Resultado do exame da Farbar Recovery Scan Tool (FRST) (x64) Versão: 21-12-2016 Executado por User (administrador) em USER-PC (23-12-2016 01:40:14) Executando a partir de C:\Users\User\Downloads Perfis Carregados: User (Perfis Disponíveis: User) Platform: Windows 7 Ultimate Service Pack 1 (X64) Idioma: Português (Brasil) Internet Explorer Versão 11 (Navegador padrão: FF) Modo da Inicialização: Normal Tutorial da Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processos (Whitelisted) ================= (Se uma entrada for incluída na fixlist, o processo será fechado. O arquivo não será movido.) (GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgwdsvca.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Windows\System32\msiexec.exe (GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler64.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgui.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.EXE () C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe (AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\40.3.6\ToolbarUpdater.exe () C:\Program Files (x86)\AVG Web TuneUp\vprot.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe (AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\40.3.6\ScriptHelper.exe (AVG Technologies CZ, s.r.o.) C:\Windows\Temp\AvgSetup\1684437e-fec2-47cf-8892-19d59aa7fb78\install\avgsetupx.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgidsagenta.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgcsrva.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgemca.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgnsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgrsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe ==================== Registro (Whitelisted) ==================== (Se uma entrada for incluída na fixlist, o ítem no Registro será restaurado para o padrão ou removido. O arquivo não será movido.) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Web TuneUp\vprot.exe [2180680 2016-12-23] () HKLM-x32\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [240400 2016-12-06] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\Av\avgui.exe [6709008 2016-07-28] (AVG Technologies CZ, s.r.o.) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\ GbPluginBb: C:\Program Files (x86)\GbPlugin\gbieh.dll [2014-07-31] (Banco do Brasil) HKU\S-1-5-21-3710701932-2594838249-1569254859-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [333824 2010-11-21] (Microsoft Corporation) IFEO\hpwucli.exe: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe" ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\PROGRAM FILES (X86)\GbPlugin\gbieh.dll [1754664 2014-07-31] (Banco do Brasil) ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-11-30] (Google) ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-11-30] (Google) ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-11-30] (Google) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Nenhum Arquivo ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => -> Nenhum Arquivo Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitorar alertas de tinta - HP Deskjet 1000 J110 series.lnk [2016-12-23] ShortcutTarget: Monitorar alertas de tinta - HP Deskjet 1000 J110 series.lnk -> C:\Program Files\HP\HP Deskjet 1000 J110 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.) ==================== Internet (Whitelisted) ==================== (Se um ítem for incluído na fixlist, sendo um ítem do Registro, será removido ou restaurado para o padrão.) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{15BDDEF3-F265-44EF-9E5F-55EB6D984B30}: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{92D1800C-9934-4A35-BA9A-7BFADC3E6FC7}: [NameServer] 4.2.2.2,4.2.2.1 Tcpip\..\Interfaces\{92D1800C-9934-4A35-BA9A-7BFADC3E6FC7}: [DhcpNameServer] 192.168.0.1 Internet Explorer: ================== HKU\S-1-5-21-3710701932-2594838249-1569254859-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://mysearch.avg.com/?cid=%7BE0D1388E-F85A-44D9-A316-F528966DF299%7D&mid=009e03ce8e1e47d3b3d919d59aa7fb78-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=pt-br&ds=AVG&coid=avgtbavg&cmpid=0616avz&pr=fr&d=2016-06-20%2011:35:41&v=4.3.1.831&pid=wtu&sg=&sap=hp HKU\S-1-5-21-3710701932-2594838249-1569254859-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://start.search.us.com/v/2/?guid={8201766A-3373-4FD7-B6DF-6E259DA0422C}&serpv=5 SearchScopes: HKU\S-1-5-21-3710701932-2594838249-1569254859-1000 -> DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={E0D1388E-F85A-44D9-A316-F528966DF299}&mid=009e03ce8e1e47d3b3d919d59aa7fb78-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=pt-br&ds=AVG&coid=avgtbavg&cmpid=0616avz&pr=fr&d=2016-06-20 11:35:41&v=4.3.6.255&pid=wtu&sg=&sap=dsp&q={searchTerms} SearchScopes: HKU\S-1-5-21-3710701932-2594838249-1569254859-1000 -> {5EAE9F62-ECA5-4DDB-896E-AA03D96ECE73} URL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=tightropetb&type=10671 SearchScopes: HKU\S-1-5-21-3710701932-2594838249-1569254859-1000 -> {69823153-BA05-49F6-AACF-0F22AB086A72} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYBR&apn_uid=6DD49806-4E4F-47CD-8C1B-F8605083441D&apn_sauid=95341C2B-DB8A-46CC-9FBB-F02F5A8F69B7 SearchScopes: HKU\S-1-5-21-3710701932-2594838249-1569254859-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={E0D1388E-F85A-44D9-A316-F528966DF299}&mid=009e03ce8e1e47d3b3d919d59aa7fb78-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=pt-br&ds=AVG&coid=avgtbavg&cmpid=0616avz&pr=fr&d=2016-06-20 11:35:41&v=4.3.6.255&pid=wtu&sg=&sap=dsp&q={searchTerms} SearchScopes: HKU\S-1-5-21-3710701932-2594838249-1569254859-1000 -> {CABF4BD7-EF20-49B3-9624-63056ED448D3} URL = hxxp://search.us.com/serp?guid={8201766A-3373-4FD7-B6DF-6E259DA0422C}&action=default_search&serpv=5&k={searchTerms} BHO: avast! Online Security -> {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -> Nenhum Arquivo BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2016-07-12] (Microsoft Corporation) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2016-07-05] (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2016-07-05] (Microsoft Corporation) BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-12] (Microsoft Corporation.) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-02-09] (Oracle Corporation) BHO-x32: Auxiliar de Conexão do Windows Live ID -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.) BHO-x32: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Web TuneUp\4.3.6.255\AVG Web TuneUp.dll [2016-12-23] (AVG) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2016-07-05] (Microsoft Corporation) BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540000} -> C:\PROGRAM FILES (X86)\GBPLUGIN\gbieh.dll [2014-07-31] (Banco do Brasil) BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-12] (Microsoft Corporation.) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-09] (Oracle Corporation) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - Nenhum Arquivo Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-12] (Microsoft Corporation.) Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-12] (Microsoft Corporation.) Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2016-07-28] (Microsoft Corporation) FireFox: ======== FF DefaultProfile: id1a0qqj.default-1406121754000 FF ProfilePath: C:\Users\User\AppData\Roaming\Philips-Songbird\Profiles\k8xzsngl.default [2016-07-15] FF NetworkProxy: Philips-Songbird\Profiles\k8xzsngl.default -> no_proxies_on", "127.0.0.1;localhost" FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\albumart@songbirdnest.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\cd-rip@songbirdnest.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\ewaacdec@songbirdnest.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\ewmp3enc@songbirdnest.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\fileassociation@philips.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\gogear@songbirdnest.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\gonzo@songbirdnest.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\gracenote@songbirdnest.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\langpack-pt-BR@songbirdnest.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\mashTape@songbirdnest.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\msc@songbirdnest.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\mtp@songbirdnest.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\philips-addon-manager@philips.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\philips-branding@philips.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\philips-likemusic@philips.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\philips-minimizetotray@philips.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\philips-msc-mtp-switch@philips.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\philips-promotions@philips.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\philips-skin@philips.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\philips-ui@philips.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\purplerain@songbirdnest.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\sharing@songbirdnest.com [não encontrado (a)] FF Extension: (Sem Nome) - C:\Program Files (x86)\Philips\Philips Songbird\extensions\windowsmedia@songbirdnest.com [não encontrado (a)] FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\id1a0qqj.default-1406121754000 [2016-12-23] FF user.js: detected! => C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\id1a0qqj.default-1406121754000\user.js [2014-07-23] FF DefaultSearchEngine: Mozilla\Firefox\Profiles\id1a0qqj.default-1406121754000 -> AVG Secure Search FF Extension: (AVG Web TuneUp) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\id1a0qqj.default-1406121754000\Extensions\avg@toolbar.xpi [2016-12-23] FF Extension: (Adblock Plus) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\id1a0qqj.default-1406121754000\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-06-23] FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\id1a0qqj.default-1406121754000\searchplugins\avg-secure-search.xml [2016-12-23] FF HKU\S-1-5-21-3710701932-2594838249-1569254859-1000\...\Firefox\Extensions: [{87F8774F-B485-47E2-A755-A40A8A5E886C}] - C:\Users\User\AppData\Local\GAS Tecnologia\GBBD\bb\xpi FF Extension: (GBBD Banco do Brasil) - C:\Users\User\AppData\Local\GAS Tecnologia\GBBD\bb\xpi [2014-05-04] [não assinado] FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_22_0_0_209.dll [2016-07-12] () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_209.dll [2016-07-12] () FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\40.3.6\\npsitesafety.dll [Nenhum Arquivo] FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google) FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-09] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-09] (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-12-26] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-23] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-23] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-12-21] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-3710701932-2594838249-1569254859-1000: @tightropeinteractive.com/Plugin -> C:\Users\User\AppData\Local\TNT2\2.0.0.1627\npTNT2.dll [2013-08-17] (Search.Us.com) FF Plugin HKU\S-1-5-21-3710701932-2594838249-1569254859-1000: @tnt2ghost.com/Plugin -> C:\Users\User\AppData\Local\TNT2\2.0.0.1627\npTNT2ghost.dll [2013-08-17] (Search.Us.com) FF Plugin HKU\S-1-5-21-3710701932-2594838249-1569254859-1000: autodesk.com/Autodesk123D -> C:\Users\User\AppData\Roaming\Autodesk\Autodesk123D32\1.0.7\npAutodesk123D32.dll [2013-07-19] (Autodesk) FF Plugin HKU\S-1-5-21-3710701932-2594838249-1569254859-1000: autodesk.com/Autodesk123DShapes -> C:\Users\User\AppData\Local\Autodesk\123DPlugins\Autodesk 123D Shapes321.0.129\npAutodesk123DShapes32.dll [2013-09-26] (Autodesk) FF Plugin HKU\S-1-5-21-3710701932-2594838249-1569254859-1000: gastecnologia.com.br/sf/bb -> C:\Users\User\AppData\Local\GAS Tecnologia\GBBD\npsf_bb.dll [2014-05-04] (GAS Tecnologia) Chrome: ======= CHR DefaultProfile: Default CHR HomePage: Default -> mysearch.avg.com/?rvt=1 CHR StartupUrls: Default -> "hxxps://www.google.com.br/" CHR DefaultSearchURL: Default -> hxxps://mysearch.avg.com/search?rvt=1&sap=dsp&q={searchTerms} CHR DefaultSearchKeyword: Default -> https://mysearch.avg.com CHR DefaultSuggestURL: Default -> hxxps://toolbar.avg.com/acp?q={searchTerms}&o=1 CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\PepperFlash\pepflashplayer.dll () CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\ppGoogleNaClPluginChrome.dll => Nenhum Arquivo CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\pdf.dll => Nenhum Arquivo CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL => Nenhum Arquivo CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL => Nenhum Arquivo CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll => Nenhum Arquivo CHR Plugin: (Java(TM) Platform SE 7 U10) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll => Nenhum Arquivo CHR Plugin: (Java Deployment Toolkit 7.0.100.18) - C:\Windows\SysWOW64\npDeployJava1.dll => Nenhum Arquivo CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll => Nenhum Arquivo CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default [2016-12-23] CHR Extension: (Autodesk 123D Design) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\adcpobnhinigjfgdjponlboohbhigoml [2014-12-02] CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-06-12] CHR Extension: (AVG Secure Search) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\chfdnecihphmhljaaejmgoiahnihplgn [2016-12-23] CHR Extension: (Pesquisa do Google) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-02] CHR Extension: (Documentos Google off-line) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-08-09] CHR Extension: (AdBlock) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-12-23] CHR Extension: (Pagamentos da Chrome Web Store) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-06-12] CHR Extension: (GBBD Banco do Brasil) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgacfjdigcddmmncljpflgcfpfahebkh [2014-12-02] CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-06-12] CHR Extension: (Chrome Media Router) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-23] CHR HKU\S-1-5-21-3710701932-2594838249-1569254859-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [chfdnecihphmhljaaejmgoiahnihplgn] - hxxps://clients2.google.com/service/update2/crx CHR HKU\S-1-5-21-3710701932-2594838249-1569254859-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pgacfjdigcddmmncljpflgcfpfahebkh] - C:\Users\User\AppData\Local\GAS Tecnologia\GBBD\bb\sf.crx [2013-07-11] CHR HKLM-x32\...\Chrome\Extension: [mphpbdjcljebbcnfopfngmfdackbbdgf] - C:\Program Files (x86)\DealPly\DealPly.crx ==================== Serviços (Whitelisted) ==================== (Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.) S3 AvgAMPS; C:\Program Files (x86)\AVG\Av\avgamps.exe [674552 2016-07-28] (AVG Technologies CZ, s.r.o.) R2 AVGIDSAgent; C:\Program Files (x86)\AVG\Av\avgidsagenta.exe [5267456 2016-07-28] (AVG Technologies CZ, s.r.o.) R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1146128 2016-12-06] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files (x86)\AVG\Av\avgwdsvca.exe [760024 2016-07-28] (AVG Technologies CZ, s.r.o.) R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [3189488 2016-07-05] (Microsoft Corporation) R2 GbpSv; C:\Program Files (x86)\GbPlugin\gbpsv.exe [546104 2014-07-21] (GAS Tecnologia) R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2015-06-25] (TuneUp Software) R2 vToolbarUpdater40.3.6; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\40.3.6\ToolbarUpdater.exe [1349704 2016-12-23] (AVG Secure Search) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) R2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [980552 2016-12-23] () ===================== Drivers (Whitelisted) ====================== (Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.) R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [163072 2016-05-13] (AVG Technologies CZ, s.r.o.) R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [314112 2016-06-30] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [261376 2016-06-01] (AVG Technologies CZ, s.r.o.) R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [260352 2016-06-01] (AVG Technologies CZ, s.r.o.) R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [360736 2016-02-16] (AVG Technologies CZ, s.r.o.) R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [261888 2016-07-19] (AVG Technologies CZ, s.r.o.) R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [52992 2016-06-01] (AVG Technologies CZ, s.r.o.) R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [298752 2016-07-12] (AVG Technologies CZ, s.r.o.) R0 avguniva; C:\Windows\System32\DRIVERS\avguniva.sys [77056 2016-06-20] (AVG Technologies CZ, s.r.o.) S0 GbpKm; C:\Windows\SysWOW64\drivers\GbpKm.sys [49536 2013-05-08] (GAS Tecnologia) R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [110744 2012-07-19] (Qualcomm Atheros Co., Ltd.) R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [31144 2015-06-04] (TuneUp Software) S3 AIDA64Driver; \??\C:\Users\User\Desktop\AIDA64\AIDA64\kerneld.x64 [X] S3 EverestDriver; \??\C:\Program Files (x86)\Lavalys\EVEREST Ultimate Edition\kerneld.amd64 [X] S3 VGPU; System32\drivers\rdvgkmd.sys [X] ==================== NetSvcs (Whitelisted) =================== (Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.) ==================== Três Meses Criados arquivos e pastas ======== (Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.) 2016-12-23 01:40 - 2016-12-23 01:40 - 00026236 _____ C:\Users\User\Downloads\FRST.txt 2016-12-23 01:39 - 2016-12-23 01:40 - 00000000 ____D C:\FRST 2016-12-23 01:38 - 2016-12-23 01:38 - 19828824 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe 2016-12-23 01:37 - 2016-12-23 01:38 - 00002833 _____ C:\Users\User\Desktop\FSS.txt 2016-12-23 01:37 - 2016-12-23 01:37 - 00000000 ____D C:\Users\User\AppData\Local\CEF 2016-12-23 01:34 - 2016-12-23 01:34 - 02420736 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe 2016-12-23 01:32 - 2016-12-23 01:33 - 01762816 _____ (Farbar) C:\Users\User\Desktop\FRST.exe 2016-12-23 01:31 - 2016-12-23 01:31 - 00003600 _____ C:\Windows\System32\Tasks\AVG EUpdate Task 2016-12-23 01:30 - 2016-12-23 01:30 - 00899584 _____ (Farbar) C:\Users\User\Desktop\FSS.exe 2016-12-23 01:15 - 2016-12-23 01:15 - 00000000 ____D C:\Users\Todos os Usuários\Avg_Update_1216tb 2016-12-23 01:15 - 2016-12-23 01:15 - 00000000 ____D C:\ProgramData\Avg_Update_1216tb ==================== Três Meses Modificados arquivos e pastas ======== (Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.) 2016-12-23 01:40 - 2012-12-27 16:06 - 00002193 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2016-12-23 01:39 - 2012-12-27 16:10 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2016-12-23 01:39 - 2012-12-27 16:10 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2016-12-23 01:39 - 2012-12-27 16:10 - 00003840 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2016-12-23 01:39 - 2012-12-27 16:10 - 00000902 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2016-12-23 01:38 - 2009-07-14 02:45 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2016-12-23 01:38 - 2009-07-14 02:45 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2016-12-23 01:28 - 2016-06-20 12:35 - 00000000 ____D C:\Users\Todos os Usuários\AVG Web TuneUp 2016-12-23 01:28 - 2016-06-20 12:35 - 00000000 ____D C:\ProgramData\AVG Web TuneUp 2016-12-23 01:28 - 2013-05-19 15:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive 2016-12-23 01:26 - 2016-06-20 12:35 - 00000000 ____D C:\Program Files (x86)\AVG Web TuneUp 2016-12-23 01:25 - 2014-05-04 13:13 - 00000000 ____D C:\Users\Todos os Usuários\MFAData 2016-12-23 01:25 - 2014-05-04 13:13 - 00000000 ____D C:\ProgramData\MFAData 2016-12-23 01:20 - 2010-11-21 07:37 - 00654272 _____ C:\Windows\system32\prfh0416.dat 2016-12-23 01:20 - 2010-11-21 07:37 - 00124724 _____ C:\Windows\system32\prfc0416.dat 2016-12-23 01:20 - 2009-07-14 03:13 - 01491932 _____ C:\Windows\system32\PerfStringBackup.INI 2016-12-23 01:20 - 2009-07-14 01:20 - 00000000 ____D C:\Windows\inf 2016-12-23 01:16 - 2012-12-27 16:03 - 00003500 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2016-12-23 01:16 - 2012-12-27 16:03 - 00003372 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2016-12-23 01:13 - 2009-07-14 03:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT ==================== Arquivos na raiz de alguns diretórios ======= 2013-07-11 16:25 - 2014-02-05 14:33 - 0030380 _____ () C:\Users\User\AppData\Roaming\unins000.dat 2014-02-05 14:33 - 2014-02-05 14:32 - 0720082 _____ () C:\Users\User\AppData\Roaming\unins000.exe 2016-08-25 18:12 - 2016-08-25 18:12 - 0006135 _____ () C:\Users\User\AppData\Local\recently-used.xbel 2013-08-26 17:24 - 2013-08-26 17:24 - 0000057 _____ () C:\ProgramData\Ament.ini Alguns arquivos em TEMP: ==================== C:\Users\User\AppData\Local\Temp\avguirn_081906895352.exe ==================== Bamital & volsnap ====================== (Não há correção automática para arquivos que não passaram na verificação.) C:\Windows\system32\winlogon.exe => O arquivo é assinado digitalmente C:\Windows\system32\wininit.exe => O arquivo é assinado digitalmente C:\Windows\SysWOW64\wininit.exe => O arquivo é assinado digitalmente C:\Windows\explorer.exe => O arquivo é assinado digitalmente C:\Windows\SysWOW64\explorer.exe => O arquivo é assinado digitalmente C:\Windows\system32\svchost.exe => O arquivo é assinado digitalmente C:\Windows\SysWOW64\svchost.exe => O arquivo é assinado digitalmente C:\Windows\system32\services.exe => O arquivo é assinado digitalmente C:\Windows\system32\User32.dll => O arquivo é assinado digitalmente C:\Windows\SysWOW64\User32.dll => O arquivo é assinado digitalmente C:\Windows\system32\userinit.exe => O arquivo é assinado digitalmente C:\Windows\SysWOW64\userinit.exe => O arquivo é assinado digitalmente C:\Windows\system32\rpcss.dll => O arquivo é assinado digitalmente C:\Windows\system32\dnsapi.dll => O arquivo é assinado digitalmente C:\Windows\SysWOW64\dnsapi.dll => O arquivo é assinado digitalmente C:\Windows\system32\Drivers\volsnap.sys => O arquivo é assinado digitalmente LastRegBack: 2016-08-15 20:51 ==================== Fim de FRST.txt ============================