Resultado do exame da Farbar Recovery Scan Tool (FRST) (x86) Versão:29-05-2016 02
Executado por Wellington (administrador) em WELLINGTON-PC (31-05-2016 22:52:23)
Executando a partir de C:\Users\Wellington\Desktop
Perfis Carregados: Wellington (Perfis Disponíveis: Wellington)
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) Idioma: Português (Brasil)
Internet Explorer Versão 8 (Navegador padrão: Chrome)
Modo da Inicialização: Normal
Tutorial da Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processos (Whitelisted) =================

(Se uma entrada for incluída na fixlist, o processo será fechado. O arquivo não será movido.)

(PSafe Total) C:\Program Files\PSafe\Total\safemon\QHActiveDefense.exe
(Microsoft Corporation) C:\Windows\System32\lpksetup.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(Adobe Systems, Incorporated) C:\Program Files\Common Files\Adobe\AdobeGCClient\AGSService.exe
(LogMeIn, Inc.) C:\Program Files\LogMeIn Hamachi\LMIGuardianSvc.exe
() C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe
() C:\Program Files\CalendarTool\2.0.0.11356\CalendarServ.exe
() C:\Program Files\ByteFence\rtop\bin\rtop_bg.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
() C:\Program Files\CalendarTool\2.0.0.11356\calendar.exe
(LogMeIn Inc.) C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(LogMeIn Inc.) C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
(Qihu Software Co. Limited) C:\Program Files\PSafe\Total\safemon\QHWatchdog.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registro (Whitelisted) ===========================

(Se uma entrada for incluída na fixlist, o ítem no Registro será restaurado para o padrão ou removido. O arquivo não será movido.)

HKLM\...\Run: [QHSafeTray] => C:\Program Files\PSafe\Total\safemon\QHSafeTray.exe [1935168 2016-02-29] (PSafe Total)
HKLM\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [5565960 2016-05-06] (LogMeIn Inc.)
HKLM\...\Run: [AdobeCS6ServiceManager] => C:\Program Files\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1075296 2013-04-25] (Adobe Systems Incorporated)
HKLM\...\Run: [SwitchBoard] => C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2016-04-09] (Microsoft Corporation)
ShellExecuteHooks:  - {7AD1C0F5-07A2-40E5-8608-C6EAA0FF362F} - C:\Users\Wellington\AppData\Roaming\Microsoft\Windows\Cookies\explibss.dll Nenhum Arquivo [ ]
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x86.dll [2016-04-01] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x86.dll [2016-04-01] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x86.dll [2016-04-01] ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  Nenhum Arquivo
CHR HKLM\SOFTWARE\Policies\Google: Restrição <======= ATENÇÃO

==================== Internet (Whitelisted) ====================

(Se um ítem for incluído na fixlist, sendo um ítem do Registro, será removido ou restaurado para o padrão.)

Hosts: Há mais de uma entrada no Hosts. Veja a seção Hosts do Addition.txt
Tcpip\..\Interfaces\{61E4FF6E-88A7-4335-8535-4292C614BADC}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{61E4FF6E-88A7-4335-8535-4292C614BADC}: [DhcpNameServer] 10.15.254.12 10.15.254.13 8.8.8.8
Tcpip\..\Interfaces\{89279D61-7584-442D-9201-3FA6947EE360}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{e29ac6c2-7037-11de-816d-806e6f6e6963}: [NameServer] 104.197.191.4

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restrição <======= ATENÇÃO
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://br.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_adwrldint_16_22&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dbr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyB0AyBzytCzyyCtDzztCzzyDtC0EtDtAtN0D0Tzu0StCyCtCtCtN1L2XzutAtFtBtBtFtAtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StD0C0EtC0AyBtC0DtGyDyDtBtAtG0FtCtDyDtGtAtB0BzztGyE0CtC0AtA0D0A0FyCzzzzyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCtDzztB0FzzyByDtGtC0C0DyDtGyEzy0D0CtG0AyDtDtAtGyBzz0AyEyByEzz0F0BtBtCzy2QtN0A0LzuyE%26cr%3D2131664821%26a%3Dwncy_adwrldint_16_22%26os_ver%3D6.1%26os%3DWindows%2B7%2BProfessional
HKU\S-1-5-21-1821321385-1194465463-391160740-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://br.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_adwrldint_16_22&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dbr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyB0AyBzytCzyyCtDzztCzzyDtC0EtDtAtN0D0Tzu0StCyCtCtCtN1L2XzutAtFtBtBtFtAtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StD0C0EtC0AyBtC0DtGyDyDtBtAtG0FtCtDyDtGtAtB0BzztGyE0CtC0AtA0D0A0FyCzzzzyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCtDzztB0FzzyByDtGtC0C0DyDtGyEzy0D0CtG0AyDtDtAtGyBzz0AyEyByEzz0F0BtBtCzy2QtN0A0LzuyE%26cr%3D2131664821%26a%3Dwncy_adwrldint_16_22%26os_ver%3D6.1%26os%3DWindows%2B7%2BProfessional
HKU\S-1-5-21-1821321385-1194465463-391160740-1000\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGIjVkxlyIvsCCX_Y7AYFuqP98ztRdo3bLXE2dGHOCJh3G-aPsQdT7h7CIS3LquBkx-JWI8E0VMdG6qHo7bj-dnwMiNa4GnZ72NRGvI9HgsRKcbtDXTaR9PsrxIBjWvB9p-FrmfJK5bkynha3afIuk5jtyceOEWv4fawM4VJ_7cRXSNf7Qnqv1XTzlOx8i6A,&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {ielnksrch} URL = 
SearchScopes: HKLM -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_adwrldint_16_22&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyB0AyBzytCzyyCtDzztCzzyDtC0EtDtAtN0D0Tzu0StCyCtCtCtN1L2XzutAtFtBtBtFtAtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StD0C0EtC0AyBtC0DtGyDyDtBtAtG0FtCtDyDtGtAtB0BzztGyE0CtC0AtA0D0A0FyCzzzzyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCtDzztB0FzzyByDtGtC0C0DyDtGyEzy0D0CtG0AyDtDtAtGyBzz0AyEyByEzz0F0BtBtCzy2QtN0A0LzuyE%26cr%3D2131664821%26a%3Dwncy_adwrldint_16_22%26os_ver%3D6.1%26os%3DWindows%2B7%2BProfessional&p={searchTerms}
SearchScopes: HKU\360SandBox -> DefaultScope {BA1BE292-1D15-488B-934D-008742212380} URL = hxxps://www.searchassist.net/search?q={searchTerms}&p=s&m=ie&c=d&s=sp
SearchScopes: HKU\360SandBox -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://www.searchassist.net/search?q={searchTerms}&p=sm=ie&c=d&s=sp
SearchScopes: HKU\360SandBox -> {BA1BE292-1D15-488B-934D-008742212380} URL = hxxps://www.searchassist.net/search?q={searchTerms}&p=s&m=ie&c=d&s=sp
SearchScopes: HKU\S-1-5-21-1821321385-1194465463-391160740-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_adwrldint_16_22&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyB0AyBzytCzyyCtDzztCzzyDtC0EtDtAtN0D0Tzu0StCyCtCtCtN1L2XzutAtFtBtBtFtAtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StD0C0EtC0AyBtC0DtGyDyDtBtAtG0FtCtDyDtGtAtB0BzztGyE0CtC0AtA0D0A0FyCzzzzyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCtDzztB0FzzyByDtGtC0C0DyDtGyEzy0D0CtG0AyDtDtAtGyBzz0AyEyByEzz0F0BtBtCzy2QtN0A0LzuyE%26cr%3D2131664821%26a%3Dwncy_adwrldint_16_22%26os_ver%3D6.1%26os%3DWindows%2B7%2BProfessional&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1821321385-1194465463-391160740-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_adwrldint_16_22&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyB0AyBzytCzyyCtDzztCzzyDtC0EtDtAtN0D0Tzu0StCyCtCtCtN1L2XzutAtFtBtBtFtAtFtDtN1L1Czu1TtN1L1G1B1V1N2Y1L1Qzu2StD0C0EtC0AyBtC0DtGyDyDtBtAtG0FtCtDyDtGtAtB0BzztGyE0CtC0AtA0D0A0FyCzzzzyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCtDzztB0FzzyByDtGtC0C0DyDtGyEzy0D0CtG0AyDtDtAtGyBzz0AyEyByEzz0F0BtBtCzy2QtN0A0LzuyE%26cr%3D2131664821%26a%3Dwncy_adwrldint_16_22%26os_ver%3D6.1%26os%3DWindows%2B7%2BProfessional&p={searchTerms}
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

FireFox:
========
FF ProfilePath: C:\Users\Wellington\AppData\Roaming\Profiles\40psipou.default
FF NewTab: C:\\ProgramData\\Statdexs\\ff.NT
FF DefaultSearchEngine: cloudfront
FF DefaultSearchEngine.US: data:text/plain,browser.search.defaultenginename.US=cloudfront
FF SelectedSearchEngine: hohosearch
FF Homepage: C:\\ProgramData\\Statdexs\\ff.HP
FF Keyword.URL: hxxp://d2ucfwpxlh3zh3.cloudfront.net/chrome.php?uid=738651E370DB8C99BB31D9488292B126&ptid=amz&ts=AHEqB3EsBn4kC0..&v=20160527&mode=ffexttoolbar&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_21_0_0_242.dll [2016-05-28] ()
FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-27] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-27] (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.2.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-04-26] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-16] (Adobe Systems Inc.)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2016-04-07] (Adobe Systems)
FF Plugin: adobe.com/AdobeExManDetect -> C:\Program Files\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll [2013-12-02] (Adobe Systems)
FF user.js: detected! => C:\Users\Wellington\AppData\Roaming\Mozilla\Firefox\Profiles\1d4k7ekq.default\user.js [2016-05-28]
FF user.js: detected! => C:\Users\Wellington\AppData\Roaming\Profiles\40psipou.default\user.js [2016-05-28]
FF SearchPlugin: C:\Users\Wellington\AppData\Roaming\Mozilla\Firefox\Profiles\1d4k7ekq.default\searchplugins\yahoo! powered search.xml [2016-05-30]
FF SearchPlugin: C:\Users\Wellington\AppData\Roaming\Profiles\40psipou.default\searchplugins\4mvob4hm.xml [2016-05-28]
FF Extension: GsearchFinder - C:\Users\Wellington\AppData\Roaming\Profiles\40psipou.default\Extensions\@E9438230-A7DF-4D1F-8F2D-CA1D0F0F7924.xpi [2016-05-27]
StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
CHR Session Restore: ChromeDefaultData -> está habilitado.
CHR HKLM\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-1821321385-1194465463-391160740-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx

==================== Serviços (Whitelisted) ========================

(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)

R2 AdobeUpdateService; C:\Program Files\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [694464 2016-04-07] (Adobe Systems Incorporated)
R2 AGSService; C:\Program Files\Common Files\Adobe\AdobeGCClient\AGSService.exe [2021592 2016-04-05] (Adobe Systems, Incorporated)
R2 Hamachi2Svc; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [1898504 2016-05-06] (LogMeIn Inc.)
R2 LMIGuardianSvc; C:\Program Files\LogMeIn Hamachi\LMIGuardianSvc.exe [405424 2016-05-06] (LogMeIn, Inc.)
R2 QHActiveDefense; C:\Program Files\PSafe\Total\safemon\QHActiveDefense.exe [858432 2016-02-29] (PSafe Total)
R2 rtop; C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe [254264 2016-05-30] ()
S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [Arquivo não assinado]
R2 TheCalendarService; C:\Program Files\CalendarTool\2.0.0.11356\CalendarServ.exe [152200 2016-05-10] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-13] (Microsoft Corporation)
S2 backlh; C:\ProgramData\Logic Handler\set.exe [X]
S2 BuhhiNefu; "C:\Program Files\Olhivudreelpici\BuhhiNefu.exe" [X]
S2 D85F4341-4A54-4FA8-8D3F-C8777EF662AC; "C:\Program Files\Olhivudreelpici\Osealpeo.exe" [X]
S2 GoogleChromeUpService; C:\ProgramData\service.exe /s GoogleChromeUpService /uid:51479 /local:br [X]
S2 Iupekve; "C:\Users\Wellington\AppData\Roaming\Soubsi\Soubsi.exe" -cms [X]
S2 Olhivudreelpici Updater; C:\Program Files\Olhivudreelpici\Gecwugp.exe [X]
S2 Poletherclnsrv; "C:\Program Files\Polether\Poletherclnsrv.exe32" {79740E79-A383-47A7-B513-3DF6563D007F} {8C4CE252-7DB2-4F8E-8E76-BAD0E5826A83} [X]
S2 ProntSpooler; "C:\Users\Wellington\AppData\Local\Apps\2.0\abril.exe" [X]
S2 Sugbenad; "C:\Users\Wellington\AppData\Roaming\JynlouNad\Kodnoo.exe" -cms [X]

===================== Drivers (Whitelisted) ==========================

(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)

R3 360AntiHacker; C:\Windows\System32\Drivers\360AntiHacker.sys [122448 2016-02-29] (360.cn)
R3 360AvFlt; C:\Windows\System32\DRIVERS\360AvFlt.sys [66128 2016-02-29] (360.cn)
R1 360Box; C:\Windows\System32\DRIVERS\360Box.sys [204368 2016-02-29] (360.cn)
S3 360Camera; C:\Windows\System32\Drivers\360Camera.sys [34888 2016-02-29] (360.cn)
R1 360SelfProtection; C:\Windows\System32\drivers\360SelfProtection.sys [179152 2016-02-29] (360安全中心)
R1 BAPIDRV; C:\Windows\System32\DRIVERS\BAPIDRV.sys [174168 2016-02-29] (Qihu 360 Software Co., Ltd.)
R0 DsArk; C:\Windows\system32\Drivers\DsArk.sys [99912 2016-02-29] (360.cn)
R1 EfiMon; C:\Windows\System32\Drivers\Efimon.sys [23752 2016-02-29] (360安全中心)
R3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [27040 2016-04-05] (LogMeIn, Inc.)
R0 HookPort; C:\Windows\System32\Drivers\Hookport.sys [60368 2016-02-29] (360安全中心)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x86.sys [91760 2012-04-25] (Qualcomm Atheros Co., Ltd.)
R1 qutmdserv; C:\Windows\System32\DRIVERS\qutmdrv.sys [292560 2016-02-29] (360.cn)
R1 qutmipc; C:\Windows\system32\drivers\qutmipc.sys [53960 2016-02-29] (360.cn)
S1 cherimoya; system32\drivers\cherimoya.sys [X]

==================== NetSvcs (Whitelisted) ===================

(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)


==================== Um Mês Criados arquivos e pastas ========

(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)

2016-05-31 22:52 - 2016-05-31 22:52 - 00015917 _____ C:\Users\Wellington\Desktop\FRST.txt
2016-05-31 22:52 - 2016-05-31 22:52 - 00000000 ____D C:\FRST
2016-05-31 22:51 - 2016-05-31 22:51 - 01734656 _____ (Farbar) C:\Users\Wellington\Desktop\FRST.exe
2016-05-31 21:41 - 2016-05-31 21:41 - 00000188 _____ C:\Users\Wellington\Downloads\LISTA DE CANAIS.txt
2016-05-31 21:40 - 2016-05-31 21:47 - 83064067 _____ C:\Users\Wellington\Downloads\kodi-16.0-Jarvis.exe
2016-05-31 01:57 - 2016-05-31 01:57 - 00000000 ____D C:\Users\Wellington\AppData\Roaming\Microsoft\Windows\Start Menu\ByteFence
2016-05-31 00:11 - 2016-02-29 23:19 - 00099912 _____ (360.cn) C:\Windows\system32\Drivers\DsArk.sys
2016-05-30 22:39 - 2016-05-30 22:39 - 00000000 ____D C:\Users\Wellington\AppData\Roaming\Notepad++
2016-05-30 18:32 - 2016-05-30 18:32 - 00000047 _____ C:\Users\Wellington\AppData\Roaming\WB.CFG
2016-05-30 17:43 - 2016-05-30 17:43 - 00000000 ____D C:\Users\Todos os Usuários\ByteFence
2016-05-30 17:43 - 2016-05-30 17:43 - 00000000 ____D C:\ProgramData\ByteFence
2016-05-30 17:32 - 2016-05-31 01:47 - 00000372 __RSH C:\Users\Todos os Usuários\ntuser.pol
2016-05-30 17:32 - 2016-05-31 01:47 - 00000372 __RSH C:\ProgramData\ntuser.pol
2016-05-30 17:32 - 2016-05-31 00:10 - 00000000 ____D C:\Users\Wellington\AppData\Local\{40A976F5-6401-1A4D-0999-3FA52DF1C33D}
2016-05-30 17:32 - 2016-05-30 17:32 - 00002433 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HowToRemove.html.lnk
2016-05-30 17:31 - 2016-05-31 05:13 - 00000000 ____D C:\Program Files\ByteFence
2016-05-30 16:52 - 2016-05-30 17:15 - 00000000 ____D C:\Users\Wellington\psfclient
2016-05-30 13:35 - 2016-05-30 14:00 - 00000000 ____D C:\Users\Wellington\otclient
2016-05-30 12:39 - 2016-05-31 19:22 - 00000000 ____D C:\Users\Wellington\AppData\Roaming\vlc
2016-05-30 12:38 - 2016-05-30 12:38 - 00001024 _____ C:\Users\Public\Desktop\VLC media player.lnk
2016-05-30 12:38 - 2016-05-30 12:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2016-05-30 12:38 - 2016-05-30 12:38 - 00000000 ____D C:\Program Files\VideoLAN
2016-05-30 12:20 - 2016-05-30 18:04 - 00000000 ____D C:\Users\Wellington\Downloads\Wellington
2016-05-30 09:59 - 2016-05-30 12:16 - 00000000 ____D C:\Users\Wellington\AppData\Roaming\otPokemon
2016-05-29 21:31 - 2016-05-29 21:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
2016-05-29 20:55 - 2016-05-29 20:55 - 00000000 ____D C:\Users\Wellington\AppData\Local\CEF
2016-05-29 20:54 - 2016-05-29 20:54 - 00001165 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Fireworks CS6.lnk
2016-05-29 20:54 - 2016-05-29 20:54 - 00000000 ____D C:\Users\Wellington\AppData\LocalLow\Adobe
2016-05-29 20:53 - 2016-05-29 20:53 - 00001311 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk
2016-05-29 20:53 - 2016-05-29 20:53 - 00000967 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
2016-05-29 20:32 - 2016-05-29 20:32 - 00001217 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Dreamweaver CC 2015.lnk
2016-05-29 20:23 - 2016-05-29 21:02 - 00000000 ____D C:\Users\Todos os Usuários\regid.1986-12.com.adobe
2016-05-29 20:23 - 2016-05-29 21:02 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2016-05-29 20:05 - 2016-05-29 20:05 - 00001256 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CC 2015 (32 Bit).lnk
2016-05-29 20:05 - 2016-05-29 20:05 - 00000000 ____D C:\Users\Wellington\Documents\Adobe
2016-05-29 19:43 - 2016-05-31 17:18 - 00000000 ___RD C:\Users\Wellington\Creative Cloud Files
2016-05-29 19:43 - 2016-05-31 17:17 - 00000000 ____D C:\Users\Todos os Usuários\boost_interprocess
2016-05-29 19:43 - 2016-05-31 17:17 - 00000000 ____D C:\ProgramData\boost_interprocess
2016-05-29 19:42 - 2016-05-29 19:42 - 00001191 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk
2016-05-29 19:26 - 2016-05-29 19:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
2016-05-29 19:26 - 2016-05-29 19:26 - 00000000 ____D C:\Program Files\Notepad++
2016-05-29 19:14 - 2016-05-29 19:14 - 00000000 ____D C:\Users\Wellington\Documents\Minhas paletas
2016-05-29 17:13 - 2016-05-29 17:13 - 00000000 ____D C:\Users\Todos os Usuários\VsTelemetry
2016-05-29 17:13 - 2016-05-29 17:13 - 00000000 ____D C:\ProgramData\VsTelemetry
2016-05-29 17:12 - 2016-05-29 17:12 - 00000000 ____D C:\Program Files\Common Files\Corel
2016-05-29 17:11 - 2016-05-29 17:11 - 00000000 ____D C:\Users\Public\Documents\Corel
2016-05-29 17:10 - 2016-05-29 19:13 - 00000000 ____D C:\Users\Wellington\Documents\Corel
2016-05-29 17:10 - 2016-05-29 18:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X8
2016-05-29 17:10 - 2016-05-29 17:15 - 00000000 ____D C:\Users\Wellington\AppData\Roaming\Corel
2016-05-29 17:08 - 2016-05-29 19:13 - 00000000 ____D C:\Users\Todos os Usuários\Corel
2016-05-29 17:08 - 2016-05-29 19:13 - 00000000 ____D C:\ProgramData\Corel
2016-05-29 17:08 - 2016-05-29 17:13 - 00000000 ____D C:\Program Files\Corel
2016-05-29 10:45 - 2016-05-29 10:45 - 00000000 ____D C:\Users\Wellington\Tracing
2016-05-29 07:44 - 2016-05-29 07:44 - 00001320 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2016-05-29 07:44 - 2016-05-29 07:44 - 00001251 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2016-05-29 07:44 - 2016-05-29 07:44 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2016-05-29 07:44 - 2014-03-31 21:36 - 00049856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fssfltr.sys
2016-05-29 07:43 - 2016-05-29 07:43 - 00002432 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
2016-05-29 07:43 - 2016-05-29 07:43 - 00001404 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2016-05-29 07:43 - 2016-05-29 07:43 - 00000020 _____ C:\Windows\¨öH
2016-05-29 07:43 - 2016-05-29 07:43 - 00000000 ____D C:\Program Files\Microsoft SQL Server Compact Edition
2016-05-29 07:42 - 2016-05-29 07:44 - 00000000 ____D C:\Program Files\Windows Live
2016-05-29 07:42 - 2016-05-29 07:42 - 00000000 ____D C:\Windows\PCHEALTH
2016-05-29 02:51 - 2016-05-29 02:51 - 00003664 ____N C:\bootsqm.dat
2016-05-29 02:34 - 2016-05-31 01:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Counter-Strike 1.6 2016 HD
2016-05-29 02:25 - 2016-05-29 02:25 - 00000000 ____D C:\Jogos
2016-05-29 01:44 - 2016-05-29 01:44 - 00000776 _____ C:\Users\Wellington\Desktop\GTA San Andreas.lnk
2016-05-29 01:38 - 2016-05-29 01:38 - 00000000 ____D C:\Users\Wellington\Documents\GTA San Andreas User Files
2016-05-29 01:38 - 2016-05-29 01:38 - 00000000 ____D C:\Users\Wellington\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2016-05-29 01:13 - 2016-05-29 11:09 - 00000000 ___HD C:\Users\Wellington\Documents\.4sh
2016-05-29 00:56 - 2016-05-29 00:56 - 00000000 ___HD C:\Users\Wellington\AppData\Roaming\GoldenGate
2016-05-29 00:56 - 2016-05-29 00:56 - 00000000 ___HD C:\Users\Wellington\AppData\Roaming\Booking_helper
2016-05-29 00:39 - 2016-05-29 00:39 - 00000000 ____D C:\Users\Wellington\AppData\Local\Setup2290016
2016-05-29 00:39 - 2016-05-29 00:39 - 00000000 ____D C:\Users\Wellington\AppData\Local\daro
2016-05-29 00:31 - 2016-05-31 22:32 - 00000286 _____ C:\Windows\Tasks\{2A21B1D9-2259-3035-4BA9-5C8C81871B91}.job
2016-05-28 23:12 - 2016-05-28 23:12 - 00000000 ____D C:\Windows\system32\jeb
2016-05-28 23:08 - 2016-05-28 23:08 - 00000030 _____ C:\Windows\system32\${LOGFILE}
2016-05-28 23:05 - 2016-05-28 23:22 - 00000000 ____D C:\Program Files\Common Files\HotStrong
2016-05-28 23:04 - 2016-05-28 23:04 - 01756999 _____ C:\Users\Wellington\AppData\Roaming\Whitela.tst
2016-05-28 23:04 - 2016-05-28 23:04 - 00072820 _____ C:\Users\Wellington\AppData\Roaming\Movela.tst
2016-05-28 23:04 - 2016-05-28 23:04 - 00002401 _____ C:\Windows\system32\findit.xml
2016-05-28 23:04 - 2016-05-28 23:04 - 00000000 ____D C:\Users\Wellington\AppData\Local\csdi_monetize_220160526
2016-05-28 23:04 - 2016-05-28 23:04 - 00000000 ____D C:\Users\Todos os Usuários\Statdexs
2016-05-28 23:04 - 2016-05-28 23:04 - 00000000 ____D C:\ProgramData\Statdexs
2016-05-28 23:04 - 2016-05-25 02:50 - 00304162 _____ ( ) C:\Windows\AdBlock.exe
2016-05-28 23:03 - 2016-05-31 00:10 - 00000000 ____D C:\Users\Todos os Usuários\Statdex
2016-05-28 23:03 - 2016-05-31 00:10 - 00000000 ____D C:\ProgramData\Statdex
2016-05-28 23:03 - 2016-05-28 23:30 - 00000000 ____D C:\Users\Todos os Usuários\Logic Handler
2016-05-28 23:03 - 2016-05-28 23:30 - 00000000 ____D C:\ProgramData\Logic Handler
2016-05-28 23:03 - 2016-05-28 23:22 - 00000000 ____D C:\Program Files\Common Files\Saltkix
2016-05-28 23:02 - 2016-05-28 23:30 - 00000000 ____D C:\Users\Todos os Usuários\CloudPrinter
2016-05-28 23:02 - 2016-05-28 23:30 - 00000000 ____D C:\ProgramData\CloudPrinter
2016-05-28 23:02 - 2016-05-28 23:04 - 06859776 _____ C:\Users\Wellington\AppData\Roaming\agent.dat
2016-05-28 23:02 - 2016-05-28 23:04 - 00126464 _____ C:\Users\Wellington\AppData\Roaming\noah.dat
2016-05-28 23:02 - 2016-05-28 23:04 - 00126464 _____ C:\Users\Wellington\AppData\Roaming\lobby.dat
2016-05-28 23:02 - 2016-05-28 23:04 - 00067776 _____ C:\Users\Wellington\AppData\Roaming\Config.xml
2016-05-28 23:02 - 2016-05-28 23:04 - 00054272 _____ C:\Users\Wellington\AppData\Roaming\ApplicationHosting.dat
2016-05-28 23:02 - 2016-05-28 23:04 - 00018432 _____ C:\Users\Wellington\AppData\Roaming\Main.dat
2016-05-28 23:02 - 2016-05-28 23:04 - 00005568 _____ C:\Users\Wellington\AppData\Roaming\md.xml
2016-05-28 23:02 - 2016-05-28 23:02 - 01756999 _____ C:\Users\Wellington\AppData\Roaming\ReZimphase.tst
2016-05-28 23:02 - 2016-05-28 23:02 - 00072820 _____ C:\Users\Wellington\AppData\Roaming\Superdax.tst
2016-05-28 23:02 - 2016-05-28 23:02 - 00000000 ____D C:\Users\Wellington\AppData\Roaming\HiOnl
2016-05-28 23:00 - 2016-05-28 23:03 - 00017952 _____ C:\Users\Wellington\AppData\Roaming\InstallationConfiguration.xml
2016-05-28 23:00 - 2016-05-28 23:00 - 00128512 _____ C:\Users\Wellington\AppData\Roaming\Installer.dat
2016-05-28 23:00 - 2016-05-28 23:00 - 00000000 ____D C:\Users\Wellington\AppData\Local\tuto_monetize_120160526
2016-05-28 22:58 - 2016-05-31 22:37 - 00000000 ____D C:\Users\Wellington\AppData\Roaming\CalendarTool
2016-05-28 22:58 - 2016-05-31 15:08 - 00000000 ____D C:\Users\Wellington\AppData\Local\3810282D-6C19-47B0-8283-5C6C29A7E108
2016-05-28 22:58 - 2016-05-31 00:10 - 00000000 ____D C:\Users\Wellington\AppData\Roaming\Soubsi
2016-05-28 22:58 - 2016-05-31 00:10 - 00000000 ____D C:\Users\Wellington\AppData\Roaming\odbKc
2016-05-28 22:58 - 2016-05-28 22:58 - 00000000 ____D C:\Users\Wellington\AppData\Roaming\WTools
2016-05-28 22:58 - 2016-05-28 22:58 - 00000000 ____D C:\Users\Wellington\AppData\Roaming\Store
2016-05-28 22:58 - 2016-05-28 22:58 - 00000000 ____D C:\Users\Wellington\AppData\LocalLow\Company
2016-05-28 22:58 - 2016-05-28 22:58 - 00000000 ____D C:\Users\Wellington\AppData\LocalLow\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}
2016-05-28 22:58 - 2016-05-28 22:58 - 00000000 ____D C:\Users\Wellington\AppData\Local\Tempfolder
2016-05-28 22:58 - 2016-05-28 22:58 - 00000000 ____D C:\Users\Public\Documents\Tools
2016-05-28 22:58 - 2016-05-28 22:58 - 00000000 ____D C:\Users\Public\Documents\Guid
2016-05-28 22:58 - 2016-05-28 22:58 - 00000000 ____D C:\Users\Public\Documents\Baidu
2016-05-28 22:58 - 2016-05-28 22:58 - 00000000 ____D C:\Program Files\CalendarTool
2016-05-28 22:57 - 2016-05-28 22:57 - 00000000 ____D C:\Users\Wellington\AppData\Roaming\Nosibay
2016-05-28 22:56 - 2016-05-28 22:56 - 00000000 ____D C:\Users\Wellington\AppData\Local\csdi_monetize_120160526
2016-05-28 22:07 - 2016-05-28 22:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2016-05-28 22:07 - 2016-05-28 22:07 - 00000000 ____D C:\Program Files\LogMeIn Hamachi
2016-05-28 22:07 - 2016-05-06 16:29 - 00027040 ____H (LogMeIn, Inc.) C:\Windows\system32\hamachi.sys
2016-05-28 20:58 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2016-05-28 20:58 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2016-05-28 20:58 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2016-05-28 20:58 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2016-05-28 20:58 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_42.dll
2016-05-28 20:58 - 2006-11-29 13:06 - 03426072 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_32.dll
2016-05-28 20:38 - 2016-05-30 18:04 - 00000000 ___RD C:\Users\Wellington\OneDrive
2016-05-28 20:37 - 2016-05-29 10:45 - 00000000 ____D C:\Users\Wellington\AppData\Local\Windows Live
2016-05-28 20:37 - 2016-05-28 20:37 - 00000000 ____D C:\Users\Todos os Usuários\Microsoft OneDrive
2016-05-28 20:37 - 2016-05-28 20:37 - 00000000 ____D C:\ProgramData\Microsoft OneDrive
2016-05-28 20:36 - 2016-05-28 20:36 - 00000000 ____D C:\Program Files\Common Files\Windows Live
2016-05-28 20:23 - 2015-07-18 10:08 - 00901264 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00066400 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00022368 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-eventing-provider-l1-1-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2016-05-28 20:23 - 2015-07-18 10:08 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2016-05-28 20:22 - 2016-05-29 17:14 - 00000000 ____D C:\Users\Todos os Usuários\Package Cache
2016-05-28 20:22 - 2016-05-29 17:14 - 00000000 ____D C:\ProgramData\Package Cache
2016-05-28 19:02 - 2016-05-28 22:14 - 00000000 ___SD C:\Users\Wellington\AppData\LocalLow\Temp
2016-05-28 18:50 - 2016-05-28 23:41 - 00000000 ____D C:\Users\Wellington\AppData\Roaming\uTorrent
2016-05-28 14:39 - 2016-05-31 15:12 - 00000000 ____D C:\Users\Wellington\Downloads\Victor

==================== Um Mês Modificados arquivos e pastas ========

(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)

2016-05-31 22:52 - 2016-04-07 16:28 - 00000000 ____D C:\Users\Wellington\AppData\Local\LogMeIn Hamachi
2016-05-31 22:50 - 2009-07-14 01:34 - 00014368 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-05-31 22:50 - 2009-07-14 01:34 - 00014368 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-05-31 22:17 - 2016-04-07 22:37 - 00000000 ____D C:\Users\Wellington\AppData\LocalLow\360WD
2016-05-31 22:05 - 2009-07-14 01:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-05-31 21:07 - 2016-04-08 00:03 - 00000000 __SHD C:\Users\Todos os Usuários\360Quarant
2016-05-31 21:07 - 2016-04-08 00:03 - 00000000 __SHD C:\ProgramData\360Quarant
2016-05-31 21:07 - 2015-02-19 17:24 - 00000000 __SHD C:\$360Section
2016-05-31 02:00 - 2016-04-07 15:29 - 00000000 ____D C:\Users\Wellington\AppData\Local\Adobe
2016-05-31 01:51 - 2016-04-07 22:37 - 00000000 ____D C:\Users\Todos os Usuários\360safe
2016-05-31 01:51 - 2016-04-07 22:37 - 00000000 ____D C:\ProgramData\360safe
2016-05-31 00:13 - 2016-04-07 13:37 - 00000000 ____D C:\Users\Wellington
2016-05-30 17:32 - 2016-04-07 14:37 - 00001105 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-05-30 05:55 - 2009-07-14 01:33 - 03745952 _____ C:\Windows\system32\FNTCACHE.DAT
2016-05-29 22:02 - 2016-04-07 15:29 - 00000000 ____D C:\Users\Todos os Usuários\Adobe
2016-05-29 22:02 - 2016-04-07 15:29 - 00000000 ____D C:\ProgramData\Adobe
2016-05-29 22:01 - 2016-04-07 15:30 - 00000000 ____D C:\Program Files\Common Files\Adobe
2016-05-29 21:32 - 2016-04-07 15:30 - 00000000 ____D C:\Program Files\Adobe
2016-05-29 21:31 - 2016-04-07 14:29 - 00000000 ____D C:\Users\Wellington\AppData\Roaming\Adobe
2016-05-29 20:55 - 2016-04-07 14:01 - 00084360 _____ C:\Users\Wellington\AppData\Local\GDIPFONTCACHEV1.DAT
2016-05-29 19:14 - 2016-04-07 13:41 - 01633534 _____ C:\Windows\system32\PerfStringBackup.INI
2016-05-29 19:14 - 2009-07-29 15:38 - 00705070 _____ C:\Windows\system32\prfh0416.dat
2016-05-29 19:14 - 2009-07-29 15:38 - 00146910 _____ C:\Windows\system32\prfc0416.dat
2016-05-29 19:14 - 2009-07-13 23:37 - 00000000 ____D C:\Windows\inf
2016-05-29 17:14 - 2009-07-13 23:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2016-05-29 01:07 - 2016-04-09 16:16 - 00000000 ____D C:\Windows\Tasks\360Disabled
2016-05-28 23:47 - 2016-04-07 14:02 - 00002151 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-05-28 23:47 - 2016-04-07 14:02 - 00002139 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-05-28 23:37 - 2015-03-06 20:28 - 00000000 ____D C:\temp
2016-05-28 23:30 - 2016-04-07 14:01 - 00000000 ____D C:\Users\Wellington\AppData\Local\Apps\2.0
2016-05-28 23:15 - 2016-04-07 22:37 - 00000000 ____D C:\Users\Todos os Usuários\360TotalSecurity
2016-05-28 23:15 - 2016-04-07 22:37 - 00000000 ____D C:\ProgramData\360TotalSecurity
2016-05-28 23:13 - 2016-04-07 14:37 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2016-05-28 23:12 - 2016-04-07 17:34 - 00000000 ____D C:\Users\Wellington\AppData\Local\Messenger
2016-05-28 23:04 - 2016-04-07 14:37 - 00001123 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-05-28 23:04 - 2016-04-07 13:38 - 00001401 _____ C:\Users\Wellington\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-05-28 23:00 - 2016-04-07 15:33 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2016-05-28 23:00 - 2016-04-07 15:33 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2016-05-28 23:00 - 2009-07-14 01:52 - 00000000 ____D C:\Windows\Downloaded Program Files
2016-05-28 22:48 - 2016-04-07 14:37 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-05-28 22:15 - 2016-04-07 17:34 - 00001122 _____ C:\Users\Wellington\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Messenger.lnk
2016-05-28 13:02 - 2016-04-07 15:30 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-05-28 12:49 - 2016-04-07 17:34 - 00000000 ____D C:\Program Files\Messenger for Desktop
2016-05-28 12:33 - 2015-12-24 19:59 - 00000000 _RSHD C:\360SANDBOX

==================== Arquivos na raiz de alguns diretórios =======

2016-05-28 23:02 - 2016-05-28 23:04 - 6859776 _____ () C:\Users\Wellington\AppData\Roaming\agent.dat
2016-05-28 23:02 - 2016-05-28 23:04 - 0054272 _____ () C:\Users\Wellington\AppData\Roaming\ApplicationHosting.dat
2016-05-28 22:56 - 2016-05-28 22:58 - 0001300 _____ () C:\Users\Wellington\AppData\Roaming\Bubble Dock.boostrap.log
2016-05-28 22:57 - 2016-05-28 22:57 - 0005743 _____ () C:\Users\Wellington\AppData\Roaming\Bubble Dock.installation.log
2016-05-28 23:02 - 2016-05-28 23:04 - 0067776 _____ () C:\Users\Wellington\AppData\Roaming\Config.xml
2016-05-28 23:00 - 2016-05-28 23:03 - 0017952 _____ () C:\Users\Wellington\AppData\Roaming\InstallationConfiguration.xml
2016-05-28 23:00 - 2016-05-28 23:00 - 0128512 _____ () C:\Users\Wellington\AppData\Roaming\Installer.dat
2016-05-28 23:02 - 2016-05-28 23:04 - 0126464 _____ () C:\Users\Wellington\AppData\Roaming\lobby.dat
2016-05-28 23:02 - 2016-05-28 23:04 - 0018432 _____ () C:\Users\Wellington\AppData\Roaming\Main.dat
2016-05-28 23:02 - 2016-05-28 23:04 - 0005568 _____ () C:\Users\Wellington\AppData\Roaming\md.xml
2016-05-28 23:04 - 2016-05-28 23:04 - 0072820 _____ () C:\Users\Wellington\AppData\Roaming\Movela.tst
2016-05-28 23:02 - 2016-05-28 23:04 - 0126464 _____ () C:\Users\Wellington\AppData\Roaming\noah.dat
2016-05-28 23:02 - 2016-05-28 23:02 - 1756999 _____ () C:\Users\Wellington\AppData\Roaming\ReZimphase.tst
2016-05-28 22:58 - 2016-05-28 22:58 - 0000078 _____ () C:\Users\Wellington\AppData\Roaming\Selection Tools.installation.log
2016-05-28 23:02 - 2016-05-28 23:02 - 0072820 _____ () C:\Users\Wellington\AppData\Roaming\Superdax.tst
2016-05-28 23:03 - 2016-05-28 23:05 - 0001150 _____ () C:\Users\Wellington\AppData\Roaming\uninstall_temp.ico
2016-05-30 18:32 - 2016-05-30 18:32 - 0000047 _____ () C:\Users\Wellington\AppData\Roaming\WB.CFG
2016-05-28 23:04 - 2016-05-28 23:04 - 1756999 _____ () C:\Users\Wellington\AppData\Roaming\Whitela.tst
2016-05-28 22:56 - 2016-05-28 22:56 - 0000097 _____ () C:\Users\Wellington\AppData\Roaming\WindApp.boostrap.log
2016-05-28 22:57 - 2016-05-28 22:57 - 0000078 _____ () C:\Users\Wellington\AppData\Roaming\WindApp.installation.log

Arquivos para serem movidos ou deletados:
====================
C:\Windows\Tasks\{2A21B1D9-2259-3035-4BA9-5C8C81871B91}.job


Alguns arquivos em TEMP:
====================
C:\Users\Wellington\AppData\Local\Temp\ChangeIcon.exe
C:\Users\Wellington\AppData\Local\Temp\xmlUpdater.exe


Alguns com tamanho de zero byte arquivos/pastas:
==========================
C:\Windows\notepad.exe
C:\Windows\System32\mfc110kor.dll
C:\Windows\System32\notepad.exe
C:\Windows\System32\XInput9_1_0.dll

==================== Bamital & volsnap =================

(Não há correção automática para arquivos que não passaram na verificação.)

C:\Windows\explorer.exe => O arquivo é assinado digitalmente
C:\Windows\system32\winlogon.exe => O arquivo é assinado digitalmente
C:\Windows\system32\wininit.exe => O arquivo é assinado digitalmente
C:\Windows\system32\svchost.exe => O arquivo é assinado digitalmente
C:\Windows\system32\services.exe => O arquivo é assinado digitalmente
C:\Windows\system32\User32.dll => O arquivo é assinado digitalmente
C:\Windows\system32\userinit.exe => O arquivo é assinado digitalmente
C:\Windows\system32\rpcss.dll => O arquivo é assinado digitalmente
C:\Windows\system32\dnsapi.dll => O arquivo é assinado digitalmente
C:\Windows\system32\Drivers\volsnap.sys => O arquivo é assinado digitalmente


LastRegBack: 2016-05-29 03:22

==================== Fim de FRST.txt ============================