Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:08-10-2015
Ran by Gustavo (administrator) on GUSTAVO (09-10-2015 22:13:46)
Running from C:\Users\Gustavo\Downloads
Loaded Profiles: UpdatusUser & Gustavo (Available Profiles: UpdatusUser & Gustavo & Convidado)
Platform: Windows 8.1 Single Language (X64) Language: Português (Brasil)
Internet Explorer Version 11 (Default browser: "C:\Program Files (x86)\baidu\Spark\Spark.exe" -- "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
() C:\Program Files (x86)\0892CCEA-3029-46F2-BD98-F3177431F5F8\xtloowpkjv64.exe
() C:\Users\Gustavo\AppData\Local\Crsoft\crsvc.exe
() C:\Users\Gustavo\AppData\Roaming\DNSHelper\DNSSVC.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe
(QNT) C:\Windows\SysWOW64\NetService\netservice.exe
(Baidu Inc.) C:\Program Files (x86)\baidu\Spark\sparkservice.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
() C:\Program Files (x86)\WeatherTool\2.0.0.10766\WeatherService.exe
() C:\Program Files\005\vulsrsebjh64.exe
(DTools LIMITED) C:\ProgramData\OWdsManProO\WdsManPro.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.6.0.27\ccsvchst.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Samsung Electronics CO., LTD.) C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.6.0.27\ccsvchst.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe
(ShenZhen Enode Techology co,.Ltd) C:\Program Files (x86)\WeatherTool\2.0.0.10766\weather.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\sSettings.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Qualcomm Atheros) C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(A.E.T. Europe B.V.) C:\Windows\System32\aetcrss1.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(GOOBZO) C:\Program Files (x86)\YouTube Accelerator\YouTubeAccelerator.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(© 2015 Microsoft Corporation) C:\Users\Gustavo\AppData\Local\Microsoft\BingSvc\BingSvc.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.163\SSScheduler.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\S Agent\CommonAgent.exe
() C:\Program Files\Samsung\Support Center\GuaranaAgent.exe
(Baidu.com, Inc.) C:\Program Files (x86)\baidu\Spark\sparkupdate.exe
() C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe
() C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe
() C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugins\10\Plugin.exe
() C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugins\2\Plugin.exe
() C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugins\5\Plugin.exe
() C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugins\12\Plugin.exe
() C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugins\3\Plugin.exe
() C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugins\12\Plugin.exe
() C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugins\3\Plugin.exe
() C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugins\7\Plugin.exe
() C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugins\7\Plugin.exe
() C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugins\8\Plugin.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13191312 2012-08-07] (Realtek Semiconductor)
HKLM\...\Run: [BtTray] => C:\Program Files (x86)\Bluetooth Suite\BtTray.exe [764032 2012-08-10] (Qualcomm Atheros)
HKLM\...\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [127616 2012-08-10] (Atheros Communications)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3940040 2015-06-12] (Synaptics Incorporated)
HKLM\...\Run: [CertificateRegistration] => C:\windows\system32\aetcrss1.exe [191488 2011-04-20] (A.E.T. Europe B.V.)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-13] (Intel Corporation)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2995904 2012-07-10] (Symantec Corporation)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-12] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [97392 2012-08-15] (CyberLink Corp.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [36710768 2015-10-01] (Dropbox, Inc.)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\ GbPluginUni: C:\Program Files (x86)\GbPlugin\gbiehUni.dll [2014-05-05] (Banco Itaú Unibanco)
HKU\S-1-5-21-2311927973-3537350689-1432087344-1001\...\Run: [Facebook Update] => "C:\Users\Gustavo\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
HKU\S-1-5-21-2311927973-3537350689-1432087344-1001\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [516608 2014-10-28] (Microsoft Corporation)
HKU\S-1-5-21-2311927973-3537350689-1432087344-1002\...\Run: [GoobzoYouTubeAccelerator] => C:\Program Files (x86)\YouTube Accelerator\YouTubeAccelerator.exe [2218856 2014-07-23] (GOOBZO)
HKU\S-1-5-21-2311927973-3537350689-1432087344-1002\...\Run: [Viber] => "C:\Users\Gustavo\AppData\Local\Viber\Viber.exe"
HKU\S-1-5-21-2311927973-3537350689-1432087344-1002\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [57981568 2015-09-28] (Skype Technologies S.A.)
HKU\S-1-5-21-2311927973-3537350689-1432087344-1002\...\Run: [BingSvc] => C:\Users\Gustavo\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-04-07] (© 2015 Microsoft Corporation)
AppInit_DLLs: C:\Program Files => C:\Program Files [0 2015-09-15] ()
ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399008} - C:\Program Files (x86)\GbPlugin\gbiehuni.dll [1586744 2014-05-05] (Banco Itaú Unibanco)
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-10-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-10-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-10-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-10-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-10-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-10-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-10-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.27.dll [2015-10-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-10-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-10-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-10-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-10-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-10-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-10-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-10-01] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.27.dll [2015-10-01] (Dropbox, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2014-12-23]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.163\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Convidado\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\COOL.vbs [2014-03-29] ()
Startup: C:\Users\Convidado\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Enviar para o OneNote.lnk [2014-02-25]
ShortcutTarget: Enviar para o OneNote.lnk -> C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe (Microsoft Corporation)
Startup: C:\Users\Gustavo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Enviar para o OneNote.lnk [2013-05-07]
ShortcutTarget: Enviar para o OneNote.lnk -> C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe (Microsoft Corporation)
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{347ECC0F-6BDF-4A97-AD01-EF5CCD95EFFC}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{E757FE2C-39E1-44C0-9B4A-B6EE5007D5A4}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.123rede.com?oem=sv1&uid=J1120021DG88DA_HitachiHTS547550A9E384&tm=1443723494
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.123rede.com?oem=sv1&uid=J1120021DG88DA_HitachiHTS547550A9E384&tm=1443723494
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.123rede.com?oem=sv1&uid=J1120021DG88DA_HitachiHTS547550A9E384&tm=1443723494
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.123rede.com?oem=sv1&uid=J1120021DG88DA_HitachiHTS547550A9E384&tm=1443723494
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=MSE1
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://go.microsoft.com/fwlink/?LinkID=226786&Mkt=pt-BR&Src=WD8&Tid=800342AA&OHP=http%3A%2F%2Fwww.google.com&OSP=
HKU\S-1-5-21-2311927973-3537350689-1432087344-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=MSE1
HKU\S-1-5-21-2311927973-3537350689-1432087344-1001\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://go.microsoft.com/fwlink/?LinkID=226786&Mkt=en-GB&Src=WD8&Tid=800342AA&OHP=http%3A%2F%2Fgo.microsoft.com%2Ffwlink%2Fp%2F%3FLinkId%3D255141&OSP=
HKU\S-1-5-21-2311927973-3537350689-1432087344-1002\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://br.search.yahoo.com/yhs/search?hspart=nzn&hsimp=yhs-bund2&p={searchTerms}
HKU\S-1-5-21-2311927973-3537350689-1432087344-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=SK2M&ocid=SK2MDHP&osmkt=pt-br
HKU\S-1-5-21-2311927973-3537350689-1432087344-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.123rede.com?oem=sv1&uid=J1120021DG88DA_HitachiHTS547550A9E384&tm=1443723494
HKU\S-1-5-21-2311927973-3537350689-1432087344-1002\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKU\S-1-5-21-2311927973-3537350689-1432087344-1002\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKU\S-1-5-21-2311927973-3537350689-1432087344-1002\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxps://br.search.yahoo.com/yhs/web?hspart=nzn&hsimp=yhs-bund2
HKU\S-1-5-21-2311927973-3537350689-1432087344-1002\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://go.microsoft.com/fwlink/?LinkID=226786&Mkt=pt-BR&Src=WD8&Tid=800342AA&OHP=www.jogostempo.com%3Foem%3Dbrsoftv3%26uid%3DJ1120021DG88DA%5FHitachiHTS547550A9E384%26tm%3D1424272994&OSP=
HKU\S-1-5-21-2311927973-3537350689-1432087344-1002\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = www.123rede.com?oem=sv1&uid=J1120021DG88DA_HitachiHTS547550A9E384&tm=1443723494
SearchScopes: HKLM -> {86c83f9e-48a4-4cd2-a763-64fea5df35f7} URL = hxxp://br.yhs4.search.yahoo.com/yhs/search?hspart=baixaki&hsimp=yhs-baixaki_br_installcore_02&type=y&p={searchTerms}
SearchScopes: HKLM-x32 -> {86c83f9e-48a4-4cd2-a763-64fea5df35f7} URL = hxxp://br.yhs4.search.yahoo.com/yhs/search?hspart=baixaki&hsimp=yhs-baixaki_br_installcore_02&type=y&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2311927973-3537350689-1432087344-1001 -> DefaultScope {86c83f9e-48a4-4cd2-a763-64fea5df35f7} URL = 
SearchScopes: HKU\S-1-5-21-2311927973-3537350689-1432087344-1001 -> {86c83f9e-48a4-4cd2-a763-64fea5df35f7} URL = 
SearchScopes: HKU\S-1-5-21-2311927973-3537350689-1432087344-1001 -> {A1B24F64-A61A-4E03-A031-A19B11173500} URL = 
SearchScopes: HKU\S-1-5-21-2311927973-3537350689-1432087344-1002 -> DefaultScope Web URL = hxxps://br.search.yahoo.com/yhs/search?hspart=nzn&hsimp=yhs-bund2&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2311927973-3537350689-1432087344-1002 -> Web URL = hxxps://br.search.yahoo.com/yhs/search?hspart=nzn&hsimp=yhs-bund2&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2311927973-3537350689-1432087344-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SK2MDF&PC=SK2M&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2311927973-3537350689-1432087344-1002 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKU\S-1-5-21-2311927973-3537350689-1432087344-1002 -> {86c83f9e-48a4-4cd2-a763-64fea5df35f7} URL = hxxp://br.yhs4.search.yahoo.com/yhs/search?hspart=baixaki&hsimp=yhs-baixaki_br_installcore_02&type=y&p={searchTerms}
SearchScopes: HKU\S-1-5-21-2311927973-3537350689-1432087344-1002 -> {A1B24F64-A61A-4E03-A031-A19B11173500} URL = 
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-08-04] (Microsoft Corporation)
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2012-08-10] (Qualcomm Atheros Commnucations)
BHO: No Name -> {A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} ->  No File
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-09-11] (Microsoft Corporation)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\20.6.0.27\coIEPlg.dll [2015-06-29] (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\20.6.0.27\IPS\IPSBHO.DLL [2013-04-08] (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-07-11] (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540008} -> C:\Program Files (x86)\GbPlugin\gbiehuni.dll [2014-05-05] (Banco Itaú Unibanco)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-07-11] (Oracle Corporation)
BHO-x32: Jungle Net -> {dcfb5bfe-1f58-4b1d-96a7-3c7bbae51b36} -> C:\Program Files (x86)\Jungle Net\Extensions\dcfb5bfe-1f58-4b1d-96a7-3c7bbae51b36.dll [2015-10-07] ()
BHO-x32: AllDaySavings -> {fbdff406-2c4c-5d35-8469-34bb67ea3353} -> C:\Program Files\D20A6820-7C28-4015-945F-09F8551FCE45\kzhxnitccw.dll [2014-07-28] ()
Toolbar: HKLM-x32 - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe www.jogostempo.com?oem=brsoftv3&uid=J1120021DG88DA_HitachiHTS547550A9E384&tm=1424272994

FireFox:
========
FF ProfilePath: C:\Users\Gustavo\AppData\Roaming\Mozilla\Firefox\Profiles\uxf4416g.default
FF NewTab: chrome://quick_start/content/index.html
FF DefaultSearchEngine: istartsurf
FF SearchEngineOrder.3: Bing 
FF SelectedSearchEngine: istartsurf
FF Homepage: hxxp://www.msn.com/?pc=SK2M&ocid=SK2MDHP&osmkt=pt-br
hxxp://www.istartsurf.com/?type=hp&ts=1444240900&z=59b9e3a11cfd35ffb89c55fg0z8zczbobz4eaqft9q&from=cornl&uid=HitachiXHTS547550A9E384_J1120021DG88DADG88DAX
FF Keyword.URL: hxxp://www.bing.com/search?FORM=SK2MDF&PC=SK2M&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_185.dll [2015-09-22] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_185.dll [2015-09-22] ()
FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-07-11] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-07-11] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2013-12-15] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-07-27] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-18] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-07-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2311927973-3537350689-1432087344-1002: gastecnologia.com.br/sf/uni -> C:\Users\Gustavo\AppData\Local\GAS Tecnologia\GBBD\npsf_uni.dll [2014-03-27] (GAS Tecnologia)
FF user.js: detected! => C:\Users\Gustavo\AppData\Roaming\Mozilla\Firefox\Profiles\uxf4416g.default\user.js [2015-10-07]
FF SearchPlugin: C:\Users\Gustavo\AppData\Roaming\Mozilla\Firefox\Profiles\uxf4416g.default\searchplugins\bing-.xml [2015-10-09]
FF SearchPlugin: C:\Users\Gustavo\AppData\Roaming\Mozilla\Firefox\Profiles\uxf4416g.default\searchplugins\istartsurf.xml [2015-10-09]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\SearchTheWeb.xml [2015-01-23]
FF Extension: Bing Search - C:\Users\Gustavo\AppData\Roaming\Mozilla\Firefox\Profiles\uxf4416g.default\Extensions\bingsearch.full@microsoft.com [2015-10-07]
FF Extension: Default SearchProtected  - C:\Users\Gustavo\AppData\Roaming\Mozilla\Firefox\Profiles\uxf4416g.default\Extensions\defsearchp@gmail.com [2015-10-07]
FF Extension: deskCut - C:\Users\Gustavo\AppData\Roaming\Mozilla\Firefox\Profiles\uxf4416g.default\Extensions\deskCutv2@gmail.com [2015-10-07]
FF Extension: Jungle Net - C:\Users\Gustavo\AppData\Roaming\Mozilla\Firefox\Profiles\uxf4416g.default\Extensions\{27198e32-9f26-4000-8352-13ebbebb1d2c}.xpi [2015-10-07]
FF Extension: Adblock Plus - C:\Users\Gustavo\AppData\Roaming\Mozilla\Firefox\Profiles\uxf4416g.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-06-10]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-05-01]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\coFFPlgn [2015-10-07]
FF HKLM-x32\...\Firefox\Extensions: [{4963C948-9C4E-40B8-9291-CE0234B47210}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\coFFPlgn
FF HKLM-x32\...\Firefox\Extensions: [defsearchp@gmail.com] - C:\Users\Gustavo\AppData\Roaming\Mozilla\Firefox\Profiles\uxf4416g.default\extensions\defsearchp@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\Gustavo\AppData\Roaming\Mozilla\Firefox\Profiles\uxf4416g.default\extensions\deskCutv2@gmail.com
StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.istartsurf.com/?type=sc&ts=1444240900&z=59b9e3a11cfd35ffb89c55fg0z8zczbobz4eaqft9q&from=cornl&uid=HitachiXHTS547550A9E384_J1120021DG88DADG88DAX

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.msn.com/?pc=__PARAM__&ocid=__PARAM__DHP&osmkt=pt-br
CHR StartupUrls: Default -> "hxxp://www.google.com/","hxxp://www.istartsurf.com/?type=hp&ts=1444240900&z=59b9e3a11cfd35ffb89c55fg0z8zczbobz4eaqft9q&from=cornl&uid=HitachiXHTS547550A9E384_J1120021DG88DADG88DAX"
CHR DefaultSearchURL: Default -> hxxp://www.istartsurf.com/web/?type=ds&ts=1444240900&z=59b9e3a11cfd35ffb89c55fg0z8zczbobz4eaqft9q&from=cornl&uid=HitachiXHTS547550A9E384_J1120021DG88DADG88DAX&q={searchTerms}
CHR DefaultSearchKeyword: Default -> istartsurf
CHR Profile: C:\Users\Gustavo\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Adblock Plus) - C:\Users\Gustavo\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-06-10]
CHR Extension: (Jungle Net) - C:\Users\Gustavo\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnmihnbcolkckpfmjbmlmhpafbdcaclb [2015-10-07]
CHR Extension: (Bing) - C:\Users\Gustavo\AppData\Local\Google\Chrome\User Data\Default\Extensions\fcfenmboojpjinhpgggodefccipikbpd [2015-10-07]
CHR Extension: (ABP AdBlock Plus) - C:\Users\Gustavo\AppData\Local\Google\Chrome\User Data\Default\Extensions\iednhhlkbjnhhfekkmiomcifoedpgelp [2014-08-10]
CHR Extension: (EasyCalendar) - C:\Users\Gustavo\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcgcoifbkbphhjnekfkmohklfaimhikk [2015-10-07]
CHR Extension: (Adblock Super) - C:\Users\Gustavo\AppData\Local\Google\Chrome\User Data\Default\Extensions\knebimhcckndhiglamoabbnifdkijidd [2014-12-07]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Gustavo\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-10]
CHR Extension: (Skype Click to Call) - C:\Users\Gustavo\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-10-07]
CHR Extension: (Pagamentos da Chrome Web Store) - C:\Users\Gustavo\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-10]
CHR Extension: (GBBD Caixa Economica Federal) - C:\Users\Gustavo\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbcaplhfkihhldmlbjhgajdeghjdbffi [2015-09-11]
CHR HKLM\...\Chrome\Extension: [bejnhdlplbjhffionohbdnpcbobfejcc] - C:\Program Files (x86)\Norton Internet Security\Engine\20.6.0.27\Exts\Chrome.crx [2014-12-09]
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-2311927973-3537350689-1432087344-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bejnhdlplbjhffionohbdnpcbobfejcc] - C:\Program Files (x86)\Norton Internet Security\Engine\20.6.0.27\Exts\Chrome.crx [2014-12-09]
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]
StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.istartsurf.com/?type=sc&ts=1444240900&z=59b9e3a11cfd35ffb89c55fg0z8zczbobz4eaqft9q&from=cornl&uid=HitachiXHTS547550A9E384_J1120021DG88DADG88DAX

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations) [File not signed]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2774104 2015-09-11] (Microsoft Corporation)
R2 CouponarificService64; C:\Program Files (x86)\0892CCEA-3029-46F2-BD98-F3177431F5F8\xtloowpkjv64.exe [186368 2014-11-19] () [File not signed]
R2 Crashhd; C:\Users\Gustavo\AppData\Local\Crsoft\crsvc.exe [185800 2015-10-01] ()
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [136048 2015-07-29] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [136048 2015-07-29] (Dropbox, Inc.)
R2 DNSSVC; C:\Users\Gustavo\AppData\Roaming\DNSHelper\DNSSVC.exe [142792 2015-09-08] ()
R2 Easy Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe [1593976 2012-09-05] (Samsung Electronics CO., LTD.)
R2 GbpSv; C:\Program Files (x86)\GbPlugin\gbpsv.exe [527928 2014-05-05] (GAS Tecnologia)
S3 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [178312 2015-09-25] (Intel Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.163\McCHSvc.exe [289256 2015-07-31] (McAfee, Inc.)
R2 MyLocalService; C:\WINDOWS\SysWOW64\NetService\netservice.exe [226888 2015-01-20] (QNT)
S2 NetDNS; C:\Users\Gustavo\AppData\Roaming\NetTemp\SysDnsSvc.exe [173088 2015-07-08] ()
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.6.0.27\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [3939008 2012-07-10] (Symantec Corporation)
R2 Service Mgr JungleNet; C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe [1048288 2015-10-09] ()
R2 SparkSvc; C:\Program Files (x86)\baidu\Spark\sparkservice.exe [97080 2015-08-17] (Baidu Inc.)
S3 SparkUpdater; C:\Program Files (x86)\Baidu\SparkUpdate\Sparkupdate.exe [1359040 2014-12-18] (Baidu.com, Inc.) [File not signed]
R2 SWUpdateService; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [3020632 2014-04-04] (Samsung Electronics CO., LTD.)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [246464 2015-06-12] (Synaptics Incorporated)
R2 TheDesktopWeatherService; C:\Program Files (x86)\WeatherTool\2.0.0.10766\WeatherService.exe [149752 2015-07-21] ()
R2 Update Mgr JungleNet; C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe [613600 2015-10-09] ()
R2 vulsrsebjh64; C:\Program Files\005\vulsrsebjh64.exe [709120 2014-07-23] () [File not signed]
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
R2 WdsManPro; C:\ProgramData\OWdsManProO\WdsManPro.exe [442504 2015-10-07] (DTools LIMITED)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-08-10] (Atheros) [File not signed]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\BASHDefs\20151005.001\BHDrvx64.sys [1650936 2015-07-23] (Symantec Corporation)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-09-24] (Microsoft Corporation)
R1 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0401000.00B\ccSetx64.sys [168608 2012-05-25] (Symantec Corporation)
R3 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1406000.01B\ccSetx64.sys [169048 2013-04-15] (Symantec Corporation)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-24] (CyberLink)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R3 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [498512 2015-07-28] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [153936 2015-07-28] (Symantec Corporation)
R3 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\IPSDefs\20151009.001\IDSvia64.sys [767216 2015-09-22] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\VirusDefs\20151009.003\ENG64.SYS [138488 2015-10-05] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\VirusDefs\20151009.003\EX64.SYS [2146040 2015-10-05] (Symantec Corporation)
R1 netfilter64; C:\Windows\System32\drivers\netfilter64.sys [41168 2014-11-19] (NetFilterSDK.com)
R3 RadioHIDMini; C:\Windows\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows (R) Win 7 DDK provider)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2013-01-13] (Windows (R) 2003 DDK 3790 provider)
S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1406000.01B\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R3 SRTSPX; C:\Windows\system32\drivers\NISx64\1406000.01B\SRTSPX64.SYS [36952 2013-03-04] (Symantec Corporation)
R3 SymDS; C:\Windows\system32\drivers\NISx64\1406000.01B\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R3 SymEFA; C:\Windows\system32\drivers\NISx64\1406000.01B\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
S4 SymELAM; C:\Windows\system32\drivers\NISx64\1406000.01B\SymELAM.sys [23448 2012-06-20] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-19] (Symantec Corporation)
R3 SymIRON; C:\Windows\system32\drivers\NISx64\1406000.01B\Ironx64.SYS [224416 2013-03-04] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1406000.01B\SYMNETS.SYS [433752 2013-04-24] (Symantec Corporation)
S3 SzCCID; C:\Windows\system32\DRIVERS\SzCCID.sys [40448 2011-01-21] (Generic)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
R1 {3211ae5b-d056-4176-9f6e-b51496f003f1}w64; C:\Windows\System32\drivers\{3211ae5b-d056-4176-9f6e-b51496f003f1}w64.sys [48776 2014-12-13] (StdLib)
R1 {3283b201-5c22-4a7d-8767-24ec5d376ea3}w64; C:\Windows\System32\drivers\{3283b201-5c22-4a7d-8767-24ec5d376ea3}w64.sys [48776 2014-12-08] (StdLib)
R1 {47a3b56f-80e6-4ea5-8093-7656ffd5c11a}w64; C:\Windows\System32\drivers\{47a3b56f-80e6-4ea5-8093-7656ffd5c11a}w64.sys [48776 2014-12-14] (StdLib)
R1 {4f2819d0-bef1-4b68-bead-13848229eb6f}w64; C:\Windows\System32\drivers\{4f2819d0-bef1-4b68-bead-13848229eb6f}w64.sys [48776 2014-12-03] (StdLib)
R1 {8aefbcaf-640f-4dca-9a92-ed05ee387238}w64; C:\Windows\System32\drivers\{8aefbcaf-640f-4dca-9a92-ed05ee387238}w64.sys [48776 2014-12-22] (StdLib)
R1 {993baf86-643c-42e9-95e5-094f337533f0}w64; C:\Windows\System32\drivers\{993baf86-643c-42e9-95e5-094f337533f0}w64.sys [48776 2014-12-18] (StdLib)
R1 {a0eab6f4-c7be-497b-981b-51b21c0122f7}w64; C:\Windows\System32\drivers\{a0eab6f4-c7be-497b-981b-51b21c0122f7}w64.sys [48776 2014-12-05] (StdLib)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-10-09 22:13 - 2015-10-09 22:14 - 00037579 _____ C:\Users\Gustavo\Downloads\FRST.txt
2015-10-09 22:12 - 2015-10-09 22:14 - 00000000 ____D C:\FRST
2015-10-09 22:12 - 2015-10-09 22:12 - 02194944 _____ (Farbar) C:\Users\Gustavo\Downloads\FRST64.exe
2015-10-09 22:11 - 2015-10-09 22:11 - 01698304 _____ (Farbar) C:\Users\Gustavo\Downloads\FRST.exe
2015-10-08 12:48 - 2015-10-08 12:48 - 00000000 ____D C:\Users\UpdatusUser\AppData\Local\Google
2015-10-07 17:41 - 2015-10-07 17:41 - 00000000 ____D C:\Users\Gustavo\Tracing
2015-10-07 17:26 - 2015-10-07 17:26 - 00000000 ____D C:\Users\Gustavo\AppData\Local\Skype
2015-10-07 17:25 - 2015-10-09 21:59 - 00000000 ____D C:\Users\Gustavo\AppData\Roaming\Skype
2015-10-07 17:25 - 2015-10-07 17:36 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-10-07 17:25 - 2015-10-07 17:25 - 00002715 _____ C:\Users\Public\Desktop\Skype.lnk
2015-10-07 17:25 - 2015-10-07 17:25 - 00000000 ____D C:\Users\Todos os Usuários\Skype
2015-10-07 17:25 - 2015-10-07 17:25 - 00000000 ____D C:\ProgramData\Skype
2015-10-07 17:25 - 2015-10-07 17:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-10-07 17:23 - 2015-10-07 17:23 - 01503872 _____ (Skype Technologies S.A.) C:\Users\Gustavo\Downloads\SkypeSetup.exe
2015-10-07 15:07 - 2015-10-07 15:14 - 00000000 ____D C:\Users\Gustavo\AppData\Local\Lenovo
2015-10-07 15:06 - 2015-10-07 15:14 - 00000000 ____D C:\Program Files (x86)\Lenovo
2015-10-07 15:06 - 2015-10-07 15:06 - 00000000 ____D C:\WINDOWS\System32\Tasks\Lenovo
2015-10-07 15:06 - 2015-10-07 15:06 - 00000000 ____D C:\WINDOWS\Downloaded Installations
2015-10-07 15:05 - 2015-10-07 15:06 - 00000000 ____D C:\Users\Todos os Usuários\OWdsManProO
2015-10-07 15:05 - 2015-10-07 15:06 - 00000000 ____D C:\ProgramData\OWdsManProO
2015-10-07 15:05 - 2015-10-07 15:05 - 00000102 _____ C:\Users\Todos os Usuários\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2015-10-07 15:05 - 2015-10-07 15:05 - 00000102 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2015-10-07 15:04 - 2015-10-07 15:05 - 00000000 ____D C:\Users\Gustavo\AppData\Roaming\istartsurf
2015-10-07 15:04 - 2015-10-07 15:04 - 00000000 ____D C:\Users\UpdatusUser\AppData\Roaming\Baidu
2015-10-07 15:02 - 2015-10-08 12:33 - 00000000 ____D C:\Users\Gustavo\AppData\Roaming\WeatherTool
2015-10-07 15:02 - 2015-10-07 15:02 - 00000000 ____D C:\Users\Public\Documents\Guid
2015-10-07 15:02 - 2015-10-07 15:02 - 00000000 ____D C:\Program Files (x86)\WeatherTool
2015-10-07 15:01 - 2015-10-09 13:04 - 00000000 ____D C:\Users\Todos os Usuários\31f7a620-acbd-4f84-82db-5e231b8ad5de
2015-10-07 15:01 - 2015-10-09 13:04 - 00000000 ____D C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de
2015-10-07 15:01 - 2015-10-07 15:02 - 00000000 ____D C:\Program Files (x86)\Jungle Net
2015-10-07 15:01 - 2015-10-07 15:00 - 01349943 _____ C:\Users\Gustavo\Downloads\skype-voice-changer-32-bits.zip
2015-10-07 14:58 - 2015-10-07 14:59 - 01093439 _____ C:\Users\Gustavo\Downloads\installer.zip
2015-10-06 16:26 - 2015-10-06 16:26 - 00000900 _____ C:\Users\Gustavo\Desktop\LUCAS iNDENIZAÇÃO - Atalho.lnk
2015-10-06 12:58 - 2015-10-06 12:58 - 00016999 _____ C:\Users\Gustavo\Downloads\EDITAL VERTICALIZADO - TJDFT Constitucional.xlsx
2015-10-05 18:52 - 2015-10-05 18:52 - 01081058 _____ C:\Users\Gustavo\Downloads\051020151718425320 (2).zip
2015-10-05 18:52 - 2015-10-05 18:52 - 01081058 _____ C:\Users\Gustavo\Downloads\051020151718425320 (1).zip
2015-10-05 18:51 - 2015-10-05 18:52 - 01081058 _____ C:\Users\Gustavo\Downloads\051020151718425320.zip
2015-10-05 13:42 - 2015-10-05 13:42 - 00677384 _____ C:\Users\Gustavo\Downloads\29092014162703150 (1).rar
2015-10-05 13:41 - 2015-10-05 13:41 - 00677384 _____ C:\Users\Gustavo\Downloads\29092014162703150.rar
2015-10-03 14:44 - 2015-10-03 14:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-10-02 16:32 - 2015-10-02 16:32 - 00000000 ____D C:\WINDOWS\System32\Tasks\Norton Internet Security
2015-10-01 15:18 - 2015-10-01 15:18 - 00000000 ____D C:\Users\Gustavo\AppData\Roaming\shortCutStore
2015-10-01 15:18 - 2015-10-01 15:18 - 00000000 ____D C:\Users\Gustavo\AppData\Local\Crsoft
2015-10-01 14:59 - 2015-10-01 15:26 - 00000000 ____D C:\Users\Gustavo\Desktop\LUCAS iNDENIZAÇÃO
2015-09-30 19:22 - 2015-10-01 15:13 - 00000000 ____D C:\Users\Gustavo\AppData\Roaming\RunDir
2015-09-24 16:50 - 2015-09-24 16:50 - 00000000 ____D C:\Users\Gustavo\AppData\Local\A.E.T. Europe B.V
2015-09-24 16:42 - 2015-09-24 16:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SafeSign Standard
2015-09-24 16:42 - 2015-09-24 16:42 - 00000000 ____D C:\Program Files (x86)\A.E.T. Europe B.V
2015-09-24 16:41 - 2015-09-24 16:41 - 00000000 ____D C:\Users\Todos os Usuários\SZCCID
2015-09-24 16:41 - 2015-09-24 16:41 - 00000000 ____D C:\ProgramData\SZCCID
2015-09-24 16:41 - 2015-09-24 16:41 - 00000000 ____D C:\Program Files (x86)\G&D
2015-09-24 16:40 - 2015-09-24 16:41 - 00000000 ____D C:\Program Files (x86)\VALID
2015-09-24 16:19 - 2015-09-24 16:30 - 83961755 _____ C:\Users\Gustavo\Downloads\NovaCAA_instalador.exe
2015-09-14 13:45 - 2015-09-14 13:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2015-09-14 13:44 - 2015-09-14 13:44 - 00000000 ____D C:\Program Files\McAfee Security Scan
2015-09-14 13:41 - 2015-09-30 19:22 - 00000000 ____D C:\Users\Gustavo\AppData\Roaming\NetTemp
2015-09-09 14:24 - 2015-09-02 23:18 - 02531400 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2015-09-09 14:24 - 2015-09-02 23:17 - 01903848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2015-09-09 14:24 - 2015-09-02 15:48 - 02345472 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2015-09-09 14:24 - 2015-09-02 14:09 - 01556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2015-09-09 14:24 - 2015-08-26 23:48 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-09-09 14:24 - 2015-08-26 15:00 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-09-09 14:24 - 2015-08-26 15:00 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2015-09-09 14:24 - 2015-08-26 15:00 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2015-09-09 14:24 - 2015-08-26 15:00 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2015-09-09 14:24 - 2015-08-26 11:46 - 03705344 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-09-09 14:24 - 2015-08-26 11:29 - 02240512 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2015-09-09 14:24 - 2015-08-26 11:27 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-09-09 14:24 - 2015-08-26 11:27 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2015-09-09 14:24 - 2015-08-26 11:26 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2015-09-09 14:24 - 2015-08-26 11:26 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2015-09-09 14:24 - 2015-08-26 11:26 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2015-09-09 14:24 - 2015-08-22 15:19 - 25188352 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-09-09 14:24 - 2015-08-22 14:35 - 02886144 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-09-09 14:24 - 2015-08-22 14:22 - 19856384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-09-09 14:24 - 2015-08-22 14:20 - 05923840 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-09-09 14:24 - 2015-08-22 13:50 - 02279424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-09-09 14:24 - 2015-08-22 13:41 - 14451712 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-09-09 14:24 - 2015-08-22 13:28 - 04520448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-09-09 14:24 - 2015-08-22 13:26 - 02427392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-09-09 14:24 - 2015-08-22 13:22 - 12857344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-09-09 14:24 - 2015-07-30 14:18 - 00268288 _____ (Microsoft Corporation) C:\WINDOWS\system32\InkEd.dll
2015-09-09 14:24 - 2015-07-30 13:22 - 00230912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InkEd.dll
2015-09-09 14:24 - 2015-07-22 11:19 - 00041984 _____ (Microsoft Corporation) C:\WINDOWS\system32\UtcResources.dll
2015-09-09 14:24 - 2015-07-22 10:52 - 01633792 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2015-09-09 14:24 - 2015-07-17 11:15 - 00951296 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdh.dll
2015-09-09 14:24 - 2015-07-17 11:10 - 00749568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdh.dll
2015-09-09 14:24 - 2015-06-27 08:47 - 00118616 _____ (Microsoft Corporation) C:\WINDOWS\system32\consent.exe
2015-09-09 14:23 - 2015-09-01 23:56 - 04175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-09-09 14:23 - 2015-09-01 23:55 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2015-09-09 14:23 - 2015-09-01 23:50 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2015-09-09 14:23 - 2015-09-01 23:17 - 00301568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2015-09-09 14:23 - 2015-09-01 23:13 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2015-09-09 14:23 - 2015-08-22 14:34 - 00585216 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-09-09 14:23 - 2015-08-22 14:21 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-09-09 14:23 - 2015-08-22 13:55 - 00504832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-09-09 14:23 - 2015-08-22 13:50 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-09-09 14:23 - 2015-08-22 13:45 - 00665600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-09-09 14:23 - 2015-08-22 13:44 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-09-09 14:23 - 2015-08-22 13:41 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-09-09 14:23 - 2015-08-22 13:41 - 00720384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-09-09 14:23 - 2015-08-22 13:41 - 00374784 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-09-09 14:23 - 2015-08-22 13:39 - 02126336 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-09-09 14:23 - 2015-08-22 13:23 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-09-09 14:23 - 2015-08-22 13:20 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2015-09-09 14:23 - 2015-08-22 13:18 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-09-09 14:23 - 2015-08-22 13:18 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-09-09 14:23 - 2015-08-22 13:18 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-09-09 14:23 - 2015-08-22 13:14 - 01545728 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-09-09 14:23 - 2015-08-22 13:01 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-09-09 14:23 - 2015-08-22 13:00 - 01951232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-09-09 14:23 - 2015-08-22 12:56 - 01310720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-09-09 14:23 - 2015-08-22 12:55 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-09-09 14:23 - 2015-08-01 00:47 - 00229376 _____ (Microsoft Corporation) C:\WINDOWS\system32\schtasks.exe
2015-09-09 14:23 - 2015-08-01 00:45 - 00182784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schtasks.exe
2015-09-09 14:23 - 2015-08-01 00:38 - 01265152 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2015-09-09 14:23 - 2015-08-01 00:37 - 00468992 _____ (Microsoft Corporation) C:\WINDOWS\system32\taskeng.exe
2015-09-09 14:23 - 2015-08-01 00:37 - 00359936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\taskeng.exe
2015-09-09 14:23 - 2015-07-22 11:34 - 02775552 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2015-09-09 14:23 - 2015-07-22 11:33 - 01728000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2015-09-09 14:23 - 2015-07-22 11:25 - 02461184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2015-09-09 14:23 - 2015-07-22 11:25 - 01546752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2015-09-09 14:23 - 2015-07-18 15:31 - 00194048 _____ (Microsoft Corporation) C:\WINDOWS\system32\shacct.dll
2015-09-09 14:23 - 2015-07-18 15:29 - 00655872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSync.dll
2015-09-09 14:23 - 2015-07-18 15:29 - 00148480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shacct.dll
2015-09-09 14:23 - 2015-07-18 15:27 - 00520192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSync.dll
2015-09-09 14:23 - 2015-07-13 16:10 - 00411455 _____ C:\WINDOWS\system32\ApnDatabase.xml
2015-09-09 14:23 - 2015-07-09 13:14 - 00228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-09-09 14:23 - 2015-07-03 18:51 - 01380056 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2015-09-09 14:23 - 2015-07-03 11:00 - 01097216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2015-09-09 14:23 - 2015-06-19 14:07 - 02819072 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2015-09-09 14:22 - 2015-08-03 18:15 - 00074928 _____ (Microsoft Corporation) C:\WINDOWS\system32\appidapi.dll
2015-09-09 14:22 - 2015-08-03 18:15 - 00065600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appidapi.dll
2015-09-09 14:22 - 2015-08-01 11:22 - 00039936 _____ (Microsoft Corporation) C:\WINDOWS\system32\appidsvc.dll
2015-09-09 14:19 - 2015-07-10 16:06 - 00118272 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthpan.sys
2015-09-09 14:18 - 2015-07-14 00:27 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzsync.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-10-09 22:11 - 2014-12-03 23:04 - 01835066 _____ C:\WINDOWS\WindowsUpdate.log
2015-10-09 22:00 - 2013-08-22 12:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-10-09 16:29 - 2015-06-10 11:35 - 00001092 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-10-09 16:29 - 2013-02-28 17:48 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2311927973-3537350689-1432087344-1002
2015-10-09 16:21 - 2014-12-04 09:30 - 00003722 _____ C:\WINDOWS\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473
2015-10-09 16:21 - 2014-12-04 09:30 - 00003476 _____ C:\WINDOWS\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon
2015-10-09 16:17 - 2014-12-23 21:50 - 00000902 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-10-09 16:15 - 2014-12-02 15:49 - 00000000 ____D C:\Program Files\Couponarific
2015-10-09 15:47 - 2015-07-29 16:42 - 00001038 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job
2015-10-09 14:59 - 2014-07-19 12:23 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-10-09 14:38 - 2014-12-10 23:10 - 00050862 _____ C:\WINDOWS\setupact.log
2015-10-09 13:07 - 2013-08-22 12:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-10-08 16:47 - 2015-07-29 16:42 - 00001034 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job
2015-10-08 12:38 - 2012-10-09 04:25 - 00000000 ____D C:\Users\Todos os Usuários\WinClon
2015-10-08 12:38 - 2012-10-09 04:25 - 00000000 ____D C:\ProgramData\WinClon
2015-10-08 12:34 - 2015-07-29 16:53 - 00000000 ___RD C:\Users\Gustavo\Dropbox
2015-10-08 12:34 - 2015-07-29 16:42 - 00000000 ____D C:\Users\Gustavo\AppData\Local\Dropbox
2015-10-08 12:33 - 2014-12-04 07:40 - 00000000 __RDO C:\Users\Gustavo\OneDrive
2015-10-08 12:33 - 2012-10-09 04:31 - 00000000 ____D C:\Users\Todos os Usuários\Temp
2015-10-08 12:33 - 2012-10-09 04:31 - 00000000 ____D C:\ProgramData\Temp
2015-10-07 17:41 - 2014-12-03 22:35 - 00000000 ____D C:\Users\Gustavo
2015-10-07 17:17 - 2014-12-10 23:06 - 00000008 __RSH C:\Users\Todos os Usuários\ntuser.pol
2015-10-07 17:17 - 2014-12-10 23:06 - 00000008 __RSH C:\ProgramData\ntuser.pol
2015-10-07 17:16 - 2013-08-22 11:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-10-07 17:15 - 2014-12-10 23:04 - 00151796 _____ C:\WINDOWS\PFRO.log
2015-10-07 17:15 - 2012-07-26 05:12 - 00000000 ___HD C:\WINDOWS\ELAMBKUP
2015-10-07 15:04 - 2015-04-21 12:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-10-07 15:03 - 2015-06-10 11:38 - 00001580 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-10-07 15:03 - 2015-06-10 11:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-10-07 15:03 - 2015-02-18 12:23 - 00001375 _____ C:\Users\Gustavo\Desktop\Mozilla  Firefox.lnk
2015-10-07 13:14 - 2015-04-11 11:48 - 00000000 ___SD C:\WINDOWS\system32\GWX
2015-10-05 15:00 - 2012-07-26 04:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-10-05 14:58 - 2015-04-11 11:48 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2015-10-03 14:44 - 2015-07-29 16:42 - 00000000 ____D C:\Program Files (x86)\Dropbox
2015-10-01 23:46 - 2013-03-02 00:44 - 00000000 ____D C:\Users\Gustavo\AppData\Local\CrashDumps
2015-10-01 17:03 - 2014-05-17 16:43 - 00003234 _____ C:\WINDOWS\System32\Tasks\Norton WSC Integration
2015-10-01 15:30 - 2014-09-24 11:04 - 01797166 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-10-01 15:30 - 2014-09-24 10:19 - 00774900 _____ C:\WINDOWS\system32\prfh0416.dat
2015-10-01 15:30 - 2014-09-24 10:19 - 00158494 _____ C:\WINDOWS\system32\prfc0416.dat
2015-10-01 15:18 - 2015-01-23 18:00 - 00000000 ____D C:\WINDOWS\SysWOW64\RunDir
2015-10-01 15:05 - 2013-08-22 10:25 - 01048576 ___SH C:\WINDOWS\system32\config\BBI
2015-09-30 19:25 - 2013-08-22 10:25 - 00262144 ___SH C:\WINDOWS\system32\config\ELAM
2015-09-30 19:22 - 2014-07-23 17:55 - 00000302 _____ C:\WINDOWS\Tasks\FF Watcher {6C3B2C83-B45F-43F1-8E07-8B538ED9F1AE}.job
2015-09-29 00:08 - 2013-08-22 12:36 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-09-25 13:39 - 2013-05-02 22:11 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-09-24 16:41 - 2012-10-09 03:36 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-09-22 14:19 - 2014-12-23 21:50 - 00003790 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-09-18 13:24 - 2015-06-10 11:35 - 00004064 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-09-18 13:24 - 2015-06-10 11:35 - 00003828 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-09-18 13:24 - 2015-06-10 11:35 - 00001088 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-15 13:54 - 2014-07-23 17:55 - 00003250 _____ C:\WINDOWS\System32\Tasks\FF Watcher {6C3B2C83-B45F-43F1-8E07-8B538ED9F1AE}
2015-09-15 13:14 - 2013-09-16 19:34 - 00000000 ____D C:\Users\Gustavo\AppData\Local\Google
2015-09-14 22:18 - 2015-05-16 16:45 - 00812008 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-09-14 22:18 - 2015-05-16 16:45 - 00178152 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-09-14 14:15 - 2013-08-22 12:36 - 00000000 ____D C:\WINDOWS\rescache
2015-09-14 13:45 - 2015-08-03 13:06 - 00001950 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2015-09-14 13:41 - 2015-09-08 13:21 - 00000000 ____D C:\Users\Gustavo\AppData\Roaming\DNSHelper
2015-09-14 13:39 - 2013-08-22 11:44 - 00529880 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-09-14 13:33 - 2014-09-24 10:40 - 00000000 ____D C:\Program Files\Windows Journal
2015-09-14 13:33 - 2013-08-22 12:36 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2015-09-09 16:03 - 2013-11-15 16:36 - 00000000 ____D C:\WINDOWS\system32\MRT

==================== Files in the root of some directories =======

2014-09-08 19:59 - 2015-06-17 21:34 - 0004608 _____ () C:\Users\Gustavo\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-08-12 10:18 - 2014-08-13 17:42 - 0000080 _____ () C:\Users\Gustavo\AppData\Local\X-Plane Installer.prf
2014-08-12 10:09 - 2014-08-12 10:09 - 0000042 _____ () C:\Users\Gustavo\AppData\Local\x-plane_install.txt
2015-01-17 12:56 - 2015-04-12 22:16 - 0000112 _____ () C:\ProgramData\8U45ukSL.dat
2015-10-07 15:05 - 2015-10-07 15:05 - 0000102 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat

Files to move or delete:
====================
C:\ProgramData\8U45ukSL.dat
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
C:\Users\EasySurvey\EasySurvey.exe
C:\Users\Todos os Usuários\8U45ukSL.dat
C:\Users\Todos os Usuários\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat


Some files in TEMP:
====================
C:\Users\Gustavo\AppData\Local\Temp\BingBarSetup-Partner.exe
C:\Users\Gustavo\AppData\Local\Temp\BSvcProcessor.exe
C:\Users\Gustavo\AppData\Local\Temp\BSvcUpdater.exe
C:\Users\Gustavo\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpxeexzw.dll
C:\Users\Gustavo\AppData\Local\Temp\LenovoSHAREit17-9.exe
C:\Users\Gustavo\AppData\Local\Temp\{1E19C331-D780-4FC7-BA74-808B6B18125B}.dll
C:\Users\Gustavo\AppData\Local\Temp\{29D40332-F427-46FC-811D-D4AA1CC8328D}.dll
C:\Users\Gustavo\AppData\Local\Temp\{3A4340A8-FA69-4E3D-8332-82CDD4027DAE}.dll
C:\Users\Gustavo\AppData\Local\Temp\{44403A22-9D8C-4350-8B4E-FD0379A4C6FA}.dll
C:\Users\Gustavo\AppData\Local\Temp\{83A290A2-4789-4CB1-AE32-E5B9DDF24F72}.dll
C:\Users\Gustavo\AppData\Local\Temp\{D3E96160-D9BF-47F9-8800-EA9A85BBEDF3}.dll
C:\Users\Gustavo\AppData\Local\Temp\{D3EEE245-CD00-4077-8741-5B69AA8445F2}.dll


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\wininit.exe => File is digitally signed
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-10-08 13:32

==================== End of FRST.txt ============================