Publicité
Publicité
Format du document : text/plain
Prévisualisation
Resultado do exame da Farbar Recovery Scan Tool (FRST) (x64) Versão: 09.09.2018
Executado por Christian Wallace (administrador) em CHRISTIAN (12-09-2018 18:41:50)
Executando a partir de C:\Users\Christian Wallace\Downloads
Perfis Carregados: Christian Wallace (Perfis Disponíveis: Christian Wallace & Administrador)
Platform: Windows 10 Home Single Language Versão 1607 14393.1480 (X64) Idioma: Português (Brasil)
Internet Explorer Versão 11 (Navegador padrão: Chrome)
Modo da Inicialização: Normal
Tutorial da Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processos (Whitelisted) =================
(Se uma entrada for incluída na fixlist, o processo será fechado. O arquivo não será movido.)
(Microsoft Corporation) C:\Program Files\rempl\remsh.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe
(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\Monitor.exe
(Microsoft® Windows® Operating System) C:\WINDOWS\System32\Taskmgr.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\EP64.exe
(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(IObit) C:\Program Files (x86)\IObit\Driver Booster\4.5.0\Pub\PubMonitor.exe
(Microsoft Corporation) C:\Windows10Upgrade\Windows10UpgraderApp.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\Updates\16.0.10228.20080\OfficeClickToRun.exe
(Microsoft Corporation) C:\WINDOWS\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Microsoft Corporation) C:\WINDOWS\SysWOW64\wusa.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation) C:\WINDOWS\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.1439_none_7efe016621f50bd0\TiWorker.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.35063.13610.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(FG Softwares ) C:\Program Files (x86)\FG Softwares\FG Drum\FG Drum.exe
(FG Softwares ) C:\Users\Christian Wallace\AppData\Local\Temp\mrt5D76.tmp\stdrt.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registro (Whitelisted) ===========================
(Se uma entrada for incluída na fixlist, o ítem no Registro será restaurado para o padrão ou removido. O arquivo não será movido.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [18383328 2018-02-03] (Realtek Semiconductor)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [242904 2018-06-07] (AVAST Software)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2017-04-27] (Microsoft Corporation)
HKLM-x32\...\Run: [mbot_en_037050289] => [X]
HKLM-x32\...\Run: [mpck_en_005030290] => [X]
HKLM-x32\...\Run: [rec_en_245] => [X]
HKLM-x32\...\Run: [Lightshot] => C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe [225944 2016-07-11] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-09-05] (Oracle Corporation)
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATENÇÃO
HKLM\...\Winlogon: [Userinit] wscript C:\WINDOWS\run.vbs,
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4701888 2017-02-07] (Disc Soft Ltd)
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\...\Run: [Advanced SystemCare 11] => C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe [3597600 2017-09-20] (IObit)
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\...\Run: [SmartRAM] => C:\Program Files (x86)\IObit\Advanced SystemCare\Suo10_SmartRAM.exe [560416 2017-12-07] (IObit)
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\...\RunOnce: [Uninstall C:\Users\Christian Wallace\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Christian Wallace\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64"
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\...\RunOnce: [Uninstall C:\Users\Christian Wallace\AppData\Local\Microsoft\OneDrive\17.3.6390.0509] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Christian Wallace\AppData\Local\Microsoft\OneDrive\17.3.6390.0509"
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\...\MountPoints2: {38319bd3-214d-11e7-bf61-76df8238cbdb} - "E:\Office_2016_All_In_One.exe"
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\...\MountPoints2: {ad3ac490-020a-11e7-bf5d-b2f9158592f8} - "E:\LG_PC_Programs.exe"
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [37376 2016-07-16] (Microsoft Corporation)
ShellExecuteHooks: Sem Nome - {015B9650-1EA8-11E7-B5CD-64006A5CFC23} - C:\Users\Christian Wallace\AppData\Roaming\Cooqus\Gheztiontolaph.dll [147456 2017-04-15] () <==== ATENÇÃO
GroupPolicy: Restrição - Chrome <==== ATENÇÃO
CHR HKLM\SOFTWARE\Policies\Google: Restrição <==== ATENÇÃO
==================== Internet (Whitelisted) ====================
(Se um ítem for incluído na fixlist, sendo um ítem do Registro, será removido ou restaurado para o padrão.)
Winsock: Catalog5 07 C:\WINDOWS\SysWOW64\wlidNSP.dll [43520 2016-07-16] (Microsoft Corporation)
Winsock: Catalog5 08 C:\WINDOWS\SysWOW64\wlidNSP.dll [43520 2016-07-16] (Microsoft Corporation)
Winsock: Catalog5-x64 07 C:\WINDOWS\system32\wlidnsp.dll [66048 2016-07-16] (Microsoft Corporation)
Winsock: Catalog5-x64 08 C:\WINDOWS\system32\wlidnsp.dll [66048 2016-07-16] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{acf1b7c9-fad7-4337-aa64-ea188ec5f559}: [NameServer] 77.234.40.79
Tcpip\..\Interfaces\{c15a5980-427b-46f6-8b58-683bd811d9ce}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{c15a5980-427b-46f6-8b58-683bd811d9ce}: [DhcpNameServer] 192.168.1.1
Internet Explorer:
==================
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restrição <==== ATENÇÃO
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/search?FORM=INCOH1&PC=IC05&PTAG=ICO-eb661c2e
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/search?FORM=INCOH1&PC=IC05&PTAG=ICO-eb661c2e
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131079022888122504&GUID=00B194FA-6D44-B389-11D6-619E8670C616
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/search?q={searchTerms}
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/search?FORM=INCOH1&PC=IC05&PTAG=ICO-eb661c2e
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/search?q={searchTerms}
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pt-br/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-dea28497&q={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-dea28497&q={searchTerms}
SearchScopes: HKLM -> {0b4d26f6-61a8-4463-99dd-5f2fe0400fa6} URL =
SearchScopes: HKLM -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL =
SearchScopes: HKLM -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM -> {E921F400-D383-4B1B-9DE6-FCFCACFC1173} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-eb661c2e&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {E921F400-D383-4B1B-9DE6-FCFCACFC1173} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-eb661c2e&q={searchTerms}
SearchScopes: HKLM-x32 -> {3CB12E97-BDDF-4488-8C61-217335DD319F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> {d4fee3d1-1014-4db8-a824-573bf9ab51c7} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> {E921F400-D383-4B1B-9DE6-FCFCACFC1173} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-eb661c2e&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3276470861-1064914068-939901412-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-eb661c2e&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3276470861-1064914068-939901412-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-eb661c2e&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3276470861-1064914068-939901412-1001 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL =
SearchScopes: HKU\S-1-5-21-3276470861-1064914068-939901412-1001 -> {87BFF86F-BFE9-4C29-A63B-84F069F85573} URL =
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll [2017-05-22] (IObit)
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2018-06-11] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_151\bin\ssv.dll [2017-12-07] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_151\bin\jp2ssv.dll [2017-12-07] (Oracle Corporation)
BHO-x32: Dashlane BHO -> {42D79B50-CC4A-4A8E-860F-BE674AF053A2} -> C:\Users\Christian Wallace\AppData\Roaming\Dashlane\ie\Dashlanei.dll => Nenhum Arquivo
BHO-x32: IObit Surfing Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files (x86)\IObit\Advanced SystemCare\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll [2016-08-03] (IObit)
BHO-x32: IObit Ads Removal -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files (x86)\IObit\Advanced SystemCare\Surfing Protection\Adblock\Adblock.dll [2016-06-23] (IObit)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-06-07] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-06-07] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-06-07] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-06-07] (Microsoft Corporation)
Edge:
======
Edge HomeButtonPage: HKU\S-1-5-21-3276470861-1064914068-939901412-1001 -> hxxp://www.omniboxes.com/?type=hp&ts=1448636355&z=e4958baaf9bc4518ca5a7e3g3z3zab5qcc0q9c8wew&from=ient07021&uid=ST320LM001XHN-M320MBB_S2W1J5AC830421
FireFox:
========
FF DefaultProfile: 41A66E7E5EE1
FF ProfilePath: C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\41A66E7E5EE1\Profiles\lddpuliv.default [não encontrado (a)] <==== ATENÇÃO
FF ProfilePath: C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\41A66E7E5EE1\Profiles\41A66E7E5EE1 [não encontrado (a)] <==== ATENÇÃO
FF ProfilePath: C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\lddpuliv.default [2018-05-15]
FF user.js: detected! => C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\lddpuliv.default\user.js [2017-08-05]
FF Homepage: Mozilla\Firefox\Profiles\lddpuliv.default -> hxxp://www.bing.com/search?FORM=INCOH1&PC=IC04&PTAG=ICO-dea28497
FF NewTab: Mozilla\Firefox\Profiles\lddpuliv.default -> hxxp://www.yessearches.com/?ts=AHEpCHUtB3ElA0..&v=20160329&uid=E52C8A1FE09D773A61D0C3F513CF139D&ptid=pmr&mode=ffseng
FF Extension: (IObit Surfing Protection & Ads Removal) - C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\lddpuliv.default\Extensions\ascsurfingprotectionnew@iobit.com.xpi [2016-10-18] [Legacy]
FF Extension: (Dashlane) - C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\lddpuliv.default\Extensions\jetpack-extension@dashlane.com.xpi [2017-01-05] [Legacy]
FF SearchPlugin: C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\lddpuliv.default\searchplugins\bing search engine.xml [2016-08-19]
FF SearchPlugin: C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\lddpuliv.default\searchplugins\DD1B66D4.xml [2016-04-05]
FF ProfilePath: C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1 [2018-05-15]
FF user.js: detected! => C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\user.js [2017-08-05]
FF Homepage: Mozilla\Firefox\Profiles\41A66E7E5EE1 -> hxxp://www.initialpage123.com/?z=f2c53d903e695eeb64279deg3z3t4o2ocwdt9z6wat&from=dam&uid=ST320LM001XHN-M320MBB_S2W1J5AC830421&type=hp
FF NewTab: Mozilla\Firefox\Profiles\41A66E7E5EE1 -> hxxp://www.initialpage123.com/?z=f2c53d903e695eeb64279deg3z3t4o2ocwdt9z6wat&from=dam&uid=ST320LM001XHN-M320MBB_S2W1J5AC830421&type=hp
FF Extension: (IObit Surfing Protection & Ads Removal) - C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\ascsurfingprotectionnew@iobit.com.xpi [2016-10-18] [Legacy]
FF Extension: (Dashlane) - C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\jetpack-extension@dashlane.com.xpi [2017-01-05] [Legacy]
FF Extension: (Adblock Plus) - C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-11-23] [Legacy]
FF SearchPlugin: C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\searchplugins\bing search engine.xml [2016-08-19]
FF SearchPlugin: C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\searchplugins\dxhh5n33.xml [2017-04-15]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_28_0_0_126.dll [2017-12-21] ()
FF Plugin: @java.com/DTPlugin,version=11.151.2 -> C:\Program Files\Java\jre1.8.0_151\bin\dtplugin\npDeployJava1.dll [2017-12-07] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.151.2 -> C:\Program Files\Java\jre1.8.0_151\bin\plugin2\npjp2.dll [2017-12-07] (Oracle Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-03-09] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_28_0_0_126.dll [2017-12-21] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-20] (Google)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll [2013-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2018-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-23] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-23] (Google Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-03-09] (Adobe Systems)
FF Plugin HKU\S-1-5-21-3276470861-1064914068-939901412-1001: @nsroblox.roblox.com/launcher -> C:\Program Files (x86)\Roblox\Versions\version-934c86ec4aa148f0\\NPRobloxProxy.dll [2012-12-31] ( ROBLOX Corporation)
FF Plugin HKU\S-1-5-21-3276470861-1064914068-939901412-1001: @nsroblox.roblox.com/launcher64 -> C:\Program Files (x86)\Roblox\Versions\version-934c86ec4aa148f0\\NPRobloxProxy64.dll [2012-12-31] ( ROBLOX Corporation)
FF Plugin HKU\S-1-5-21-3276470861-1064914068-939901412-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Christian Wallace\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2017-05-18] (Unity Technologies ApS)
Chrome:
=======
CHR DefaultProfile: ChromeDefaultData
CHR HomePage: ChromeDefaultData -> hxxps://www.google.com.br/webhp?sourceid=chrome-instant&ion=1&ie=UTF-8&rct=j
CHR StartupUrls: ChromeDefaultData -> "hxxps://www.google.com.br/webhp?sourceid=chrome-instant&ion=1&ie=UTF-8&rct=j#q=sepa","hxxps://www.facebook.com/logout.php","hxxps://www.youtube.com/?gl=BR&hl=PT","hxxp://www.delta-homes.com/?type=hp&ts=1426151948&from=wpm03123&uid=ST320LM001XHN-M320MBB_S2W1J5AC830421","hxxp://binkiland.com/?f=7&a=bnk_bxi01_15_14&cd=2XzuyEtN2Y1L1Qzu0EzztCtCtAtB0B0BzytB0D0F0B0EtBtAtN0D0Tzu0StCtCyBzztN1L2XzutAtFzztFtAtFtCtN1L1CzutCyEtBzytDyD1V1PtN1L1G1B1V1N2Y1L1Qzu2SyBzzyDtA0AtDtD0FtG0FzyyD0CtGyE0ByCyBtGzztByD0BtGtCzytAyD0D0CzyyC0Bzz0F0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0DtA0D0FzzzytD0AtG0BtD0DtAtGyEyEtCtBtGzzyD0AyBtG0D0FtCyDyD0C0F0B0B0F0AtA2Q&cr=621722237&ir=","hxxp://www.omniboxes.com/?type=hp&ts=1447413965&z=9234ddd971be5b82d79606bgdz4z0mczdg6c8t7q1e&from=wpm07173&uid=ST320LM001XHN-M320MBB_S2W1J5AC830421"
CHR Profile: C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2018-09-12] <==== ATENÇÃO
CHR Extension: (Google Tradutor) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb [2017-10-19]
CHR Extension: (EditThisCookie) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\fngmhnnpilhplaeedifhccceomclgfbg [2018-09-12]
CHR Extension: (AdBlock) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2018-09-12]
CHR Extension: (Adam's Virtual Guitar) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\jjmglhglajnejdnihkcngheghkgpfign [2017-08-05]
CHR Extension: (ButtonBeats Guitar) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\mkcpeekapbmklcidenkpbjcpcicmjmnf [2017-08-05]
CHR Extension: (Office Online) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\ndjpnladcallmjemlbaebfadecfhkepb [2018-06-07]
CHR Extension: (Pagamentos da Chrome Web Store) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-06-07]
CHR Extension: (Auto Refresh Plus) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\oilipfekkmncanaajkapbpancpelijih [2018-06-11]
CHR Extension: (Chrome Media Router) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-09-12]
CHR Profile: C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default [2017-12-04]
CHR Extension: () - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb [2017-08-09]
CHR Extension: () - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default\Extensions\eogeabecipmckmihpmkgjbghbffcebcf [2017-08-09]
CHR Extension: () - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbliahafihjjinkdlbmchkapfmcoacdi [2017-08-09]
CHR Extension: (AdBlock) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-04-15]
CHR Extension: () - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkcpeekapbmklcidenkpbjcpcicmjmnf [2017-08-09]
CHR Extension: (Pagamentos da Chrome Web Store) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
CHR Extension: () - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default\Extensions\oilipfekkmncanaajkapbpancpelijih [2017-08-09]
CHR Extension: () - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-08-09]
CHR HKLM\...\Chrome\Extension: [coljhboelhlkbgaaolcngflenaggpeao] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [elggllhppljlljkgfeokjpehmdamkejk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [fcljdicbcnmfhekdcaobgbpjjifniemh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [kmedakdfngfmagjlndeckcbfcmidlbio] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [noajmlkipclmeolfcnflkjhijkigpfjh] - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default\Extensions\noajmlkipclmeolfcnflkjhijkigpfjh.crx [2014-11-12]
==================== Serviços (Whitelisted) ====================
(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)
S2 AdvancedSystemCareService11; C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe [1053984 2017-11-01] (IObit)
S4 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2021592 2016-04-05] (Adobe Systems, Incorporated)
S3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7620096 2018-06-07] (AVAST Software)
S4 AtherosSvc; C:\WINDOWS\system32\AdminService.exe [208384 2012-08-29] (Atheros Commnucations) [Arquivo não assinado]
S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [317280 2018-06-07] (AVAST Software)
S4 CleanupPSvc; C:\Program Files (x86)\AVAST Software\Avast Cleanup\TuneupSvc.exe [4709728 2017-12-21] (AVAST Software)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [8652976 2018-05-24] (Microsoft Corporation)
S4 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [1471168 2017-02-07] (Disc Soft Ltd)
S4 DSAService; C:\Program Files (x86)\Intel Driver Update Utility\DSAService.exe [21240 2017-07-17] (Intel)
S4 IObitUnSvr; C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe [206112 2017-06-14] (IObit)
S2 Motorola Device Manager; C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [137528 2014-04-08] (Motorola Mobility LLC)
S4 msvsmon90; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe [4466688 2007-11-07] (Microsoft Corporation)
S2 PST Service; C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [65657 2011-09-02] (Motorola) [Arquivo não assinado]
S4 SkypeUpdateEx; C:\Program Files (x86)\SkypeUpdateEx\SkypeUpdateEx.exe [167352 2016-03-21] (skype.cog.cc)
S4 SWUpdateService; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [3196768 2015-09-25] (Samsung Electronics CO., LTD.)
S4 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [256120 2016-02-01] (Synaptics Incorporated)
S3 VSStandardCollectorService140; C:\Program Files (x86)\Microsoft Visual Studio 14.0\Team Tools\DiagnosticsHub\Collector\StandardCollector.Service.exe [108776 2016-09-06] (Microsoft Corporation)
S4 wampapache64; c:\wamp64\bin\apache\apache2.4.23\bin\httpd.exe [29696 2016-07-01] (Apache Software Foundation) [Arquivo não assinado]
S4 wampmysqld64; c:\wamp64\bin\mysql\mysql5.7.14\bin\mysqld.exe [39885824 2016-07-12] () [Arquivo não assinado]
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347320 2017-04-27] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103712 2017-04-27] (Microsoft Corporation)
===================== Drivers (Whitelisted) ======================
(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)
S3 andnetadb; C:\WINDOWS\System32\Drivers\lgandnetadb.sys [31744 2013-04-18] (Google Inc) [Arquivo não assinado]
R1 aswArPot; C:\WINDOWS\System32\drivers\aswArPot.sys [196640 2018-06-07] (AVAST Software)
R1 aswbidsdriver; C:\WINDOWS\System32\drivers\aswbidsdrivera.sys [227504 2018-06-07] (AVAST Software)
R0 aswbidsh; C:\WINDOWS\System32\drivers\aswbidsha.sys [199440 2018-06-07] (AVAST Software)
R0 aswblog; C:\WINDOWS\System32\drivers\aswbloga.sys [343752 2018-06-07] (AVAST Software)
R0 aswbuniv; C:\WINDOWS\System32\drivers\aswbuniva.sys [57680 2018-06-07] (AVAST Software)
R1 aswHdsKe; C:\WINDOWS\System32\drivers\aswHdsKe.sys [234560 2018-06-07] (AVAST Software)
S3 aswHwid; C:\WINDOWS\System32\drivers\aswHwid.sys [46968 2018-06-07] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\System32\drivers\aswMonFlt.sys [159120 2018-06-07] (AVAST Software)
R1 aswRdr; C:\WINDOWS\System32\drivers\aswRdr2.sys [111360 2018-06-07] (AVAST Software)
R0 aswRvrt; C:\WINDOWS\System32\drivers\aswRvrt.sys [85968 2018-06-07] (AVAST Software)
R1 aswSnx; C:\WINDOWS\System32\drivers\aswSnx.sys [1027720 2018-06-07] (AVAST Software)
R1 aswSP; C:\WINDOWS\System32\drivers\aswSP.sys [460520 2018-06-07] (AVAST Software)
R2 aswStm; C:\WINDOWS\System32\drivers\aswStm.sys [205976 2018-06-07] (AVAST Software)
S3 aswTap; C:\WINDOWS\System32\drivers\aswTap.sys [53904 2017-04-15] (The OpenVPN Project)
R0 aswVmm; C:\WINDOWS\System32\drivers\aswVmm.sys [381552 2018-06-07] (AVAST Software)
R3 athr; C:\WINDOWS\System32\drivers\athw10x.sys [4320176 2018-02-03] (Qualcomm Atheros Communications, Inc.)
R3 BtFilter; C:\WINDOWS\system32\DRIVERS\btfilter.sys [605616 2017-12-05] (Qualcomm)
S3 cpuz138; não ImagePath
R3 cpuz143; C:\WINDOWS\temp\cpuz143\cpuz143_x64.sys [48960 2018-09-12] (CPUID)
S3 CySmb; C:\WINDOWS\System32\drivers\cysmb.sys [10752 2016-04-20] (Cypress Semiconductor, Inc.) [Arquivo não assinado]
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30264 2017-04-15] (Disc Soft Ltd)
R3 dtliteusbbus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [47672 2017-04-15] (Disc Soft Ltd)
R1 HWiNFO32; C:\WINDOWS\SysWOW64\drivers\HWiNFO64A.SYS [27552 2016-04-20] (REALiX(tm))
R3 iobit_monitor_server; C:\Program Files (x86)\IObit\Advanced SystemCare\drivers\Monitor_win10_x64.sys [24056 2017-07-18] (IObit)
S3 IUFileFilter; C:\Program Files (x86)\IObit\IObit Uninstaller\drivers\win10_amd64\IUFileFilter.sys [39904 2017-06-06] (IObit.com)
S3 IURegProcessFilter; C:\Program Files (x86)\IObit\IObit Uninstaller\drivers\win10_amd64\IURegProcessFilter.sys [39792 2017-09-28] (IObit.com)
S3 libusb0; C:\WINDOWS\system32\DRIVERS\libusb0.sys [52832 2017-01-25] (hxxp://libusb-win32.sourceforge.net)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 RadioHIDMini; C:\WINDOWS\System32\drivers\RadioHIDMini.sys [32168 2015-07-16] (Windows (R) Win 7 DDK provider)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [1010648 2017-12-05] (Realtek )
R3 rtsuvc; C:\WINDOWS\system32\DRIVERS\rtsuvc.sys [2599128 2017-08-06] (Realtek Semiconductor Corp.)
R3 ScpVBus; C:\WINDOWS\System32\drivers\ScpVBus.sys [39168 2013-05-19] (Scarlet.Crush Productions)
S3 semav6msr64; C:\WINDOWS\system32\drivers\semav6msr64.sys [21984 2016-03-09] ()
R3 SensorsSimulatorDriver; C:\WINDOWS\System32\drivers\WUDFRd.sys [216064 2016-07-16] (Microsoft Corporation)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
S2 stdmfpam; C:\Program Files (x86)\HomeTab\stdmfpam.dll [67968 2015-12-21] ()
S2 stdmfpama; C:\Program Files (x86)\HomeTab\stdmfpam.dll [67968 2015-12-21] ()
S2 stdmfpamb; C:\Program Files (x86)\HomeTab\stdmfpam.dll [67968 2015-12-21] ()
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
S3 WinRing0_1_2_0; não ImagePath
S3 X6va063; não ImagePath
S3 xhunter1; C:\WINDOWS\xhunter1.sys [47096 2017-12-12] (Wellbia.com Co., Ltd.)
S3 xspirit; C:\WINDOWS\xspirit.sys [22912 2017-02-28] ()
S3 X6va031; \??\C:\WINDOWS\SysWOW64\Drivers\X6va031 [X]
S3 X6va060; \??\C:\WINDOWS\SysWOW64\Drivers\X6va060 [X]
==================== NetSvcs (Whitelisted) ===================
(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)
==================== Três Meses Criados arquivos e pastas ========
(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)
2018-09-12 18:41 - 2018-09-12 18:44 - 000031039 _____ C:\Users\Christian Wallace\Downloads\FRST.txt
2018-09-12 18:40 - 2018-09-12 18:41 - 000000000 ____D C:\FRST
2018-09-12 18:38 - 2018-09-12 18:40 - 002413568 _____ (Farbar) C:\Users\Christian Wallace\Downloads\FRST64.exe
2018-09-12 11:42 - 2018-09-12 11:47 - 000000000 ____D C:\750b8dfda00fd3aa75acaf138184
2018-09-12 11:42 - 2018-09-12 11:42 - 000000000 ___HT C:\WINDOWS\wusa.lock
2018-09-12 11:13 - 2018-09-12 11:15 - 000000000 ___HD C:\$WINDOWS.~BT
2018-09-12 11:11 - 2018-09-12 11:11 - 000000830 _____ C:\Users\Christian Wallace\Desktop\Assistente de Atualização do Windows 10.lnk
2018-09-12 11:07 - 2018-09-12 18:31 - 000004264 _____ C:\WINDOWS\System32\Tasks\Avast Emergency Update
2018-09-12 11:06 - 2018-09-12 11:06 - 000003074 _____ C:\WINDOWS\System32\Tasks\Driver Booster SkipUAC (Christian Wallace)
2018-07-03 11:37 - 2018-07-03 11:37 - 000000000 ____D C:\WINDOWS\UpdateAssistant
==================== Três Meses Modificados arquivos e pastas ========
(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)
2018-09-12 18:29 - 2018-05-23 18:48 - 000000000 ____D C:\Windows10Upgrade
2018-09-12 18:28 - 2014-09-21 13:45 - 000563832 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2018-09-12 18:20 - 2016-07-16 08:36 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-09-12 18:18 - 2016-10-01 14:07 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-09-12 11:29 - 2016-06-21 00:46 - 000002308 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-09-12 11:17 - 2016-10-01 14:05 - 000000000 ___DC C:\WINDOWS\Panther
2018-09-12 11:11 - 2018-05-23 18:52 - 000000842 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Assistente de Atualização do Windows 10.lnk
2018-09-12 11:06 - 2016-04-20 15:56 - 000000000 ____D C:\Users\Todos os Usuários\IObit
2018-09-12 11:06 - 2016-04-20 15:56 - 000000000 ____D C:\ProgramData\IObit
2018-09-12 08:51 - 2017-12-04 18:16 - 000004284 _____ C:\WINDOWS\System32\Tasks\Avast TUNEUP Update
2018-09-12 07:27 - 2016-10-01 15:08 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
==================== Arquivos na raiz de alguns diretórios =======
2015-10-24 13:39 - 2015-11-27 11:59 - 000000098 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2015-10-24 13:39 - 2015-11-27 11:59 - 000000098 _____ () C:\Users\Todos os Usuários\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2014-09-22 23:32 - 2014-09-22 23:32 - 000000328 _____ () C:\Users\Christian Wallace\AppData\Roaming\aps.uninstall.scan.results
2016-01-05 15:39 - 2016-01-05 15:39 - 000384000 ____N () C:\Users\Christian Wallace\AppData\Roaming\Dyonanthan.exe
2016-03-17 17:59 - 2016-03-17 17:59 - 000000097 _____ () C:\Users\Christian Wallace\AppData\Roaming\LauncherSettings_live.cfg
2016-03-17 17:55 - 2016-03-17 17:56 - 000010496 _____ () C:\Users\Christian Wallace\AppData\Roaming\TheHunterSettings_live.bin
2016-03-17 17:44 - 2016-03-17 17:44 - 000000039 _____ () C:\Users\Christian Wallace\AppData\Roaming\TheHunterSettings_steam_live.cfg
2014-10-16 21:50 - 2017-02-09 23:02 - 000000419 _____ () C:\Users\Christian Wallace\AppData\Roaming\WB.CFG
2014-10-18 12:50 - 2014-10-18 12:50 - 000233515 _____ () C:\Users\Christian Wallace\AppData\Local\147048093dsi1.dat
2014-10-18 12:50 - 2014-10-18 12:50 - 000119964 _____ () C:\Users\Christian Wallace\AppData\Local\147048093dsi2.dat
2015-03-24 20:37 - 2015-03-24 20:37 - 000274045 _____ () C:\Users\Christian Wallace\AppData\Local\dsi1.dat
2015-03-24 20:37 - 2015-03-24 20:37 - 000161916 _____ () C:\Users\Christian Wallace\AppData\Local\dsi2.dat
2014-09-22 23:30 - 2014-09-22 23:30 - 000627600 _____ (ClickMeIn Limited) C:\Users\Christian Wallace\AppData\Local\nsnA011.tmp
2014-10-18 18:06 - 2016-04-08 14:43 - 000007616 _____ () C:\Users\Christian Wallace\AppData\Local\Resmon.ResmonCfg
2016-04-16 00:23 - 2016-04-16 00:23 - 000000003 _____ () C:\Users\Christian Wallace\AppData\Local\updater.log
2016-04-16 00:23 - 2017-05-29 20:42 - 000000425 _____ () C:\Users\Christian Wallace\AppData\Local\UserProducts.xml
Alguns arquivos em TEMP:
====================
2017-12-12 12:00 - 2017-12-23 20:54 - 000000000 _____ () C:\Users\Christian Wallace\AppData\Local\Temp\29c801ba6a177616225dafc56717c5e8.dll
2017-12-22 15:54 - 2017-12-22 15:54 - 000024064 _____ () C:\Users\Christian Wallace\AppData\Local\Temp\installer_x64.exe
2017-12-22 15:54 - 2017-12-22 15:54 - 000019968 _____ () C:\Users\Christian Wallace\AppData\Local\Temp\installer_x86.exe
==================== Bamital & volsnap ======================
(Não há correção automática para arquivos que não passaram na verificação.)
C:\WINDOWS\system32\winlogon.exe => O arquivo é assinado digitalmente
C:\WINDOWS\system32\wininit.exe => O arquivo é assinado digitalmente
C:\WINDOWS\explorer.exe => O arquivo é assinado digitalmente
C:\WINDOWS\SysWOW64\explorer.exe => O arquivo é assinado digitalmente
C:\WINDOWS\system32\svchost.exe => O arquivo é assinado digitalmente
C:\WINDOWS\SysWOW64\svchost.exe => O arquivo é assinado digitalmente
C:\WINDOWS\system32\services.exe => O arquivo é assinado digitalmente
C:\WINDOWS\system32\User32.dll => O arquivo é assinado digitalmente
C:\WINDOWS\SysWOW64\User32.dll => O arquivo é assinado digitalmente
C:\WINDOWS\system32\userinit.exe => O arquivo é assinado digitalmente
C:\WINDOWS\SysWOW64\userinit.exe => O arquivo é assinado digitalmente
C:\WINDOWS\system32\rpcss.dll => O arquivo é assinado digitalmente
C:\WINDOWS\system32\dnsapi.dll => O arquivo é assinado digitalmente
C:\WINDOWS\SysWOW64\dnsapi.dll => O arquivo é assinado digitalmente
C:\WINDOWS\system32\Drivers\volsnap.sys => O arquivo é assinado digitalmente
LastRegBack: 2018-06-20 21:31
==================== Fim de FRST.txt ============================
Executado por Christian Wallace (administrador) em CHRISTIAN (12-09-2018 18:41:50)
Executando a partir de C:\Users\Christian Wallace\Downloads
Perfis Carregados: Christian Wallace (Perfis Disponíveis: Christian Wallace & Administrador)
Platform: Windows 10 Home Single Language Versão 1607 14393.1480 (X64) Idioma: Português (Brasil)
Internet Explorer Versão 11 (Navegador padrão: Chrome)
Modo da Inicialização: Normal
Tutorial da Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processos (Whitelisted) =================
(Se uma entrada for incluída na fixlist, o processo será fechado. O arquivo não será movido.)
(Microsoft Corporation) C:\Program Files\rempl\remsh.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe
(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\Monitor.exe
(Microsoft® Windows® Operating System) C:\WINDOWS\System32\Taskmgr.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\EP64.exe
(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(IObit) C:\Program Files (x86)\IObit\Driver Booster\4.5.0\Pub\PubMonitor.exe
(Microsoft Corporation) C:\Windows10Upgrade\Windows10UpgraderApp.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\Updates\16.0.10228.20080\OfficeClickToRun.exe
(Microsoft Corporation) C:\WINDOWS\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Microsoft Corporation) C:\WINDOWS\SysWOW64\wusa.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation) C:\WINDOWS\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.1439_none_7efe016621f50bd0\TiWorker.exe
() C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2017.35063.13610.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(FG Softwares ) C:\Program Files (x86)\FG Softwares\FG Drum\FG Drum.exe
(FG Softwares ) C:\Users\Christian Wallace\AppData\Local\Temp\mrt5D76.tmp\stdrt.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registro (Whitelisted) ===========================
(Se uma entrada for incluída na fixlist, o ítem no Registro será restaurado para o padrão ou removido. O arquivo não será movido.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [18383328 2018-02-03] (Realtek Semiconductor)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [242904 2018-06-07] (AVAST Software)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2017-04-27] (Microsoft Corporation)
HKLM-x32\...\Run: [mbot_en_037050289] => [X]
HKLM-x32\...\Run: [mpck_en_005030290] => [X]
HKLM-x32\...\Run: [rec_en_245] => [X]
HKLM-x32\...\Run: [Lightshot] => C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe [225944 2016-07-11] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-09-05] (Oracle Corporation)
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATENÇÃO
HKLM\...\Winlogon: [Userinit] wscript C:\WINDOWS\run.vbs,
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4701888 2017-02-07] (Disc Soft Ltd)
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\...\Run: [Advanced SystemCare 11] => C:\Program Files (x86)\IObit\Advanced SystemCare\ASCTray.exe [3597600 2017-09-20] (IObit)
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\...\Run: [SmartRAM] => C:\Program Files (x86)\IObit\Advanced SystemCare\Suo10_SmartRAM.exe [560416 2017-12-07] (IObit)
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\...\RunOnce: [Uninstall C:\Users\Christian Wallace\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Christian Wallace\AppData\Local\Microsoft\OneDrive\17.3.6390.0509\amd64"
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\...\RunOnce: [Uninstall C:\Users\Christian Wallace\AppData\Local\Microsoft\OneDrive\17.3.6390.0509] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Christian Wallace\AppData\Local\Microsoft\OneDrive\17.3.6390.0509"
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\...\MountPoints2: {38319bd3-214d-11e7-bf61-76df8238cbdb} - "E:\Office_2016_All_In_One.exe"
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\...\MountPoints2: {ad3ac490-020a-11e7-bf5d-b2f9158592f8} - "E:\LG_PC_Programs.exe"
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [37376 2016-07-16] (Microsoft Corporation)
ShellExecuteHooks: Sem Nome - {015B9650-1EA8-11E7-B5CD-64006A5CFC23} - C:\Users\Christian Wallace\AppData\Roaming\Cooqus\Gheztiontolaph.dll [147456 2017-04-15] () <==== ATENÇÃO
GroupPolicy: Restrição - Chrome <==== ATENÇÃO
CHR HKLM\SOFTWARE\Policies\Google: Restrição <==== ATENÇÃO
==================== Internet (Whitelisted) ====================
(Se um ítem for incluído na fixlist, sendo um ítem do Registro, será removido ou restaurado para o padrão.)
Winsock: Catalog5 07 C:\WINDOWS\SysWOW64\wlidNSP.dll [43520 2016-07-16] (Microsoft Corporation)
Winsock: Catalog5 08 C:\WINDOWS\SysWOW64\wlidNSP.dll [43520 2016-07-16] (Microsoft Corporation)
Winsock: Catalog5-x64 07 C:\WINDOWS\system32\wlidnsp.dll [66048 2016-07-16] (Microsoft Corporation)
Winsock: Catalog5-x64 08 C:\WINDOWS\system32\wlidnsp.dll [66048 2016-07-16] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{acf1b7c9-fad7-4337-aa64-ea188ec5f559}: [NameServer] 77.234.40.79
Tcpip\..\Interfaces\{c15a5980-427b-46f6-8b58-683bd811d9ce}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{c15a5980-427b-46f6-8b58-683bd811d9ce}: [DhcpNameServer] 192.168.1.1
Internet Explorer:
==================
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restrição <==== ATENÇÃO
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/search?FORM=INCOH1&PC=IC05&PTAG=ICO-eb661c2e
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/search?FORM=INCOH1&PC=IC05&PTAG=ICO-eb661c2e
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131079022888122504&GUID=00B194FA-6D44-B389-11D6-619E8670C616
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/search?q={searchTerms}
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/search?FORM=INCOH1&PC=IC05&PTAG=ICO-eb661c2e
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/search?q={searchTerms}
HKU\S-1-5-21-3276470861-1064914068-939901412-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pt-br/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-dea28497&q={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-dea28497&q={searchTerms}
SearchScopes: HKLM -> {0b4d26f6-61a8-4463-99dd-5f2fe0400fa6} URL =
SearchScopes: HKLM -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL =
SearchScopes: HKLM -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM -> {E921F400-D383-4B1B-9DE6-FCFCACFC1173} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-eb661c2e&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {E921F400-D383-4B1B-9DE6-FCFCACFC1173} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-eb661c2e&q={searchTerms}
SearchScopes: HKLM-x32 -> {3CB12E97-BDDF-4488-8C61-217335DD319F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> {d4fee3d1-1014-4db8-a824-573bf9ab51c7} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> {E921F400-D383-4B1B-9DE6-FCFCACFC1173} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-eb661c2e&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3276470861-1064914068-939901412-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-eb661c2e&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3276470861-1064914068-939901412-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=INCOH2&PC=IC05&PTAG=ICO-eb661c2e&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3276470861-1064914068-939901412-1001 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL =
SearchScopes: HKU\S-1-5-21-3276470861-1064914068-939901412-1001 -> {87BFF86F-BFE9-4C29-A63B-84F069F85573} URL =
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll [2017-05-22] (IObit)
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2018-06-11] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_151\bin\ssv.dll [2017-12-07] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_151\bin\jp2ssv.dll [2017-12-07] (Oracle Corporation)
BHO-x32: Dashlane BHO -> {42D79B50-CC4A-4A8E-860F-BE674AF053A2} -> C:\Users\Christian Wallace\AppData\Roaming\Dashlane\ie\Dashlanei.dll => Nenhum Arquivo
BHO-x32: IObit Surfing Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files (x86)\IObit\Advanced SystemCare\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll [2016-08-03] (IObit)
BHO-x32: IObit Ads Removal -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files (x86)\IObit\Advanced SystemCare\Surfing Protection\Adblock\Adblock.dll [2016-06-23] (IObit)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-06-07] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-06-07] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-06-07] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-06-07] (Microsoft Corporation)
Edge:
======
Edge HomeButtonPage: HKU\S-1-5-21-3276470861-1064914068-939901412-1001 -> hxxp://www.omniboxes.com/?type=hp&ts=1448636355&z=e4958baaf9bc4518ca5a7e3g3z3zab5qcc0q9c8wew&from=ient07021&uid=ST320LM001XHN-M320MBB_S2W1J5AC830421
FireFox:
========
FF DefaultProfile: 41A66E7E5EE1
FF ProfilePath: C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\41A66E7E5EE1\Profiles\lddpuliv.default [não encontrado (a)] <==== ATENÇÃO
FF ProfilePath: C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\41A66E7E5EE1\Profiles\41A66E7E5EE1 [não encontrado (a)] <==== ATENÇÃO
FF ProfilePath: C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\lddpuliv.default [2018-05-15]
FF user.js: detected! => C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\lddpuliv.default\user.js [2017-08-05]
FF Homepage: Mozilla\Firefox\Profiles\lddpuliv.default -> hxxp://www.bing.com/search?FORM=INCOH1&PC=IC04&PTAG=ICO-dea28497
FF NewTab: Mozilla\Firefox\Profiles\lddpuliv.default -> hxxp://www.yessearches.com/?ts=AHEpCHUtB3ElA0..&v=20160329&uid=E52C8A1FE09D773A61D0C3F513CF139D&ptid=pmr&mode=ffseng
FF Extension: (IObit Surfing Protection & Ads Removal) - C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\lddpuliv.default\Extensions\ascsurfingprotectionnew@iobit.com.xpi [2016-10-18] [Legacy]
FF Extension: (Dashlane) - C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\lddpuliv.default\Extensions\jetpack-extension@dashlane.com.xpi [2017-01-05] [Legacy]
FF SearchPlugin: C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\lddpuliv.default\searchplugins\bing search engine.xml [2016-08-19]
FF SearchPlugin: C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\lddpuliv.default\searchplugins\DD1B66D4.xml [2016-04-05]
FF ProfilePath: C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1 [2018-05-15]
FF user.js: detected! => C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\user.js [2017-08-05]
FF Homepage: Mozilla\Firefox\Profiles\41A66E7E5EE1 -> hxxp://www.initialpage123.com/?z=f2c53d903e695eeb64279deg3z3t4o2ocwdt9z6wat&from=dam&uid=ST320LM001XHN-M320MBB_S2W1J5AC830421&type=hp
FF NewTab: Mozilla\Firefox\Profiles\41A66E7E5EE1 -> hxxp://www.initialpage123.com/?z=f2c53d903e695eeb64279deg3z3t4o2ocwdt9z6wat&from=dam&uid=ST320LM001XHN-M320MBB_S2W1J5AC830421&type=hp
FF Extension: (IObit Surfing Protection & Ads Removal) - C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\ascsurfingprotectionnew@iobit.com.xpi [2016-10-18] [Legacy]
FF Extension: (Dashlane) - C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\jetpack-extension@dashlane.com.xpi [2017-01-05] [Legacy]
FF Extension: (Adblock Plus) - C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-11-23] [Legacy]
FF SearchPlugin: C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\searchplugins\bing search engine.xml [2016-08-19]
FF SearchPlugin: C:\Users\Christian Wallace\AppData\Roaming\Mozilla\Firefox\Profiles\41A66E7E5EE1\searchplugins\dxhh5n33.xml [2017-04-15]
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_28_0_0_126.dll [2017-12-21] ()
FF Plugin: @java.com/DTPlugin,version=11.151.2 -> C:\Program Files\Java\jre1.8.0_151\bin\dtplugin\npDeployJava1.dll [2017-12-07] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.151.2 -> C:\Program Files\Java\jre1.8.0_151\bin\plugin2\npjp2.dll [2017-12-07] (Oracle Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-03-09] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_28_0_0_126.dll [2017-12-21] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-20] (Google)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll [2013-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2018-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-23] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-23] (Google Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-03-09] (Adobe Systems)
FF Plugin HKU\S-1-5-21-3276470861-1064914068-939901412-1001: @nsroblox.roblox.com/launcher -> C:\Program Files (x86)\Roblox\Versions\version-934c86ec4aa148f0\\NPRobloxProxy.dll [2012-12-31] ( ROBLOX Corporation)
FF Plugin HKU\S-1-5-21-3276470861-1064914068-939901412-1001: @nsroblox.roblox.com/launcher64 -> C:\Program Files (x86)\Roblox\Versions\version-934c86ec4aa148f0\\NPRobloxProxy64.dll [2012-12-31] ( ROBLOX Corporation)
FF Plugin HKU\S-1-5-21-3276470861-1064914068-939901412-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Christian Wallace\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2017-05-18] (Unity Technologies ApS)
Chrome:
=======
CHR DefaultProfile: ChromeDefaultData
CHR HomePage: ChromeDefaultData -> hxxps://www.google.com.br/webhp?sourceid=chrome-instant&ion=1&ie=UTF-8&rct=j
CHR StartupUrls: ChromeDefaultData -> "hxxps://www.google.com.br/webhp?sourceid=chrome-instant&ion=1&ie=UTF-8&rct=j#q=sepa","hxxps://www.facebook.com/logout.php","hxxps://www.youtube.com/?gl=BR&hl=PT","hxxp://www.delta-homes.com/?type=hp&ts=1426151948&from=wpm03123&uid=ST320LM001XHN-M320MBB_S2W1J5AC830421","hxxp://binkiland.com/?f=7&a=bnk_bxi01_15_14&cd=2XzuyEtN2Y1L1Qzu0EzztCtCtAtB0B0BzytB0D0F0B0EtBtAtN0D0Tzu0StCtCyBzztN1L2XzutAtFzztFtAtFtCtN1L1CzutCyEtBzytDyD1V1PtN1L1G1B1V1N2Y1L1Qzu2SyBzzyDtA0AtDtD0FtG0FzyyD0CtGyE0ByCyBtGzztByD0BtGtCzytAyD0D0CzyyC0Bzz0F0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0DtA0D0FzzzytD0AtG0BtD0DtAtGyEyEtCtBtGzzyD0AyBtG0D0FtCyDyD0C0F0B0B0F0AtA2Q&cr=621722237&ir=","hxxp://www.omniboxes.com/?type=hp&ts=1447413965&z=9234ddd971be5b82d79606bgdz4z0mczdg6c8t7q1e&from=wpm07173&uid=ST320LM001XHN-M320MBB_S2W1J5AC830421"
CHR Profile: C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2018-09-12] <==== ATENÇÃO
CHR Extension: (Google Tradutor) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb [2017-10-19]
CHR Extension: (EditThisCookie) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\fngmhnnpilhplaeedifhccceomclgfbg [2018-09-12]
CHR Extension: (AdBlock) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2018-09-12]
CHR Extension: (Adam's Virtual Guitar) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\jjmglhglajnejdnihkcngheghkgpfign [2017-08-05]
CHR Extension: (ButtonBeats Guitar) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\mkcpeekapbmklcidenkpbjcpcicmjmnf [2017-08-05]
CHR Extension: (Office Online) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\ndjpnladcallmjemlbaebfadecfhkepb [2018-06-07]
CHR Extension: (Pagamentos da Chrome Web Store) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-06-07]
CHR Extension: (Auto Refresh Plus) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\oilipfekkmncanaajkapbpancpelijih [2018-06-11]
CHR Extension: (Chrome Media Router) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-09-12]
CHR Profile: C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default [2017-12-04]
CHR Extension: () - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb [2017-08-09]
CHR Extension: () - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default\Extensions\eogeabecipmckmihpmkgjbghbffcebcf [2017-08-09]
CHR Extension: () - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbliahafihjjinkdlbmchkapfmcoacdi [2017-08-09]
CHR Extension: (AdBlock) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-04-15]
CHR Extension: () - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkcpeekapbmklcidenkpbjcpcicmjmnf [2017-08-09]
CHR Extension: (Pagamentos da Chrome Web Store) - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
CHR Extension: () - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default\Extensions\oilipfekkmncanaajkapbpancpelijih [2017-08-09]
CHR Extension: () - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-08-09]
CHR HKLM\...\Chrome\Extension: [coljhboelhlkbgaaolcngflenaggpeao] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [elggllhppljlljkgfeokjpehmdamkejk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [fcljdicbcnmfhekdcaobgbpjjifniemh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [kmedakdfngfmagjlndeckcbfcmidlbio] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [noajmlkipclmeolfcnflkjhijkigpfjh] - C:\Users\Christian Wallace\AppData\Local\Google\Chrome\User Data\Default\Extensions\noajmlkipclmeolfcnflkjhijkigpfjh.crx [2014-11-12]
==================== Serviços (Whitelisted) ====================
(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)
S2 AdvancedSystemCareService11; C:\Program Files (x86)\IObit\Advanced SystemCare\ASCService.exe [1053984 2017-11-01] (IObit)
S4 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2021592 2016-04-05] (Adobe Systems, Incorporated)
S3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7620096 2018-06-07] (AVAST Software)
S4 AtherosSvc; C:\WINDOWS\system32\AdminService.exe [208384 2012-08-29] (Atheros Commnucations) [Arquivo não assinado]
S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [317280 2018-06-07] (AVAST Software)
S4 CleanupPSvc; C:\Program Files (x86)\AVAST Software\Avast Cleanup\TuneupSvc.exe [4709728 2017-12-21] (AVAST Software)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [8652976 2018-05-24] (Microsoft Corporation)
S4 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [1471168 2017-02-07] (Disc Soft Ltd)
S4 DSAService; C:\Program Files (x86)\Intel Driver Update Utility\DSAService.exe [21240 2017-07-17] (Intel)
S4 IObitUnSvr; C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe [206112 2017-06-14] (IObit)
S2 Motorola Device Manager; C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [137528 2014-04-08] (Motorola Mobility LLC)
S4 msvsmon90; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe [4466688 2007-11-07] (Microsoft Corporation)
S2 PST Service; C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [65657 2011-09-02] (Motorola) [Arquivo não assinado]
S4 SkypeUpdateEx; C:\Program Files (x86)\SkypeUpdateEx\SkypeUpdateEx.exe [167352 2016-03-21] (skype.cog.cc)
S4 SWUpdateService; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [3196768 2015-09-25] (Samsung Electronics CO., LTD.)
S4 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [256120 2016-02-01] (Synaptics Incorporated)
S3 VSStandardCollectorService140; C:\Program Files (x86)\Microsoft Visual Studio 14.0\Team Tools\DiagnosticsHub\Collector\StandardCollector.Service.exe [108776 2016-09-06] (Microsoft Corporation)
S4 wampapache64; c:\wamp64\bin\apache\apache2.4.23\bin\httpd.exe [29696 2016-07-01] (Apache Software Foundation) [Arquivo não assinado]
S4 wampmysqld64; c:\wamp64\bin\mysql\mysql5.7.14\bin\mysqld.exe [39885824 2016-07-12] () [Arquivo não assinado]
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347320 2017-04-27] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103712 2017-04-27] (Microsoft Corporation)
===================== Drivers (Whitelisted) ======================
(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)
S3 andnetadb; C:\WINDOWS\System32\Drivers\lgandnetadb.sys [31744 2013-04-18] (Google Inc) [Arquivo não assinado]
R1 aswArPot; C:\WINDOWS\System32\drivers\aswArPot.sys [196640 2018-06-07] (AVAST Software)
R1 aswbidsdriver; C:\WINDOWS\System32\drivers\aswbidsdrivera.sys [227504 2018-06-07] (AVAST Software)
R0 aswbidsh; C:\WINDOWS\System32\drivers\aswbidsha.sys [199440 2018-06-07] (AVAST Software)
R0 aswblog; C:\WINDOWS\System32\drivers\aswbloga.sys [343752 2018-06-07] (AVAST Software)
R0 aswbuniv; C:\WINDOWS\System32\drivers\aswbuniva.sys [57680 2018-06-07] (AVAST Software)
R1 aswHdsKe; C:\WINDOWS\System32\drivers\aswHdsKe.sys [234560 2018-06-07] (AVAST Software)
S3 aswHwid; C:\WINDOWS\System32\drivers\aswHwid.sys [46968 2018-06-07] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\System32\drivers\aswMonFlt.sys [159120 2018-06-07] (AVAST Software)
R1 aswRdr; C:\WINDOWS\System32\drivers\aswRdr2.sys [111360 2018-06-07] (AVAST Software)
R0 aswRvrt; C:\WINDOWS\System32\drivers\aswRvrt.sys [85968 2018-06-07] (AVAST Software)
R1 aswSnx; C:\WINDOWS\System32\drivers\aswSnx.sys [1027720 2018-06-07] (AVAST Software)
R1 aswSP; C:\WINDOWS\System32\drivers\aswSP.sys [460520 2018-06-07] (AVAST Software)
R2 aswStm; C:\WINDOWS\System32\drivers\aswStm.sys [205976 2018-06-07] (AVAST Software)
S3 aswTap; C:\WINDOWS\System32\drivers\aswTap.sys [53904 2017-04-15] (The OpenVPN Project)
R0 aswVmm; C:\WINDOWS\System32\drivers\aswVmm.sys [381552 2018-06-07] (AVAST Software)
R3 athr; C:\WINDOWS\System32\drivers\athw10x.sys [4320176 2018-02-03] (Qualcomm Atheros Communications, Inc.)
R3 BtFilter; C:\WINDOWS\system32\DRIVERS\btfilter.sys [605616 2017-12-05] (Qualcomm)
S3 cpuz138; não ImagePath
R3 cpuz143; C:\WINDOWS\temp\cpuz143\cpuz143_x64.sys [48960 2018-09-12] (CPUID)
S3 CySmb; C:\WINDOWS\System32\drivers\cysmb.sys [10752 2016-04-20] (Cypress Semiconductor, Inc.) [Arquivo não assinado]
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30264 2017-04-15] (Disc Soft Ltd)
R3 dtliteusbbus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [47672 2017-04-15] (Disc Soft Ltd)
R1 HWiNFO32; C:\WINDOWS\SysWOW64\drivers\HWiNFO64A.SYS [27552 2016-04-20] (REALiX(tm))
R3 iobit_monitor_server; C:\Program Files (x86)\IObit\Advanced SystemCare\drivers\Monitor_win10_x64.sys [24056 2017-07-18] (IObit)
S3 IUFileFilter; C:\Program Files (x86)\IObit\IObit Uninstaller\drivers\win10_amd64\IUFileFilter.sys [39904 2017-06-06] (IObit.com)
S3 IURegProcessFilter; C:\Program Files (x86)\IObit\IObit Uninstaller\drivers\win10_amd64\IURegProcessFilter.sys [39792 2017-09-28] (IObit.com)
S3 libusb0; C:\WINDOWS\system32\DRIVERS\libusb0.sys [52832 2017-01-25] (hxxp://libusb-win32.sourceforge.net)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 RadioHIDMini; C:\WINDOWS\System32\drivers\RadioHIDMini.sys [32168 2015-07-16] (Windows (R) Win 7 DDK provider)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [1010648 2017-12-05] (Realtek )
R3 rtsuvc; C:\WINDOWS\system32\DRIVERS\rtsuvc.sys [2599128 2017-08-06] (Realtek Semiconductor Corp.)
R3 ScpVBus; C:\WINDOWS\System32\drivers\ScpVBus.sys [39168 2013-05-19] (Scarlet.Crush Productions)
S3 semav6msr64; C:\WINDOWS\system32\drivers\semav6msr64.sys [21984 2016-03-09] ()
R3 SensorsSimulatorDriver; C:\WINDOWS\System32\drivers\WUDFRd.sys [216064 2016-07-16] (Microsoft Corporation)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
S2 stdmfpam; C:\Program Files (x86)\HomeTab\stdmfpam.dll [67968 2015-12-21] ()
S2 stdmfpama; C:\Program Files (x86)\HomeTab\stdmfpam.dll [67968 2015-12-21] ()
S2 stdmfpamb; C:\Program Files (x86)\HomeTab\stdmfpam.dll [67968 2015-12-21] ()
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
S3 WinRing0_1_2_0; não ImagePath
S3 X6va063; não ImagePath
S3 xhunter1; C:\WINDOWS\xhunter1.sys [47096 2017-12-12] (Wellbia.com Co., Ltd.)
S3 xspirit; C:\WINDOWS\xspirit.sys [22912 2017-02-28] ()
S3 X6va031; \??\C:\WINDOWS\SysWOW64\Drivers\X6va031 [X]
S3 X6va060; \??\C:\WINDOWS\SysWOW64\Drivers\X6va060 [X]
==================== NetSvcs (Whitelisted) ===================
(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)
==================== Três Meses Criados arquivos e pastas ========
(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)
2018-09-12 18:41 - 2018-09-12 18:44 - 000031039 _____ C:\Users\Christian Wallace\Downloads\FRST.txt
2018-09-12 18:40 - 2018-09-12 18:41 - 000000000 ____D C:\FRST
2018-09-12 18:38 - 2018-09-12 18:40 - 002413568 _____ (Farbar) C:\Users\Christian Wallace\Downloads\FRST64.exe
2018-09-12 11:42 - 2018-09-12 11:47 - 000000000 ____D C:\750b8dfda00fd3aa75acaf138184
2018-09-12 11:42 - 2018-09-12 11:42 - 000000000 ___HT C:\WINDOWS\wusa.lock
2018-09-12 11:13 - 2018-09-12 11:15 - 000000000 ___HD C:\$WINDOWS.~BT
2018-09-12 11:11 - 2018-09-12 11:11 - 000000830 _____ C:\Users\Christian Wallace\Desktop\Assistente de Atualização do Windows 10.lnk
2018-09-12 11:07 - 2018-09-12 18:31 - 000004264 _____ C:\WINDOWS\System32\Tasks\Avast Emergency Update
2018-09-12 11:06 - 2018-09-12 11:06 - 000003074 _____ C:\WINDOWS\System32\Tasks\Driver Booster SkipUAC (Christian Wallace)
2018-07-03 11:37 - 2018-07-03 11:37 - 000000000 ____D C:\WINDOWS\UpdateAssistant
==================== Três Meses Modificados arquivos e pastas ========
(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)
2018-09-12 18:29 - 2018-05-23 18:48 - 000000000 ____D C:\Windows10Upgrade
2018-09-12 18:28 - 2014-09-21 13:45 - 000563832 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2018-09-12 18:20 - 2016-07-16 08:36 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-09-12 18:18 - 2016-10-01 14:07 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-09-12 11:29 - 2016-06-21 00:46 - 000002308 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-09-12 11:17 - 2016-10-01 14:05 - 000000000 ___DC C:\WINDOWS\Panther
2018-09-12 11:11 - 2018-05-23 18:52 - 000000842 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Assistente de Atualização do Windows 10.lnk
2018-09-12 11:06 - 2016-04-20 15:56 - 000000000 ____D C:\Users\Todos os Usuários\IObit
2018-09-12 11:06 - 2016-04-20 15:56 - 000000000 ____D C:\ProgramData\IObit
2018-09-12 08:51 - 2017-12-04 18:16 - 000004284 _____ C:\WINDOWS\System32\Tasks\Avast TUNEUP Update
2018-09-12 07:27 - 2016-10-01 15:08 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
==================== Arquivos na raiz de alguns diretórios =======
2015-10-24 13:39 - 2015-11-27 11:59 - 000000098 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2015-10-24 13:39 - 2015-11-27 11:59 - 000000098 _____ () C:\Users\Todos os Usuários\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2014-09-22 23:32 - 2014-09-22 23:32 - 000000328 _____ () C:\Users\Christian Wallace\AppData\Roaming\aps.uninstall.scan.results
2016-01-05 15:39 - 2016-01-05 15:39 - 000384000 ____N () C:\Users\Christian Wallace\AppData\Roaming\Dyonanthan.exe
2016-03-17 17:59 - 2016-03-17 17:59 - 000000097 _____ () C:\Users\Christian Wallace\AppData\Roaming\LauncherSettings_live.cfg
2016-03-17 17:55 - 2016-03-17 17:56 - 000010496 _____ () C:\Users\Christian Wallace\AppData\Roaming\TheHunterSettings_live.bin
2016-03-17 17:44 - 2016-03-17 17:44 - 000000039 _____ () C:\Users\Christian Wallace\AppData\Roaming\TheHunterSettings_steam_live.cfg
2014-10-16 21:50 - 2017-02-09 23:02 - 000000419 _____ () C:\Users\Christian Wallace\AppData\Roaming\WB.CFG
2014-10-18 12:50 - 2014-10-18 12:50 - 000233515 _____ () C:\Users\Christian Wallace\AppData\Local\147048093dsi1.dat
2014-10-18 12:50 - 2014-10-18 12:50 - 000119964 _____ () C:\Users\Christian Wallace\AppData\Local\147048093dsi2.dat
2015-03-24 20:37 - 2015-03-24 20:37 - 000274045 _____ () C:\Users\Christian Wallace\AppData\Local\dsi1.dat
2015-03-24 20:37 - 2015-03-24 20:37 - 000161916 _____ () C:\Users\Christian Wallace\AppData\Local\dsi2.dat
2014-09-22 23:30 - 2014-09-22 23:30 - 000627600 _____ (ClickMeIn Limited) C:\Users\Christian Wallace\AppData\Local\nsnA011.tmp
2014-10-18 18:06 - 2016-04-08 14:43 - 000007616 _____ () C:\Users\Christian Wallace\AppData\Local\Resmon.ResmonCfg
2016-04-16 00:23 - 2016-04-16 00:23 - 000000003 _____ () C:\Users\Christian Wallace\AppData\Local\updater.log
2016-04-16 00:23 - 2017-05-29 20:42 - 000000425 _____ () C:\Users\Christian Wallace\AppData\Local\UserProducts.xml
Alguns arquivos em TEMP:
====================
2017-12-12 12:00 - 2017-12-23 20:54 - 000000000 _____ () C:\Users\Christian Wallace\AppData\Local\Temp\29c801ba6a177616225dafc56717c5e8.dll
2017-12-22 15:54 - 2017-12-22 15:54 - 000024064 _____ () C:\Users\Christian Wallace\AppData\Local\Temp\installer_x64.exe
2017-12-22 15:54 - 2017-12-22 15:54 - 000019968 _____ () C:\Users\Christian Wallace\AppData\Local\Temp\installer_x86.exe
==================== Bamital & volsnap ======================
(Não há correção automática para arquivos que não passaram na verificação.)
C:\WINDOWS\system32\winlogon.exe => O arquivo é assinado digitalmente
C:\WINDOWS\system32\wininit.exe => O arquivo é assinado digitalmente
C:\WINDOWS\explorer.exe => O arquivo é assinado digitalmente
C:\WINDOWS\SysWOW64\explorer.exe => O arquivo é assinado digitalmente
C:\WINDOWS\system32\svchost.exe => O arquivo é assinado digitalmente
C:\WINDOWS\SysWOW64\svchost.exe => O arquivo é assinado digitalmente
C:\WINDOWS\system32\services.exe => O arquivo é assinado digitalmente
C:\WINDOWS\system32\User32.dll => O arquivo é assinado digitalmente
C:\WINDOWS\SysWOW64\User32.dll => O arquivo é assinado digitalmente
C:\WINDOWS\system32\userinit.exe => O arquivo é assinado digitalmente
C:\WINDOWS\SysWOW64\userinit.exe => O arquivo é assinado digitalmente
C:\WINDOWS\system32\rpcss.dll => O arquivo é assinado digitalmente
C:\WINDOWS\system32\dnsapi.dll => O arquivo é assinado digitalmente
C:\WINDOWS\SysWOW64\dnsapi.dll => O arquivo é assinado digitalmente
C:\WINDOWS\system32\Drivers\volsnap.sys => O arquivo é assinado digitalmente
LastRegBack: 2018-06-20 21:31
==================== Fim de FRST.txt ============================