHE.DAT
2017-10-17 10:00 - 2016-12-17 11:37 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2017-10-06 12:56 - 2009-07-14 01:20 - 000000000 ____D C:\Windows\system32\NDF
2017-09-27 08:10 - 2017-09-14 13:02 - 000003122 _____ C:\Windows\System32\Tasks\Avira SystrayStartTrigger
2017-09-26 08:08 - 2016-11-09 11:01 - 000000000 ____D C:\Escolar_plus
2017-09-22 08:10 - 2009-07-14 03:09 - 000000000 ____D C:\Windows\System32\Tasks\WPD
==================== Arquivos na raiz de alguns diretórios =======
2016-12-19 09:30 - 2016-12-19 09:30 - 000000057 _____ () C:\ProgramData\Ament.ini
==================== Bamital & volsnap ======================
(Não há correção automática para arquivos que não passaram na verificação.)
C:\Windows\system32\winlogon.exe => O arquivo é assinado digitalmente
C:\Windows\system32\wininit.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\wininit.exe => O arquivo é assinado digitalmente
C:\Windows\explorer.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\explorer.exe => O arquivo é assinado digitalmente
C:\Windows\system32\svchost.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\svchost.exe => O arquivo é assinado digitalmente
C:\Windows\system32\services.exe => O arquivo é assinado digitalmente
C:\Windows\system32\User32.dll => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\User32.dll => O arquivo é assinado digitalmente
C:\Windows\system32\userinit.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\userinit.exe => O arquivo é assinado digitalmente
C:\Windows\system32\rpcss.dll => O arquivo é assinado digitalmente
C:\Windows\system32\dnsapi.dll => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\dnsapi.dll => O arquivo é assinado digitalmente
C:\Windows\system32\Drivers\volsnap.sys => O arquivo é assinado digitalmente
LastRegBack: 2017-10-10 11:13
==================== Fim de FRST.txt ============================