Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:18-11-2015 Ran by Marina (administrator) on MARINA-PC (18-11-2015 18:14:26) Running from C:\Users\Marina\Downloads Loaded Profiles: Marina & Outros (Available Profiles: Marina & Outros & UpdatusUser) Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: Português (Brasil) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe (Navigation Co., Ltd.) C:\Users\Marina\AppData\Roaming\ntsvc\ntsvc.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe (arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe () C:\Program Files (x86)\SkypeUpdateEx\SkypeUpdateEx.exe (Clarus, Inc.) C:\Program Files (x86)\Clarus\Samsung Drive Manager\SZDrvSvc.exe (GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE () C:\Users\Marina\AppData\Roaming\XBox\XBLive.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Microsoft Corporation) C:\Windows\vVX1000.exe (GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe (Microsoft Corporation) C:\Windows\System32\StikyNot.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe (Clarus, Inc.) C:\Program Files (x86)\Clarus\Samsung Drive Manager\ABRTMon.exe (Mega Limited) C:\Users\Marina\AppData\Local\MEGAsync\MEGAsync.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe (Clarus, Inc.) C:\Program Files (x86)\Clarus\Samsung Drive Manager\Drive Manager.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (AVG Technologies CZ, s.r.o.) C:\Config.Msi\46d98.rbf (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe (Oracle Corporation) C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2launcher.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (RealNetworks, Inc.) C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor) HKLM\...\Run: [VX1000] => C:\Windows\vVX1000.exe [762736 2010-05-20] (Microsoft Corporation) HKLM\...\Run: [Diebold - Warsaw] => C:\Program Files\Diebold\Warsaw\core.exe [847160 2015-02-13] (GAS Tecnologia LTDA) HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133440 2012-07-19] (Intel Corporation) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-20] (Intel Corporation) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.) HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.) HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2024800 2014-06-04] (Wondershare) HKLM-x32\...\Run: [TkBellExe] => C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [295512 2014-03-20] (RealNetworks, Inc.) HKLM-x32\...\Run: [Clarus Drive Manager] => C:\Program Files (x86)\Clarus\Samsung Drive Manager\Drive Manager.exe [8135744 2013-12-18] (Clarus, Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-06-08] (Oracle Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\ GbPluginBb: C:\Program Files (x86)\GbPlugin\gbieh.dll [2015-08-19] (Banco do Brasil) HKU\S-1-5-21-1676987257-1593010146-3184279874-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-13] (Microsoft Corporation) HKU\S-1-5-21-1676987257-1593010146-3184279874-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd) HKU\S-1-5-21-1676987257-1593010146-3184279874-1000\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.) HKU\S-1-5-21-1676987257-1593010146-3184279874-1000\...\MountPoints2: G - G:\setup.exe HKU\S-1-5-21-1676987257-1593010146-3184279874-1000\...\MountPoints2: {08e47114-68cb-11e4-9464-94de802f4d14} - G:\setup.exe HKU\S-1-5-21-1676987257-1593010146-3184279874-1000\...\MountPoints2: {6a37ce29-be97-11e3-9c29-00215abc46b8} - K:\Startme.exe HKU\S-1-5-21-1676987257-1593010146-3184279874-1001\...\MountPoints2: {08e47114-68cb-11e4-9464-94de802f4d14} - G:\setup.exe HKU\S-1-5-21-1676987257-1593010146-3184279874-1001\...\MountPoints2: {6a37ce29-be97-11e3-9c29-00215abc46b8} - K:\Startme.exe HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-06-30] (Microsoft Corporation) ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\Program Files (x86)\GbPlugin\gbieh.dll [1896320 2015-08-19] (Banco do Brasil) ShellIconOverlayIdentifiers: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Marina\AppData\Local\MEGAsync\ShellExtX64.dll [2014-05-01] () ShellIconOverlayIdentifiers: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Marina\AppData\Local\MEGAsync\ShellExtX64.dll [2014-05-01] () ShellIconOverlayIdentifiers: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Marina\AppData\Local\MEGAsync\ShellExtX64.dll [2014-05-01] () ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers-x32: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Marina\AppData\Local\MEGAsync\ShellExtX32.dll [2014-05-01] () ShellIconOverlayIdentifiers-x32: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Marina\AppData\Local\MEGAsync\ShellExtX32.dll [2014-05-01] () ShellIconOverlayIdentifiers-x32: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Marina\AppData\Local\MEGAsync\ShellExtX32.dll [2014-05-01] () Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Drive Manager Real-Time.lnk [2015-05-01] ShortcutTarget: Samsung Drive Manager Real-Time.lnk -> C:\Program Files (x86)\Clarus\Samsung Drive Manager\ABRTMon.exe (Clarus, Inc.) Startup: C:\Users\Marina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEGAsync.lnk [2015-08-12] ShortcutTarget: MEGAsync.lnk -> C:\Users\Marina\AppData\Local\MEGAsync\MEGAsync.exe (Mega Limited) GroupPolicy: Restriction - Chrome <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Winsock: Catalog5 10 C:\ProgramData\System32\SafeGuard32.dll No File Winsock: Catalog5-x64 10 C:\ProgramData\System32\SafeGuard64.dll [2316728 2015-10-29] () Hosts: 192.168.0.4 NPI3A4330 Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{4E34EF1C-33F8-4200-87FB-34739BE08D7F}: [DhcpNameServer] 192.168.42.129 Tcpip\..\Interfaces\{7E4E527D-8E49-47F4-AE96-AACF63D1AF39}: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{8723281D-83BA-40E6-92B0-BE1F0D92253B}: [DhcpNameServer] 192.168.42.129 Tcpip\..\Interfaces\{8961206D-4727-424A-9902-C057B4C90F0B}: [DhcpNameServer] 192.168.0.1 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = HKU\S-1-5-21-1676987257-1593010146-3184279874-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://mysearch.avg.com/?cid={479C948E-D4DC-4E73-9147-96DD9739DB14}&mid=30f62e50eea947cd9b5c4597c6cba4e7-22997078e123f8e98035605f0ab183a14cbe16d3&lang=pt-br&ds=AVG&coid=avgtbavg&cmpid=0615tb&pr=fr&d=2015-02-20 01:09:46&v=4.1.6.294&pid=wtu&sg=&sap=hp HKU\S-1-5-21-1676987257-1593010146-3184279874-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.megaware.com.br SearchScopes: HKLM -> DefaultScope {E921F400-D383-4B1B-9DE6-FCFCACFC1173} URL = /?bd=ds&oem=302br&uid=ST1000DM003-1CH162_S1DFAPHWXXXXS1DFAPHW&version=2.3.0.10992&pid=414031160&tid=702&q={searchTerms} SearchScopes: HKLM -> {E921F400-D383-4B1B-9DE6-FCFCACFC1173} URL = /?bd=ds&oem=302br&uid=ST1000DM003-1CH162_S1DFAPHWXXXXS1DFAPHW&version=2.3.0.10992&pid=414031160&tid=702&q={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope {E921F400-D383-4B1B-9DE6-FCFCACFC1173} URL = /?bd=ds&oem=302br&uid=ST1000DM003-1CH162_S1DFAPHWXXXXS1DFAPHW&version=2.3.0.10992&pid=414031160&tid=702&q={searchTerms} SearchScopes: HKLM-x32 -> {E921F400-D383-4B1B-9DE6-FCFCACFC1173} URL = /?bd=ds&oem=302br&uid=ST1000DM003-1CH162_S1DFAPHWXXXXS1DFAPHW&version=2.3.0.10992&pid=414031160&tid=702&q={searchTerms} SearchScopes: HKU\S-1-5-21-1676987257-1593010146-3184279874-1001 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={479C948E-D4DC-4E73-9147-96DD9739DB14}&mid=30f62e50eea947cd9b5c4597c6cba4e7-22997078e123f8e98035605f0ab183a14cbe16d3&lang=pt-br&ds=AVG&coid=avgtbavg&cmpid=0915tb&pr=fr&d=2015-02-20 01:09:46&v=4.1.6.294&pid=wtu&sg=&sap=dsp&q={searchTerms} BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.) BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation) BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2013-08-14] (RealDownloader) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll [2015-08-12] (Oracle Corporation) BHO-x32: Auxiliar de Conexão de Conta da Microsoft -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.) BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation) BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540000} -> C:\Program Files (x86)\GbPlugin\gbieh.dll [2015-08-19] (Banco do Brasil) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-08-12] (Oracle Corporation) DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-10-12] (Microsoft Corporation) Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-10-12] (Microsoft Corporation) StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.seekmx.com/?bd=sc&oem=302br&uid=ST1000DM003-1CH162_S1DFAPHWXXXXS1DFAPHW&version=2.3.0.10992&pid=414031160&tid=702 FireFox: ======== FF ProfilePath: C:\Users\Marina\AppData\Roaming\Mozilla\Firefox\Profiles\yxszbf0u.default FF NetworkProxy: "socks_remote_dns", true FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_226.dll [2015-10-22] () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-10-22] () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll [2012-10-04] (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-18] () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.13.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2013-02-05] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-08-12] (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation) FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll [2014-03-20] (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2013-08-14] (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2013-08-14] (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2013-08-14] (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll [2014-03-20] (RealPlayer) FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2013-08-14] (RealDownloader) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-14] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-14] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-05-08] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1676987257-1593010146-3184279874-1000: gastecnologia.com.br/sf/abn -> C:\Users\Marina\AppData\Local\GAS Tecnologia\GBBD\npsf_abn.dll [2015-02-20] (GAS Tecnologia) FF Plugin HKU\S-1-5-21-1676987257-1593010146-3184279874-1001: gastecnologia.com.br/sf/bb -> C:\Users\Outros\AppData\Local\GAS Tecnologia\GBBD\npsf_bb.dll [2015-09-04] (GAS Tecnologia) FF Plugin HKU\S-1-5-21-1676987257-1593010146-3184279874-1001: gastecnologia.com.br/sf/gas64 -> C:\Users\Outros\AppData\Local\GAS Tecnologia\GBBD\npsf_gas_64.dll [No File] FF SearchPlugin: C:\Users\Marina\AppData\Roaming\Mozilla\Firefox\Profiles\yxszbf0u.default\searchplugins\avg-secure-search.xml [2015-09-30] FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\buscape.xml [2015-11-08] FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\mercadolivre.xml [2015-11-08] FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wtu-secure-search.xml [2015-09-30] FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-03-20] [not signed] FF Extension: GBBD Banco Santander (Brasil) S.A. - C:\Users\Marina\AppData\Local\GAS Tecnologia\GBBD\abn\xpi [2015-01-26] [not signed] FF Extension: FoxyProxy Standard - C:\Users\Marina\AppData\Roaming\Mozilla\Firefox\Profiles\yxszbf0u.default\extensions\foxyproxy@eric.h.jung [2015-05-31] FF Extension: AVG Web TuneUp - C:\Users\Marina\AppData\Roaming\Mozilla\Firefox\Profiles\yxszbf0u.default\extensions\avg@toolbar [2015-10-29] [not signed] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-10-08] FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-03-20] [not signed] FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-03-20] [not signed] FF HKU\S-1-5-21-1676987257-1593010146-3184279874-1000\...\Firefox\Extensions: [{87F8774F-B485-47E2-A755-A40A8A5E8874}] - C:\Users\Marina\AppData\Local\GAS Tecnologia\GBBD\abn\xpi FF Extension: GBBD Banco Santander (Brasil) S.A. - C:\Users\Marina\AppData\Local\GAS Tecnologia\GBBD\abn\xpi [2015-01-26] [not signed] FF HKU\S-1-5-21-1676987257-1593010146-3184279874-1001\...\Firefox\Extensions: [{87F8774F-B485-47E2-A755-A40A8A5E886C}] - C:\Users\Outros\AppData\Local\GAS Tecnologia\GBBD\bb\xpi FF Extension: GBBD Banco do Brasil - C:\Users\Outros\AppData\Local\GAS Tecnologia\GBBD\bb\xpi [2015-09-04] [not signed] Chrome: ======= CHR StartupUrls: Default -> "hxxp://www.funnyordie.com/davefranco?_cc=__d___&_ccid=n70bvm.midncm","hxxps://www.youtube.com/watch?v=VetVl9FrQ_U","hxxp://video.gq.com/watch/derrick-rose-may-cover","hxxps://www.youtube.com/user/tommcflytwitter/videos?view=0","hxxps://www.youtube.com/watch?v=M46Sip8OjzM","hxxps://www.youtube.com/user/officialmcfly/videos?view=0","hxxps://www.youtube.com/watch?v=LWp6hMthyO0","hxxps://pt.wikipedia.org/wiki/Jason_Mraz","hxxps://www.kickstarter.com/projects/1040304630/would-you-short-film-w-dave-franco-and-chris-mintz","hxxps://en.wikipedia.org/wiki/Memory_Lane:_The_Best_of_McFly#Track_listing","hxxps://www.youtube.com/watch?v=3RvFgtFUBLk","hxxps://www.youtube.com/watch?v=5jqjaK_qnVU","hxxps://en.wikipedia.org/wiki/Dave_Franco#Filmography","hxxps://www.youtube.com/watch?v=Jv6QhStiIN8","hxxps://en.wikipedia.org/wiki/List_of_songs_in_Smash","hxxp://www.funnyordie.com/davefranco?_cc=__d___&_ccid=n70bvm.midncm","hxxp://www.tvmuse.com/tv-shows/Crownies_26371/season_1/episode_15/video-results/","hxxps://www.youtube.com/watch?feature=player_embedded&v=dzAjFoyY_ic","hxxp://www.tvmuse.com/tv-shows/Teen-Titans_8991/season_3/episode_9/","hxxps://www.youtube.com/watch?v=Jv6QhStiIN8","hxxp://www.vagalume.com.br/jason-mraz/","hxxps://www.youtube.com/watch?v=EsCiHu7wkFU","hxxps://www.youtube.com/watch?feature=player_embedded&v=N0kJCh_wdZg","hxxps://www.youtube.com/watch?v=fDd6i2hUApg" CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.86\PepperFlash\pepflashplayer.dll () CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.86\ppGoogleNaClPluginChrome.dll => No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\46.0.2490.86\pdf.dll => No File CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll => No File CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll => No File CHR Plugin: (Java(TM) Platform SE 7 U13) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll => No File CHR Plugin: (Java Deployment Toolkit 7.0.130.20) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) CHR Profile: C:\Users\Marina\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Marina\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-18] CHR Extension: (Google Drive) - C:\Users\Marina\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21] CHR Extension: (YouTube) - C:\Users\Marina\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24] CHR Extension: (Google Search) - C:\Users\Marina\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27] CHR Extension: (Stylish) - C:\Users\Marina\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjnbnpbmkenffdnngjfgmeleoegfcffe [2015-09-30] CHR Extension: (Documentos Google off-line) - C:\Users\Marina\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-18] CHR Extension: (Lone Tree) - C:\Users\Marina\AppData\Local\Google\Chrome\User Data\Default\Extensions\hfmkllfplegemejikoabfpjdaoncphip [2013-02-06] CHR Extension: (eclock) - C:\Users\Marina\AppData\Local\Google\Chrome\User Data\Default\Extensions\hnplpedplphoahacdlbcepdokaakokno [2015-11-13] CHR Extension: (RealDownloader) - C:\Users\Marina\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2014-03-20] CHR Extension: (GBBD Banco Santander (Brasil) S.A.) - C:\Users\Marina\AppData\Local\Google\Chrome\User Data\Default\Extensions\idnljhnpjegfbcohjhdnhjlnfnffmbnf [2015-03-07] CHR Extension: (StumbleUpon) - C:\Users\Marina\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcahibnffhnnjcedflmchmokndkjnhpg [2014-03-02] CHR Extension: (Coupons at Checkout) - C:\Users\Marina\AppData\Local\Google\Chrome\User Data\Default\Extensions\kegphgaihkjoophpabchkmpaknehfamb [2015-11-16] CHR Extension: (Skype Click to Call) - C:\Users\Marina\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-10-13] CHR Extension: (Pagamentos da Chrome Web Store) - C:\Users\Marina\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-04] CHR Extension: (Gmail) - C:\Users\Marina\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-02] CHR HKU\S-1-5-21-1676987257-1593010146-3184279874-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [abmojiekfpcmkkfamgfcpgfgipocface] - C:\Users\Marina\AppData\Local\GAS Tecnologia\GBBD\abn\sf.crx [2013-06-10] CHR HKU\S-1-5-21-1676987257-1593010146-3184279874-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pgacfjdigcddmmncljpflgcfpfahebkh] - C:\Users\Outros\AppData\Local\GAS Tecnologia\GBBD\bb\sf.crx [2014-02-19] CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14] CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-10-12] ==================== Services (Whitelisted) ======================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] () R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2015-10-12] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2015-10-12] (Microsoft Corporation) R2 GbpSv; C:\Program Files (x86)\GbPlugin\gbpsv.exe [587576 2015-08-12] (GAS Tecnologia) R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [217088 2007-11-06] (Hewlett-Packard Co.) [File not signed] R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [139264 2007-11-06] (Hewlett-Packard Co.) [File not signed] S4 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [46904 2013-12-17] (Hewlett-Packard Company) R3 ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [160256 2011-08-30] (Intel Corporation) [File not signed] S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed] R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-07-05] (Intel Corporation) R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2009-05-14] (Hewlett-Packard) [File not signed] S4 ogmservice; C:\Program Files (x86)\Online Games Manager\ogmservice.exe [581568 2014-03-27] (RealNetworks, Inc.) R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2009-05-14] (Hewlett-Packard) [File not signed] R2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [337776 2014-04-30] (arvato digital services llc) S4 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] () R2 Sed; C:\Users\Marina\AppData\Roaming\ntsvc\ntsvc.exe [266104 2015-10-19] (Navigation Co., Ltd.) R2 SkypeUpdateEx; C:\Program Files (x86)\SkypeUpdateEx\SkypeUpdateEx.exe [178608 2015-11-05] () R2 SZDrvSvc; C:\Program Files (x86)\Clarus\Samsung Drive Manager\SZDrvSvc.exe [18432 2013-12-18] (Clarus, Inc.) [File not signed] R2 Warsaw Technology; C:\Program Files\Diebold\Warsaw\core.exe [847160 2015-02-13] (GAS Tecnologia LTDA) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) R2 XBox; C:\Users\Marina\AppData\Roaming\XBox\XBLive.exe [6728120 2015-11-05] () ===================== Drivers (Whitelisted) ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [22680 2012-10-25] () R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-11-10] (Disc Soft Ltd) S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation) R1 gbpddfac; C:\Windows\System32\drivers\gbpddfac64.sys [28888 2015-11-18] (GAS Tecnologia) S0 GbpKm; C:\Windows\SysWOW64\drivers\GbpKm.sys [49536 2013-05-08] (GAS Tecnologia) R3 GBPRCM; C:\Program Files (x86)\GbPlugin\gbprcm64.sys [29912 2015-08-26] (GAS Tecnologia) S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2015-05-21] () R3 mdf16; C:\Program Files (x86)\Clarus\Samsung Drive Manager\mdf16.sys [20400 2012-06-21] () R3 mvd23; C:\Program Files (x86)\Clarus\Samsung Drive Manager\mvd23.sys [99248 2012-06-21] () S3 SrvHsfPCIe; C:\Windows\System32\DRIVERS\VSTBS36.SYS [287744 2009-06-10] (Conexant Systems, Inc.) S3 Warsaw_PP; C:\Program Files (x86)\GbPlugin\wsftprp64.sys [24792 2015-04-29] (GAS Tecnologia LTDA) R4 WinDivert1.1; C:\Windows\system32\WinDivert64.sys [37592 2015-02-13] (Basil's Projects) R4 AVGIDSHA; system32\DRIVERS\avgidsha.sys [X] R4 Avgrkx64; system32\DRIVERS\avgrkx64.sys [X] R4 Avgtdia; system32\DRIVERS\avgtdia.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-11-18 18:14 - 2015-11-18 18:14 - 02008576 _____ (Farbar) C:\Users\Marina\Downloads\FRST64.exe 2015-11-18 18:14 - 2015-11-18 18:14 - 00034123 _____ C:\Users\Marina\Downloads\FRST.txt 2015-11-18 18:14 - 2015-11-18 18:14 - 00000000 ____D C:\FRST 2015-11-18 17:50 - 2015-11-18 17:50 - 00003117 _____ C:\Users\Marina\Desktop\ZHPCleaner.txt 2015-11-18 17:44 - 2015-11-18 17:44 - 01897984 _____ C:\Users\Marina\Downloads\ZHPCleaner (1).exe 2015-11-18 17:01 - 2015-11-18 17:50 - 00000000 ____D C:\Users\Marina\AppData\Roaming\ZHP 2015-11-18 17:01 - 2015-11-18 17:44 - 00000836 _____ C:\Users\Marina\Desktop\ZHPCleaner.lnk 2015-11-18 16:59 - 2015-11-18 16:59 - 01897984 _____ C:\Users\Marina\Downloads\ZHPCleaner.exe 2015-11-11 08:12 - 2015-11-15 01:02 - 00003344 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1676987257-1593010146-3184279874-1001 2015-11-06 14:10 - 2015-11-15 01:02 - 00003212 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1676987257-1593010146-3184279874-1001 2015-10-28 21:01 - 2015-10-28 21:01 - 00000000 ____D C:\Windows\SysWOW64\worker 2015-10-26 09:17 - 2015-10-28 19:01 - 00000370 _____ C:\Windows\Tasks\1015tbUpdateInfo.job 2015-10-26 09:17 - 2015-10-28 19:01 - 00000000 ____D C:\Users\Todos os Usuários\Avg_Update_1015tb 2015-10-26 09:17 - 2015-10-28 19:01 - 00000000 ____D C:\ProgramData\Avg_Update_1015tb 2015-10-26 09:17 - 2015-10-26 09:17 - 00002490 _____ C:\Windows\System32\Tasks\1015tbUpdateInfo 2015-10-19 20:24 - 2015-11-18 17:11 - 00000000 ____D C:\Program Files (x86)\SkypeUpdateEx ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-11-18 18:11 - 2007-01-01 00:52 - 01874778 _____ C:\Windows\WindowsUpdate.log 2015-11-18 17:46 - 2013-02-06 00:41 - 00001070 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-11-18 17:24 - 2013-02-06 00:03 - 00000902 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-11-18 17:20 - 2009-07-14 02:45 - 00017920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-11-18 17:20 - 2009-07-14 02:45 - 00017920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-11-18 17:17 - 2015-02-19 22:57 - 00000000 ___HD C:\$AVG 2015-11-18 17:17 - 2015-02-19 22:57 - 00000000 ____D C:\Users\Todos os Usuários\AVG2015 2015-11-18 17:17 - 2015-02-19 22:57 - 00000000 ____D C:\ProgramData\AVG2015 2015-11-18 17:17 - 2015-02-19 22:53 - 00000000 ____D C:\Users\Todos os Usuários\MFAData 2015-11-18 17:17 - 2015-02-19 22:53 - 00000000 ____D C:\ProgramData\MFAData 2015-11-18 17:12 - 2015-06-26 03:39 - 00028888 _____ (GAS Tecnologia) C:\Windows\system32\Drivers\gbpddfac64.sys 2015-11-18 17:11 - 2013-05-20 21:37 - 00003366 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1676987257-1593010146-3184279874-1000 2015-11-18 17:11 - 2013-03-10 18:27 - 00000324 _____ C:\Windows\Tasks\GlaryInitialize.job 2015-11-18 17:11 - 2013-03-01 23:09 - 00003234 _____ C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1676987257-1593010146-3184279874-1000 2015-11-18 17:11 - 2013-02-06 00:41 - 00001066 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-11-18 17:11 - 2009-07-14 03:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2015-11-18 17:10 - 2009-07-14 02:51 - 00163012 _____ C:\Windows\setupact.log 2015-11-18 16:27 - 2015-09-08 10:04 - 00003344 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1676987257-1593010146-3184279874-1000 2015-11-18 16:27 - 2015-09-08 10:04 - 00003212 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1676987257-1593010146-3184279874-1000 2015-11-13 09:44 - 2015-08-23 16:27 - 00000286 __RSH C:\Users\Todos os Usuários\ntuser.pol 2015-11-13 09:44 - 2015-08-23 16:27 - 00000286 __RSH C:\ProgramData\ntuser.pol 2015-11-12 01:01 - 2015-08-12 00:08 - 00000000 ___RD C:\Users\Marina\Documents\MEGAsync 2015-11-11 19:46 - 2013-02-06 00:41 - 00002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2015-11-10 21:42 - 2013-06-10 01:09 - 00000000 ____D C:\Users\Todos os Usuários\GAS Tecnologia 2015-11-10 21:42 - 2013-06-10 01:09 - 00000000 ____D C:\ProgramData\GAS Tecnologia 2015-11-09 11:13 - 2015-04-13 09:08 - 00000047 _____ C:\Windows\system32\local.cfg 2015-11-09 01:23 - 2013-02-06 00:35 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2015-11-08 23:49 - 2014-04-06 14:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2015-11-06 11:10 - 2015-09-19 20:00 - 00000000 ____D C:\Users\Marina\AppData\Roaming\XBox 2015-10-28 21:01 - 2015-09-23 16:59 - 00641054 _____ C:\Windows\SysWOW64\worker.zip 2015-10-22 23:12 - 2013-02-05 21:54 - 00000000 ____D C:\Users\Marina\AppData\Local\Adobe 2015-10-22 22:43 - 2013-02-06 00:03 - 00780488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-10-22 22:43 - 2013-02-06 00:03 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-10-22 22:43 - 2013-02-06 00:03 - 00003840 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-10-19 20:22 - 2015-08-23 16:28 - 00000000 ____D C:\Users\Marina\AppData\Roaming\ntsvc ==================== Files in the root of some directories ======= 2013-06-10 01:09 - 2014-03-17 21:58 - 0030307 _____ () C:\Users\Marina\AppData\Roaming\unins000.dat 2013-03-02 01:26 - 2014-10-16 21:29 - 0005632 _____ () C:\Users\Marina\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-11-10 11:24 - 2014-11-10 11:24 - 0000020 _____ () C:\ProgramData\bc.ini 2013-02-05 23:54 - 2014-01-31 21:04 - 0002985 _____ () C:\ProgramData\hpzinstall.log Some files in TEMP: ==================== C:\Users\Marina\AppData\Local\Temp\ose00000.exe C:\Users\Marina\AppData\Local\Temp\ose00001.exe C:\Users\Marina\AppData\Local\Temp\_is892C.exe ==================== Bamital & volsnap ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\dnsapi.dll => File is digitally signed C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-11-11 19:58 ==================== End of FRST.txt ============================