Resultado do exame Adicional Farbar Recovery Scan Tool (x86) Versão: 18-11-2016 Executado por Cristina (18-11-2016 22:40:16) Executando a partir de C:\Users\Cristina\Downloads Microsoft Windows 7 Professional Service Pack 1 (X86) (2015-07-19 20:23:13) Modo da Inicialização: Normal ========================================================== ==================== Contas: ============================= Administrador (S-1-5-21-1455526487-581654163-2976102132-500 - Administrator - Disabled) Convidado (S-1-5-21-1455526487-581654163-2976102132-501 - Limited - Disabled) Cristina (S-1-5-21-1455526487-581654163-2976102132-1000 - Administrator - Enabled) => C:\Users\Cristina ==================== Central de Segurança ======================== (Se uma entrada for incluída na fixlist, será removida.) AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Programas Instalados ====================== (Somente os programas adwares com a indicação "Oculto" podem ser adicionados à fixlist para desocultá-los. Os programas adwares devem ser desinstalados manualmente.) µTorrent (HKU\S-1-5-21-1455526487-581654163-2976102132-1000\...\uTorrent) (Version: 3.4.8.42576 - BitTorrent Inc.) Ad-Aware Web Companion (Version: 2.0.1025.2130 - Lavasoft) Hidden Adobe Acrobat Reader DC - Português (HKLM\...\{AC76BA86-7AD7-1046-7B44-AC0F074E4100}) (Version: 15.020.20042 - Adobe Systems Incorporated) Arquivo do WinRAR (HKLM\...\WinRAR archiver) (Version: - ) Body Text Feathering (HKLM\...\PopupProduct) (Version: 1.0.0.0 - Body Text Feathering) <==== ATENÇÃO cleaner 1.0.1 (HKLM\...\cleaner) (Version: - cleaner) DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 10.3.0.0152 - Disc Soft Ltd) DeVeDe (HKLM\...\{D1BCDFB2-D631-4AD5-9CA1-B86E01E1AC62}) (Version: 3.17.1 - MajorSilence) FormatFactory 3.7.0.0 (HKLM\...\FormatFactory) (Version: 3.7.0.0 - Format Factory) gamesdesktop version 1.1 (HKLM\...\gamesdesktop_is1) (Version: 1.1 - gamesdesktop) <==== ATENÇÃO Google Update Helper (Version: 1.3.31.5 - Google Inc.) Hidden Gramblr (HKLM\...\Gramblr) (Version: 2.8.0 - Gramblr Team) Hola™ 1.18.524 - Better Internet (HKLM\...\Hola) (Version: 1.18.524 - Hola Networks Ltd.) <==== ATENÇÃO KMPlayer (remove only) (HKLM\...\The KMPlayer) (Version: 4.1.1.5 - PandoraTV) LavasoftTcpService (Version: 2.3.4.7 - Lavasoft) Hidden LG United Mobile Drivers (HKLM\...\{5DB849D6-9392-4FB7-9ABB-87ED433152E5}) (Version: 3.8.1 - LG Electronics) MaohaWiFi (HKLM\...\MaohaAP) (Version: 1.0.8.8 - 深圳市猫哈网络科技发展有限公司) <==== ATENÇÃO MEGAsync (HKLM\...\MEGAsync) (Version: - Mega Limited) Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation) Microsoft .NET Framework 4.5.2 (Português do Brasil) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1046) (Version: 4.5.51209 - Microsoft Corporation) Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.50903 - Microsoft Corporation) Mozilla Firefox 49.0.1 (x86 pt-BR) (HKLM\...\Mozilla Firefox 49.0.1 (x86 pt-BR)) (Version: 49.0.1 - Mozilla) Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 49.0.1.6109 - Mozilla) Mp3tag v2.75 (HKLM\...\Mp3tag) (Version: v2.75 - Florian Heidenreich) Nero 8 Essentials (HKLM\...\{7FD7FB8C-2C75-4A8E-A236-EB23C5CD1046}) (Version: 8.3.582 - Nero AG) OtherSearch (HKLM\...\OtherSearch) (Version: 3.0.4.2 - Theudobald Yanko) <==== ATENÇÃO Pacote de Idiomas do Microsoft Visual Studio 2010 Tools for Office Runtime (x86) - Português (Brasil) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - PTB) (Version: 10.0.50903 - Microsoft Corporation) PhotoScape (HKLM\...\PhotoScape) (Version: - ) PicosmosTools 1.0.1.0 (HKLM\...\PicosmosTools) (Version: 1.0.1.0 - Free Time) Revisores de Texto do Microsoft Office 2013 – Português do Brasil (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (HKLM\...\{91150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUSR_{7F6C4883-A18C-459A-82C1-A2F9403F2DA6}) (Version: - Microsoft) shopperz (HKLM\...\{0A8F1140-0E5B-4795-8E2B-3BB4C939FD35}) (Version: 2.0.0.480 - shopperz) <==== ATENÇÃO Spotify (HKU\S-1-5-21-1455526487-581654163-2976102132-1000\...\Spotify) (Version: 1.0.42.151.g19de0aa6 - Spotify AB) sunnyday version 1.1 (HKLM\...\sunnyday_is1) (Version: 1.1 - sunnyday) <==== ATENÇÃO Update for Skype for Business 2015 (KB3039776) 32-Bit Edition (HKLM\...\{90150000-012B-0416-0000-0000000FF1CE}_Office15.PROPLUSR_{7BDD179E-C954-438B-937D-EB411B701EAB}) (Version: - Microsoft) Update for Skype for Business 2015 (KB3127934) 32-Bit Edition (HKLM\...\{90150000-012B-0416-0000-0000000FF1CE}_Office15.PROPLUSR_{561D6567-A41D-407F-957C-39EEA3AB2D73}) (Version: - Microsoft) Update for Skype for Business 2015 (KB3127934) 32-Bit Edition (HKLM\...\{91150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUSR_{561D6567-A41D-407F-957C-39EEA3AB2D73}) (Version: - Microsoft) VCRedistSetup (Version: 1.0.0 - Nero AG) Hidden VirtualDJ 8 (HKLM\...\{A8EB77B7-2A7B-46F8-BF9D-9EE1F95A9A2E}) (Version: 8.0.2523.0 - Atomix Productions) Web Companion (HKLM\...\{88B10E3E-8911-4FAC-8663-CCF6E33C58B3}_WebCompanion) (Version: 2.0.1025.2130 - Lavasoft) ==================== Exame Personalizado CLSID (Whitelisted): ========================== (Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.) CustomCLSID: HKU\S-1-5-21-1455526487-581654163-2976102132-1000_Classes\CLSID\{A2DF06F9-A21A-44A8-8A99-8B9C84F29160}\localserver32 -> C:\Users\Cristina\AppData\Local\Chromium\Application\46.0.2480.0\delegate_execute.exe (The Chromium Authors) <==== ATENÇÃO CustomCLSID: HKU\S-1-5-21-1455526487-581654163-2976102132-1000_Classes\CLSID\{E6CA27A3-C7E9-959D-201B-C2561585645C}\InprocServer32 -> não caminho do arquivo ==================== Tarefas Agendadas (Whitelisted) ============= (Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.) Task: {143A343A-2CA9-4165-B2C2-32DB5BE186D0} - System32\Tasks\{8E712FAB-60F1-4453-A5AB-92355A9158DB} => pcalua.exe -a "C:\Program Files\WinRAR\WinRAR.exe" -d C:\Users\Cristina\Downloads -c "C:\Users\Cristina\Downloads\CADAUMNSUASADA.rar" Task: {3B00AD63-5EC5-4BA5-B7F3-C6BB224A1B5E} - System32\Tasks\klcp_update => C:\Program Files\K-Lite Codec Pack\Tools\CodecTweakTool.exe [2016-07-07] () Task: {3C5DF79E-BAB7-47A6-BD68-DC3B9F334299} - System32\Tasks\Update Service for Youtube AdBlock2 => C:\Program Files\Youtube AdBlock\W5wA4Na.exe <==== ATENÇÃO Task: {44A1793F-5C45-4C60-934C-3AB9D12EF2BD} - System32\Tasks\UpdateTask => C:\Users\Cristina\AppData\Local\{759A4~1\UNINST~1.EXE Task: {5466F259-FD22-407B-9065-8634E41887DC} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-10-21] (Adobe Systems Incorporated) Task: {640DCA01-6E42-4549-8AE1-03F4B3D9E173} - System32\Tasks\{097C74BA-BA37-49BC-B46E-276E60877F4C} => pcalua.exe -a "C:\Program Files\GreatMaker\MaohaWiFi\Uninstall.exe" Task: {94BB3847-E427-4873-8B96-5D2552DEDEA0} - System32\Tasks\updengine => C:\Program Files\OtherSearch\updengine.exe [2016-11-17] () <==== ATENÇÃO Task: {9856AD13-74D7-466D-A0E5-B582F8396130} - System32\Tasks\Update Service for Youtube AdBlock => C:\Program Files\Youtube AdBlock\W5wA4Na.exe <==== ATENÇÃO Task: {A1AA6F54-FA83-45D8-AD35-93DE8028C21A} - System32\Tasks\Kupiynohoing Cache => C:\Program Files\Nernapyclermocult\nerlether.exe [2016-11-18] (Glarysoft Ltd) Task: {A7FF74A1-AE26-4F77-8207-0AB337AED126} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation) Task: {C98A6D9F-97FE-4060-BB9B-B1E77DCAD1DE} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation) Task: {C99B2C10-6C1D-474A-8E08-9BB17431FC77} - System32\Tasks\{3D62DB2E-A8F1-4484-89AC-D4BF64B6C9D8} => pcalua.exe -a D:\browser.exe -d D:\ Task: {CC6F5A21-7F1E-412B-991D-78F60EF3DE66} - System32\Tasks\ChelfNotify Task => C:\ProgramData\ChelfNotify\BrowserUpdate.exe [2016-06-29] (Tencent) <==== ATENÇÃO Task: {DB1CCB27-3C62-4946-BCED-71DC1125A6E9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-07-25] (Google Inc.) Task: {DBE3625A-4646-448A-9183-C628D0EE08F9} - System32\Tasks\{7AB16E8D-3C71-4543-900F-B12531BD640D} => pcalua.exe -a "C:\Program Files\WinRAR\uninstall.exe" Task: {F0D215B4-03AD-4AAD-B8B4-7F97F9263E8D} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-07-25] (Google Inc.) Task: {FC0EA0E7-78B8-49BE-89D3-63E80D8A6DDD} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation) (Se uma entrada for incluída na fixlist, o arquivo da tarefa (.job) será movido. O arquivo que está sendo executado pela tarefa não será movido.) Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\UpdateTask.job => C:\Users\Cristina\AppData\Local\{759A4~1\UNINST~1.EXE ==================== Atalhos ============================= (As entradas podem ser listadas para serem restauradas ou removidas.) WMI_ActiveScriptEventConsumer_ASEC: <===== ATENÇÃO Shortcut: C:\Users\Cristina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VirtualDJ\Online Help.lnk -> hxxp://www.virtualdj.com/wiki/ Shortcut: C:\Users\Cristina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VirtualDJ\www.virtualdj.com.lnk -> hxxp://www.virtualdj.com/ ShortcutWithArgument: C:\Users\Cristina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://9o0gle.com/ ShortcutWithArgument: C:\Users\Cristina\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Chromium.lnk -> C:\Users\Cristina\AppData\Local\Chromium\Application\chrome.exe (The Chromium Authors) -> --load-extension="C:\Users\Cristina\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk" hxxp://9o0gle.com/ ShortcutWithArgument: C:\Users\Cristina\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://9o0gle.com/ ShortcutWithArgument: C:\Users\Cristina\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://9o0gle.com/ ==================== Módulos Carregados (Whitelisted) ============== 2016-11-18 13:53 - 2016-11-18 13:53 - 00258560 _____ () C:\Users\Cristina\AppData\Roaming\Imywi\Movkix.dll 2016-11-18 13:55 - 2016-11-18 22:26 - 00353280 _____ () C:\Program Files\Ebukfijmijpe\Nufmeu.DLL 2014-05-01 12:15 - 2014-05-01 12:15 - 00463360 _____ () C:\Users\Cristina\AppData\Local\MEGAsync\ShellExtX32.dll 2015-07-22 03:00 - 2003-05-15 15:43 - 00119808 _____ () C:\Program Files\WinRAR\rarext.dll 2015-06-08 15:12 - 2015-06-08 15:12 - 00078656 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll 2015-06-08 15:12 - 2015-06-08 15:12 - 00184680 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll 2015-06-08 15:12 - 2015-06-08 15:12 - 00046920 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll 2015-06-08 15:13 - 2015-06-08 15:13 - 00073544 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll 2015-06-08 15:12 - 2015-06-08 15:12 - 00033136 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Repositories.dll 2015-06-08 15:12 - 2015-06-08 15:12 - 00015696 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll 2015-06-08 15:12 - 2015-06-08 15:12 - 00123736 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.PUP.Management.dll 2015-06-08 15:11 - 2015-06-08 15:11 - 00039256 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll 2016-10-28 16:33 - 2016-10-28 16:33 - 00276480 _____ () c:\program files\wefashpluqitain\vrzrpr.dll 2016-11-14 22:42 - 2015-10-15 09:21 - 00163344 _____ () C:\Program Files\GreatMaker\MaohaWiFi\maohasubstat.dll 2016-11-14 22:42 - 2014-12-18 05:02 - 00261600 _____ () C:\Program Files\GreatMaker\MaohaWiFi\Updater\CheckUpdate.dll 2016-11-14 22:42 - 2016-05-31 06:51 - 00237088 _____ () C:\Program Files\GreatMaker\MaohaWiFi\tipsdll.dll 2016-11-14 22:42 - 2014-08-19 05:36 - 00206816 _____ () C:\Program Files\GreatMaker\MaohaWiFi\CrRpt.dll 2015-06-08 15:12 - 2015-06-08 15:12 - 00019816 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe 2015-06-08 15:12 - 2015-06-08 15:12 - 00012144 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Service.Logger.dll 2015-06-08 15:12 - 2015-06-08 15:12 - 00034664 _____ () C:\Program Files\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WcfService.dll 2016-11-02 09:54 - 2016-11-14 01:35 - 00208384 _____ () c:\programdata\winsapsvc\winsap.dll 2016-05-04 19:18 - 2016-11-17 12:15 - 07727696 _____ () C:\Program Files\Gramblr\gramblr.exe 2016-11-18 22:10 - 2016-11-18 22:10 - 00276480 _____ () c:\program files\nernapyclermocult\tnrcr.dll 2016-11-18 22:16 - 2016-11-18 22:16 - 00638464 _____ () C:\Program Files\03000200-1479514604-0500-0006-000700080009\knsbFA9E.tmpfs 2015-12-26 06:59 - 2015-12-26 06:59 - 00158720 _____ () C:\Users\Cristina\AppData\Local\03000200-1479507492-0500-0006-000700080009\qnsc5BFC.tmp 2016-11-18 22:21 - 2016-11-16 23:08 - 00282703 ____H () C:\Program Files\wanttoxiamen\Bind.exe 2016-11-18 22:21 - 2016-11-18 22:24 - 04213248 _____ () C:\Program Files\mpck\wincom_UL7.exe 2016-11-18 13:53 - 2016-11-18 13:53 - 00121344 _____ () C:\Users\Cristina\AppData\Roaming\KoymtPacetu\Wawjebt.exe 2016-11-18 13:54 - 2016-11-18 22:26 - 00218112 _____ () C:\Users\Cristina\AppData\Roaming\KoymtPacetu\Taepma.din 2016-11-18 13:53 - 2016-11-18 13:53 - 00170496 _____ () C:\Users\Cristina\AppData\Roaming\Imywi\Imywi.exe 2016-11-18 13:53 - 2016-11-18 13:53 - 00112128 _____ () C:\Users\Cristina\AppData\Roaming\Imywi\Movkix.exe 2016-11-18 13:55 - 2016-11-18 22:26 - 00265216 _____ () C:\Program Files\Ebukfijmijpe\Cudpilh.exe 2016-11-18 13:55 - 2016-11-18 22:26 - 00270336 _____ () C:\Program Files\Ebukfijmijpe\Reinaav.exe 2016-11-18 13:55 - 2016-11-18 22:26 - 01681920 _____ () C:\Program Files\Ebukfijmijpe\FueIzela.exe 2016-11-18 13:55 - 2016-11-18 22:26 - 00558592 _____ () C:\Program Files\Ebukfijmijpe\Owelo.exe 2016-11-18 13:55 - 2016-11-18 22:26 - 00722944 _____ () C:\Program Files\Ebukfijmijpe\Hijap.DLL 2016-11-18 13:55 - 2016-11-18 22:26 - 00328704 _____ () C:\Program Files\Ebukfijmijpe\Ueroa.DLL 2016-11-18 13:55 - 2016-11-18 22:26 - 00328192 _____ () C:\Program Files\Ebukfijmijpe\Sajomoat.DLL 2016-11-18 22:26 - 2016-11-18 22:27 - 00369664 _____ () C:\Program Files\YLNC30MHQH\YLNC30MHQ.exe 2016-11-18 22:26 - 2016-11-18 22:29 - 04213248 _____ () C:\Program Files\sunnyday\wincom_VPQ.exe 2016-11-18 22:29 - 2016-11-18 22:29 - 00325596 _____ () C:\Users\Cristina\AppData\Local\Temp\I64V4UDOD\shopperz.exe 2016-11-18 22:29 - 2016-11-18 22:29 - 00006656 _____ () C:\Users\Cristina\AppData\Local\Temp\nslE44C.tmp\nsExec.dll 2016-11-18 22:29 - 2016-11-18 22:29 - 00006656 _____ () C:\Users\Cristina\AppData\Local\Temp\nslE44C.tmp\nsE45D.tmp 2016-09-21 10:53 - 2016-09-21 10:53 - 00351232 _____ () C:\Users\Cristina\AppData\Local\Temp\nslE44C.tmp\preinstaller_win.exe 2016-11-18 22:29 - 2016-11-18 22:29 - 00709632 _____ () C:\Users\Cristina\AppData\Local\Temp\is-1MPKQ.tmp\19HHJU7FS.tmp 2016-11-18 22:29 - 2008-10-15 15:44 - 00205312 _____ () C:\Users\Cristina\AppData\Local\Temp\is-S01JH.tmp\itdownload.dll 2016-11-18 22:30 - 2016-11-18 22:30 - 00321536 _____ () C:\Users\Cristina\AppData\Local\Temp\sdfE8DD.exe 2016-11-18 22:30 - 2016-11-18 22:31 - 00369664 _____ () C:\Users\Cristina\AppData\Local\Temp\LPQ7I4P6NE.exe 2016-11-18 13:55 - 2016-11-18 22:26 - 00229888 _____ () C:\Program Files\Ebukfijmijpe\Bayqg.dll 2016-11-18 22:33 - 2016-11-18 22:33 - 00369664 _____ () C:\Users\Cristina\AppData\Local\Temp\O2KMF50GX\O2KMF50GX.exe ==================== Alternate Data Streams (Whitelisted) ========= (Se uma entrada for incluída na fixlist, somente o ADS será removido.) ==================== Modo de Segurança (Whitelisted) =================== (Se uma entrada for incluída na fixlist, será removida do Registro. O valor "AlternateShell" será restaurado.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\zdengine => ""="service" ==================== Associação (Whitelisted) =============== (Se uma entrada for incluída na fixlist, o ítem no Registro será restaurado para o padrão ou removido.) ==================== Internet Explorer confiável/restrito =============== (Se uma entrada for incluída na fixlist, será removida do Registro.) IE trusted site: HKU\S-1-5-21-1455526487-581654163-2976102132-1000\...\hola.org -> hxxp://hola.org IE trusted site: HKU\S-1-5-21-1455526487-581654163-2976102132-1000\...\localhost -> localhost IE trusted site: HKU\S-1-5-21-1455526487-581654163-2976102132-1000\...\webcompanion.com -> hxxp://webcompanion.com ==================== Hosts Conteúdo: ========================== (Se necessário, a diretiva Hosts: pode ser incluída na fixlist para redefinir o Hosts.) 2009-07-14 00:04 - 2016-11-18 22:24 - 00001370 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 down.baidu2016.com 127.0.0.1 123.sogou.com 127.0.0.1 www.czzsyzgm.com 127.0.0.1 www.czzsyzxl.com 127.0.0.1 union.baidu2019.com 127.0.0.1 down.baidu2016.com 127.0.0.1 123.sogou.com 127.0.0.1 www.czzsyzgm.com 127.0.0.1 www.czzsyzxl.com 127.0.0.1 union.baidu2019.com 127.0.0.1 down.baidu2016.com 127.0.0.1 123.sogou.com 127.0.0.1 www.czzsyzgm.com 127.0.0.1 www.czzsyzxl.com 127.0.0.1 union.baidu2019.com ==================== Outras Áreas ============================ (Atualmente não há nenhuma correção automática para esta seção.) HKU\S-1-5-21-1455526487-581654163-2976102132-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Cristina\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg DNS Servers: 104.197.191.4 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Firewall do Windows está habilitado. ==================== MSCONFIG/TASK MANAGER ítens desabilitados == ==================== Regras do Firewall (Whitelisted) =============== (Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.) FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe FirewallRules: [TCP Query User{F2485DF7-947A-4C44-A1CF-D5EFC2D277CD}C:\users\cristina\appdata\roaming\utorrent\utorrent.exe] => (Block) C:\users\cristina\appdata\roaming\utorrent\utorrent.exe FirewallRules: [UDP Query User{F2CAA337-D7B9-40E5-96B3-BA2194060659}C:\users\cristina\appdata\roaming\utorrent\utorrent.exe] => (Block) C:\users\cristina\appdata\roaming\utorrent\utorrent.exe FirewallRules: [{0A6CE4F1-98D4-4ADD-9FEE-9AF7C1098C20}] => (Allow) C:\Program Files\Hola\app\hola_updater.exe FirewallRules: [{B909E77E-E335-43F2-997F-ADE870636AB5}] => (Allow) C:\Program Files\Hola\app\hola_updater.exe FirewallRules: [{E23184D1-7F79-4B98-9D53-92BA056271A0}] => (Allow) C:\Program Files\Hola\app\hola_svc.exe FirewallRules: [{4C5D8A78-F922-41B6-ADDE-C2F878AF2192}] => (Allow) C:\Program Files\Hola\app\hola_svc.exe FirewallRules: [{1179F6BD-634F-476A-A3F5-51E92B3476AB}] => (Allow) C:\Users\Cristina\AppData\Local\Hola\firefox_hola\app\hola_plugin.exe FirewallRules: [{3ABEAFF3-1424-4030-99C7-F49DCFF40B45}] => (Allow) C:\Users\Cristina\AppData\Local\Hola\firefox_hola\app\hola_plugin.exe FirewallRules: [TCP Query User{62AF754A-B12E-4EAA-9DED-A55F6343A348}C:\users\cristina\downloads\ffinstonline.exe] => (Allow) C:\users\cristina\downloads\ffinstonline.exe FirewallRules: [UDP Query User{1CF3B78D-7D84-4CA7-A278-8C80946B4ED0}C:\users\cristina\downloads\ffinstonline.exe] => (Allow) C:\users\cristina\downloads\ffinstonline.exe FirewallRules: [TCP Query User{90797299-C48D-417E-85BD-0C99425F909B}C:\program files\formatfactory\ffmodules\package\pfinstonline.exe] => (Block) C:\program files\formatfactory\ffmodules\package\pfinstonline.exe FirewallRules: [UDP Query User{F1A1B543-2EBB-4239-84E8-A7B504AE0B9F}C:\program files\formatfactory\ffmodules\package\pfinstonline.exe] => (Block) C:\program files\formatfactory\ffmodules\package\pfinstonline.exe FirewallRules: [{88AFDF44-9A0F-4E44-B4FC-D3C82A79BB7F}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe FirewallRules: [{6CEF2555-3A19-4BD8-BD31-CC6E3D6F23AD}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe FirewallRules: [{055FF2A9-4939-41B5-8DF8-67A9AF57108B}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe FirewallRules: [TCP Query User{31764817-11A6-492C-ACD8-9CF1FC11D71A}C:\program files\connectify\connectify.exe] => (Allow) C:\program files\connectify\connectify.exe FirewallRules: [UDP Query User{A040EE3D-B86E-4022-8809-9012CDE26437}C:\program files\connectify\connectify.exe] => (Allow) C:\program files\connectify\connectify.exe FirewallRules: [{6F23B8BE-58C3-4841-89D7-D6CFF586FC7B}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe FirewallRules: [{B70DDF8B-B675-4D3D-8315-5846FFCFB793}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe FirewallRules: [{FE51C903-600A-4770-8D7F-AADED42434A0}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [{DFA3691A-80CF-4447-8B3A-B79428F2F77F}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [{D9259CF0-5392-40A3-9A81-56CD7A79D851}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{88567765-91BC-44A7-BC19-D0D6026E2388}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [TCP Query User{45678DFE-F05F-4F8B-8C19-35C55E409B3F}C:\users\cristina\appdata\roaming\utorrent\utorrent.exe] => (Block) C:\users\cristina\appdata\roaming\utorrent\utorrent.exe FirewallRules: [UDP Query User{8B990542-765C-4F67-B384-F3F8B9C06845}C:\users\cristina\appdata\roaming\utorrent\utorrent.exe] => (Block) C:\users\cristina\appdata\roaming\utorrent\utorrent.exe FirewallRules: [{F811C5CD-EE7E-4DB1-B3E1-1584B54E33E2}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [{009E7199-7FC1-44BF-ACC9-CC89C04C2CF7}] => (Allow) C:\Program Files\Microsoft Office\Office15\lync.exe FirewallRules: [{A545D201-095F-45BE-A842-3B819ED7898D}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{5E2A8962-4649-47FC-8A2E-D0A0DC2F7662}] => (Allow) C:\Program Files\Microsoft Office\Office15\UcMapi.exe FirewallRules: [{24A22850-0753-41B5-BE67-71E91631194A}] => (Allow) C:\Users\Cristina\AppData\Local\Chromium\Application\chrome.exe FirewallRules: [TCP Query User{F96E65D6-0FC0-45A8-A85B-E4BA4D54187E}C:\program files\formatfactory\formatfactory.exe] => (Allow) C:\program files\formatfactory\formatfactory.exe FirewallRules: [UDP Query User{BEDD88DA-1565-408B-BE25-5A5897C3AE4D}C:\program files\formatfactory\formatfactory.exe] => (Allow) C:\program files\formatfactory\formatfactory.exe FirewallRules: [TCP Query User{20BF40EB-0AD2-4437-B11A-7E89EEC8FCE8}C:\users\cristina\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\cristina\appdata\roaming\spotify\spotify.exe FirewallRules: [UDP Query User{0E93F067-A3DB-4313-9EE3-C9AA722C8144}C:\users\cristina\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\cristina\appdata\roaming\spotify\spotify.exe FirewallRules: [TCP Query User{068DB383-F61A-42DA-81C3-65B425617246}C:\users\cristina\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\cristina\appdata\roaming\spotify\spotify.exe FirewallRules: [UDP Query User{642521F1-ED09-4918-B7DF-52D3DEB54AC9}C:\users\cristina\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\cristina\appdata\roaming\spotify\spotify.exe FirewallRules: [{3F0F1F54-CB93-4792-A48D-1590D491249D}] => (Allow) C:\Users\Cristina\AppData\Local\Temp\is-8L5V5.tmp\download\MiniThunderPlatform.exe FirewallRules: [TCP Query User{FFC16C17-093E-49E6-9743-8033EE1B91C1}C:\program files\greatmaker\maohawifi\maohawifi.exe] => (Allow) C:\program files\greatmaker\maohawifi\maohawifi.exe FirewallRules: [UDP Query User{B231E1F4-2CCB-47A5-91B2-8122D0B9B6FA}C:\program files\greatmaker\maohawifi\maohawifi.exe] => (Allow) C:\program files\greatmaker\maohawifi\maohawifi.exe FirewallRules: [{01033B9B-8EF0-4EDD-92A3-59C3389CF1E4}] => (Allow) C:\Program Files\GreatMaker\MaohaWiFi\MaohaWiFi.exe FirewallRules: [{6027B9EE-FAD8-4897-8BD5-F32934AFFDB5}] => (Allow) C:\Program Files\GreatMaker\MaohaWiFi\DrvUpdate.exe FirewallRules: [{3E3B34AD-1841-4BE4-9F61-E77867EAE647}] => (Allow) C:\Program Files\GreatMaker\MaohaWiFi\MaohaWifiSvr.exe ==================== Pontos de Restauração ========================= 11-11-2016 21:34:09 Ponto de Verificação Agendado 12-11-2016 15:42:35 Windows Update 15-11-2016 00:04:03 Windows Update 15-11-2016 15:23:47 LavasoftWeCompanion 15-11-2016 22:30:14 Windows Update 16-11-2016 12:43:44 Windows Update 18-11-2016 22:14:40 Removed MSXML 4.0 SP2 (KB954430) 18-11-2016 22:15:26 Removed MSXML 4.0 SP2 (KB973688) 18-11-2016 22:29:49 Removed Microsoft Silverlight ==================== Dispositivos Apresentando Falhas No Gerenciador ============= ==================== Erros no Log de eventos: ========================= Erros em Aplicativos: ================== Error: (11/18/2016 10:10:06 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Nome de aplicativo com falha: KINCB.exe, versão: 2.1.1.3, carimbo de hora: 0x2a425e19 Nome do módulo de falhas: KINCB.exe, versão: 2.1.1.3, carimbo de hora: 0x2a425e19 Código de exceção: 0xc0000005 Deslocamento com falha: 0x000f8e30 Identificação do processo com falha: 0x15a4 Hora de início do aplicativo com falha: 0x01d241f9104a3a9b Caminho do aplicativo com falha: C:\Users\Cristina\AppData\Local\Temp\Rar$EX00.700\KINCB.exe FCaminho do módulo de falhas: C:\Users\Cristina\AppData\Local\Temp\Rar$EX00.700\KINCB.exe Identificação do Relatório: 8638e6c6-adec-11e6-9736-c89cdc40a2bc Error: (11/18/2016 07:37:08 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: O programa uTorrent.exe versão 3.4.8.42576 parou de interagir com o Windows e foi fechado. Para ver se há mais informações disponíveis sobre o problema, verifique o histórico de problemas no painel de controle da Central de Ações. ID de Processo: 768 Hora de Início: 01d241ce2912bec0 Hora de Término: 65 Caminho do Aplicativo: C:\Users\Cristina\AppData\Roaming\uTorrent\uTorrent.exe Id do Relatório: 26558375-add7-11e6-9736-c89cdc40a2bc Error: (11/18/2016 05:03:04 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (11/18/2016 04:21:32 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: ) Description: Event-ID 0 Error: (11/18/2016 04:13:07 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (11/17/2016 03:20:12 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (11/17/2016 12:22:56 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: ) Description: Event-ID 0 Error: (11/17/2016 12:14:31 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (11/16/2016 01:11:44 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (11/16/2016 12:49:49 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: ) Description: Event-ID 0 Erros de Sistema: ============= Error: (11/18/2016 10:11:16 PM) (Source: Service Control Manager) (EventID: 7030) (User: ) Description: O serviço Qovchgroserge está marcado como um serviço interativo. No entanto, o sistema está configurado para não permitir serviços interativos. Esse serviço pode não funcionar corretamente. Error: (11/18/2016 09:27:59 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: O serviço Conectividade do Windows para Gramblr. foi finalizado inesperadamente. Isto aconteceu 1 vez(es). A seguinte ação corretiva será tomada em 500 milissegundos: Reiniciar o serviço. Error: (11/18/2016 09:27:59 PM) (Source: Service Control Manager) (EventID: 7023) (User: ) Description: O serviço Conectividade do Windows para Gramblr. terminou com o erro: Função incorreta. Error: (11/18/2016 05:02:00 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Não foi possível iniciar o serviço The Calendar Service devido ao seguinte erro: O sistema não pode encontrar o arquivo especificado. Error: (11/18/2016 05:01:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Não foi possível iniciar o serviço Border Photo Album devido ao seguinte erro: O sistema não pode encontrar o arquivo especificado. Error: (11/18/2016 05:01:50 PM) (Source: Service Control Manager) (EventID: 7023) (User: ) Description: O serviço Archer terminou com o erro: O sistema não pode encontrar o arquivo especificado. Error: (11/18/2016 04:11:43 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Não foi possível iniciar o serviço The Calendar Service devido ao seguinte erro: O sistema não pode encontrar o arquivo especificado. Error: (11/18/2016 04:11:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Não foi possível iniciar o serviço Border Photo Album devido ao seguinte erro: O sistema não pode encontrar o arquivo especificado. Error: (11/18/2016 04:11:30 PM) (Source: Service Control Manager) (EventID: 7023) (User: ) Description: O serviço Archer terminou com o erro: O sistema não pode encontrar o arquivo especificado. Error: (11/17/2016 03:18:47 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Não foi possível iniciar o serviço The Calendar Service devido ao seguinte erro: O sistema não pode encontrar o arquivo especificado. ==================== Informações da Memória =========================== Processador: Pentium(R) Dual-Core CPU E5700 @ 3.00GHz Percentagem de memória em uso: 56% RAM física total: 3261.24 MB RAM física disponível: 1421.36 MB Virtual Total: 6518.75 MB Virtual disponível: 4249.71 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:931.41 GB) (Free:646.61 GB) NTFS ==================== MBR & Tabela de Partições ================== ==================== Fim de Addition.txt ============================