Resultado do exame da Farbar Recovery Scan Tool (FRST) (x64) Versão: 15-03-2017 Executado por Renato (administrador) em RENATO-PC (21-03-2017 15:07:37) Executando a partir de C:\Users\Renato\Downloads Perfis Carregados: Renato (Perfis Disponíveis: Renato) Platform: Windows 7 Ultimate (X64) Idioma: Português (Brasil) Internet Explorer Versão 9 (Navegador padrão: IE) Modo da Inicialização: Normal Tutorial da Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processos (Whitelisted) ================= (Se uma entrada for incluída na fixlist, o processo será fechado. O arquivo não será movido.) (GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe () C:\ProgramData\service.exe () C:\Windows\SysWOW64\srvany.exe () C:\Windows\KMService.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe (Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe () C:\Windows\svchost.exe (Microsoft Corporation) C:\ProgramData\Windows Security\winsecurity.exe () C:\Windows\csrss.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE () C:\Users\Renato\AppData\Roaming\WMPNetworkAcSvc\WMPNetworkAcSvc.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler64.exe (Microsoft Corporation) C:\Program Files\XBox\XBLive.exe () C:\Windows\Temp\g7A8D.tmp.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe (GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe (Microsoft Corporation) C:\ProgramData\Microsoft\Network\Dsq\network\sysnetwk.exe (LITE-ON TECHNOLOGY CORP.) C:\Program Files\Lenovo\USB Enhanced Performance Keyboard\Skdaemon.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (Microsoft Corporation) C:\Windows\System32\StikyNot.exe (Microsoft) C:\Users\Renato\AppData\Roaming\c4dRcR\wxX0TN.exe () C:\Users\Renato\AppData\Local\Temp\00009360\msiql.exe () C:\Users\Renato\AppData\Local\LikeToles01a\MCHromptoolz0.exe (Nuance Communications, Inc.) C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe (CompSoft) C:\Program Files (x86)\DoroPDFWriter\DoroServer.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Windows\System32\msiexec.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe (Microsoft Corporation) C:\Windows\System32\rstrui.exe (Microsoft Corporation) C:\Windows\System32\wbengine.exe (Microsoft Corporation) C:\Windows\System32\vds.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registro (Whitelisted) ==================== (Se uma entrada for incluída na fixlist, o ítem no Registro será restaurado para o padrão ou removido. O arquivo não será movido.) HKLM\...\Run: [Enhanced Performance Keyboard] => C:\Program Files\Lenovo\USB Enhanced Performance Keyboard\SKDaemon.exe [4013056 2014-08-17] (LITE-ON TECHNOLOGY CORP.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11465832 2010-09-07] (Realtek Semiconductor) HKLM\...\Run: [Diebold - Warsaw] => C:\Program Files\Diebold\Warsaw\core.exe [925744 2016-06-23] (GAS Tecnologia LTDA) HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation) HKLM-x32\...\Run: [SSBkgdUpdate] => C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.) HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe [29984 2007-10-18] (Nuance Communications, Inc.) HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe [46368 2007-10-18] (Nuance Communications, Inc.) HKLM-x32\...\Run: [PPort11reminder] => "C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\PaperPort\11\Config\Ereg\Ereg.ini HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35760 2009-12-22] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [948672 2009-12-11] (Adobe Systems Incorporated) HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation) HKLM-x32\...\Run: [DoroServer] => C:\Program Files (x86)\DoroPDFWriter\DoroServer.exe [208896 2015-09-23] (CompSoft) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\ GbPluginCef: C:\Program Files (x86)\GbPlugin\gbiehCef.dll [2016-10-27] (Caixa Economica Federal) HKU\S-1-5-21-3989744648-3571885242-2210684081-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9364696 2017-03-03] (Piriform Ltd) HKU\S-1-5-21-3989744648-3571885242-2210684081-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-13] (Microsoft Corporation) HKU\S-1-5-21-3989744648-3571885242-2210684081-1000\...\Run: [1A9A31FFF1059ED7] => C:\Users\Renato\AppData\Roaming\c4dRcR\wxX0TN.exe [34496 2017-03-21] (Microsoft) HKU\S-1-5-21-3989744648-3571885242-2210684081-1000\...\Run: [msiql] => C:\Users\Renato\AppData\Local\Temp\00009360\msiql.exe [2072064 2017-03-21] () <===== ATENÇÃO HKU\S-1-5-21-3989744648-3571885242-2210684081-1000\...\Run: [osmsg] => C:\ProgramData\WindowsMsg\Chrome.exe [7174656 2017-03-14] () HKU\S-1-5-21-3989744648-3571885242-2210684081-1000\...\MountPoints2: {836cd6b1-262d-11e5-b3cd-d43d7efcf277} - F:\Setup.exe HKLM\...\Providers\a40l9eyv: C:\Program Files (x86)\Stukatprjertion Update\local64spl.dll [307712 2017-03-21] () ShellExecuteHooks: Sem Nome - {976C97C2-03AA-11E7-8491-64006A5CFC23} - -> Nenhum Arquivo ShellExecuteHooks: Sem Nome - {29E23142-03AB-11E7-928B-64006A5CFC23} - -> Nenhum Arquivo ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399003} - C:\Program Files (x86)\GbPlugin\gbiehcef.dll [1903328 2016-10-27] (Caixa Economica Federal) ShellIconOverlayIdentifiers: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => -> Nenhum Arquivo ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => -> Nenhum Arquivo ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => -> Nenhum Arquivo ShellIconOverlayIdentifiers: [KzShlobj] -> {AAA0C5B8-933F-4200-93AD-B143D7FFF9F2} => C:\Program Files\¿ìѹ\X64\KZipShell.dll [2017-03-21] () ShellIconOverlayIdentifiers-x32: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => -> Nenhum Arquivo ShellIconOverlayIdentifiers-x32: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => -> Nenhum Arquivo ShellIconOverlayIdentifiers-x32: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => -> Nenhum Arquivo Startup: C:\Users\Renato\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\35768.js [2017-03-21] () Startup: C:\Users\Renato\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MCHromptoolz0.lnk [2017-03-21] ShortcutTarget: MCHromptoolz0.lnk -> C:\Users\Renato\AppData\Local\LikeToles01a\MCHromptoolz0.exe () GroupPolicy: Restrição <======= ATENÇÃO CHR HKLM\SOFTWARE\Policies\Google: Restrição <======= ATENÇÃO ==================== Internet (Whitelisted) ==================== (Se um ítem for incluído na fixlist, sendo um ítem do Registro, será removido ou restaurado para o padrão.) ProxyEnable: [S-1-5-21-3989744648-3571885242-2210684081-1000] => Proxy está habilitado. ProxyServer: [S-1-5-21-3989744648-3571885242-2210684081-1000] => http=127.0.0.1:8080;https=127.0.0.1:8080 Hosts: Há mais de uma entrada no Hosts. Veja a seção Hosts do Addition.txt Tcpip\..\Interfaces\{1025BF11-E7F8-41BD-8393-DE293559B26D}: [NameServer] 8.8.8.8 ManualProxies: 1http=127.0.0.1:8080;https=127.0.0.1:8080 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://br.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dnldastr_17_13¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0DyEtA0DyB0E0F0C0FtByByB0DzytAtCtN0D0Tzu0StCzytDyCtN1L2XzutAtFtByBtFyEtFyDtBtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2SyCtCyEtC0D0CtBtCtGtC0Czz0CtG0C0B0CyDtGyB0Fzy0DtG0ByEtB0CyDzzyCtA0Bzz0EtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0A0DyDtC0A0FtG0AtBzy0DtGyE0EtCyDtGzztC0C0EtGyB0CtCyCyEtCtA0A0D0DyD0C2QtN0A0LzuyE%26cr%3D234855385%26a%3Dwbf_dnldastr_17_13%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://br.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dnldastr_17_13¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0DyEtA0DyB0E0F0C0FtByByB0DzytAtCtN0D0Tzu0StCzytDyCtN1L2XzutAtFtByBtFyEtFyDtBtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2SyCtCyEtC0D0CtBtCtGtC0Czz0CtG0C0B0CyDtGyB0Fzy0DtG0ByEtB0CyDzzyCtA0Bzz0EtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0A0DyDtC0A0FtG0AtBzy0DtGyE0EtCyDtGzztC0C0EtGyB0CtCyCyEtCtA0A0D0DyD0C2QtN0A0LzuyE%26cr%3D234855385%26a%3Dwbf_dnldastr_17_13%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate HKU\S-1-5-21-3989744648-3571885242-2210684081-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com.br/ HKU\S-1-5-21-3989744648-3571885242-2210684081-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pt-br/?ocid=iehp SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dnldastr_17_13¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0DyEtA0DyB0E0F0C0FtByByB0DzytAtCtN0D0Tzu0StCzytDyCtN1L2XzutAtFtByBtFyEtFyDtBtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2SyCtCyEtC0D0CtBtCtGtC0Czz0CtG0C0B0CyDtGyB0Fzy0DtG0ByEtB0CyDzzyCtA0Bzz0EtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0A0DyDtC0A0FtG0AtBzy0DtGyE0EtCyDtGzztC0C0EtGyB0CtCyCyEtCtA0A0D0DyD0C2QtN0A0LzuyE%26cr%3D234855385%26a%3Dwbf_dnldastr_17_13%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dnldastr_17_13¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0DyEtA0DyB0E0F0C0FtByByB0DzytAtCtN0D0Tzu0StCzytDyCtN1L2XzutAtFtByBtFyEtFyDtBtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2SyCtCyEtC0D0CtBtCtGtC0Czz0CtG0C0B0CyDtGyB0Fzy0DtG0ByEtB0CyDzzyCtA0Bzz0EtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0A0DyDtC0A0FtG0AtBzy0DtGyE0EtCyDtGzztC0C0EtGyB0CtCyCyEtCtA0A0D0DyD0C2QtN0A0LzuyE%26cr%3D234855385%26a%3Dwbf_dnldastr_17_13%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms} SearchScopes: HKU\S-1-5-21-3989744648-3571885242-2210684081-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3989744648-3571885242-2210684081-1000 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_dnldastr_17_13¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0DyEtA0DyB0E0F0C0FtByByB0DzytAtCtN0D0Tzu0StCzytDyCtN1L2XzutAtFtByBtFyEtFyDtBtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2SyCtCyEtC0D0CtBtCtGtC0Czz0CtG0C0B0CyDtGyB0Fzy0DtG0ByEtB0CyDzzyCtA0Bzz0EtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtC0A0DyDtC0A0FtG0AtBzy0DtGyE0EtCyDtGzztC0C0EtGyB0CtCyCyEtCtA0A0D0DyD0C2QtN0A0LzuyE%26cr%3D234855385%26a%3Dwbf_dnldastr_17_13%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms} SearchScopes: HKU\S-1-5-21-3989744648-3571885242-2210684081-1000 -> {74AB41FF-67F2-44B9-930D-65284FFD24F3} URL = hxxps://br.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation) BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21] (Adobe Systems Incorporated) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-09-26] (Oracle Corporation) BHO-x32: Auxiliar de Conexão de Conta da Microsoft -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation) BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540003} -> C:\Program Files (x86)\GbPlugin\gbiehcef.dll [2016-10-27] (Caixa Economica Federal) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-09-26] (Oracle Corporation) Toolbar: HKU\S-1-5-21-3989744648-3571885242-2210684081-1000 -> Sem Nome - {41564952-412D-5350-00A7-7A786E7484D7} - Nenhum Arquivo StartMenuInternet: IEXPLORE.EXE - iexplore.exe FireFox: ======== FF DefaultProfile: jh3781rj.default FF ProfilePath: C:\Users\Renato\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\jh3781rj.default\Profiles\jh3781rj.default [não encontrado (a)] FF ProfilePath: C:\Users\Renato\AppData\Roaming\Mozilla\Firefox\Profiles\jh3781rj.default [2017-03-21] FF HKU\S-1-5-21-3989744648-3571885242-2210684081-1000\...\Firefox\Extensions: [{87F8774F-B485-47E2-A755-A40A8A5E886D}] - C:\Users\Renato\AppData\Local\GAS Tecnologia\GBBD\cef\xpi FF Extension: (GBBD Caixa Economica Federal) - C:\Users\Renato\AppData\Local\GAS Tecnologia\GBBD\cef\xpi [2015-07-07] [não assinado] FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_127.dll [2017-03-14] () FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_127.dll [2017-03-14] () FF Plugin-x32: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-09-26] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-09-26] (Oracle Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-20] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-20] (Google Inc.) FF Plugin HKU\S-1-5-21-3989744648-3571885242-2210684081-1000: gastecnologia.com.br/sf/cef -> C:\Users\Renato\AppData\Local\GAS Tecnologia\GBBD\npsf_cef.dll [2014-12-09] (GAS Tecnologia) FF Plugin HKU\S-1-5-21-3989744648-3571885242-2210684081-1000: gastecnologia.com.br/sf/cef64 -> C:\Users\Renato\AppData\Local\GAS Tecnologia\GBBD\npsf_cef_64.dll [2014-12-09] (GAS Tecnologia) Chrome: ======= CHR DefaultProfile: ChromeDefaultData2 CHR StartupUrls: ChromeDefaultData2 -> "hxxp://www.google.com.br/" CHR DefaultSearchURL: ChromeDefaultData2 -> hxxp://srch.bar/{searchTerms} CHR DefaultSearchKeyword: ChromeDefaultData2 -> Yahoo CHR DefaultSuggestURL: ChromeDefaultData2 -> hxxp://srch.bar/?s={searchTerms} CHR Profile: C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2017-03-21] <==== ATENÇÃO CHR Extension: (Google Apresentações) - C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-06-24] CHR Extension: (Google Docs) - C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\aohghmighlieiainnegkcijnfilokake [2015-06-24] CHR Extension: (Google Drive) - C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23] CHR Extension: (YouTube) - C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-28] CHR Extension: (Google Search) - C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-03] CHR Extension: (Planilhas do Google) - C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-06-24] CHR Extension: (Documentos Google off-line) - C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-16] CHR Extension: (Pagamentos da Chrome Web Store) - C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09] CHR Extension: (Yahoo Partner) - C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\npdicihegicnhaangkdmcgbjceoemeoo [2017-03-21] CHR Extension: (Gmail) - C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-24] CHR Extension: (Chrome Media Router) - C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-08] CHR Profile: C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2 [2017-03-21] <==== ATENÇÃO CHR Extension: (Google Docs) - C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2\Extensions\aohghmighlieiainnegkcijnfilokake [2017-03-21] CHR Extension: (Google Drive) - C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-03-21] CHR Extension: (YouTube) - C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-03-21] CHR Extension: (Documentos Google off-line) - C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-03-21] CHR Extension: (Pagamentos da Chrome Web Store) - C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-21] CHR Extension: (Gmail) - C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-03-21] CHR Extension: (Chrome Media Router) - C:\Users\Renato\AppData\Local\Google\Chrome\User Data\ChromeDefaultData2\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-03-21] CHR HKLM\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx CHR HKU\S-1-5-21-3989744648-3571885242-2210684081-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [npdicihegicnhaangkdmcgbjceoemeoo] - hxxps://clients2.google.com/service/update2/crx ==================== Serviços (Whitelisted) ==================== (Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.) R2 GbpSv; C:\Program Files (x86)\GbPlugin\gbpsv.exe [631520 2016-10-27] (GAS Tecnologia) R2 GoogleChromeUpService; C:\ProgramData\service.exe [1620992 2017-03-21] () [Arquivo não assinado] <==== ATENÇÃO R2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2015-06-24] () [Arquivo não assinado] R2 KuaizipUpdateChecker; C:\Program Files\¿ìѹ\X86\kuaizipUpdateChecker.dll [219032 2017-03-21] () R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation) R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [50688 2014-11-17] (Hewlett-Packard) [Arquivo não assinado] S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation) R2 OtherSearch; C:\Program Files (x86)\jsXuLWuidd\kl.dll [1009152 2017-03-13] () [Arquivo não assinado] <==== ATENÇÃO R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [66048 2014-11-17] (Hewlett-Packard) [Arquivo não assinado] R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10351856 2016-12-15] (TeamViewer GmbH) R2 Warsaw Technology; C:\Program Files\Diebold\Warsaw\core.exe [925744 2016-06-23] (GAS Tecnologia LTDA) S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation) R2 Windows; C:\Windows\svchost.exe [177152 2017-03-21] () [Arquivo não assinado] R2 WindowsSecurity; C:\ProgramData\Windows Security\winsecurity.exe [1265152 2017-03-01] (Microsoft Corporation) [Arquivo não assinado] <==== ATENÇÃO R2 WMPNetworkAcSvc; C:\Users\Renato\AppData\Roaming\WMPNetworkAcSvc\WMPNetworkAcSvc.exe [5091840 2016-11-10] () [Arquivo não assinado] <==== ATENÇÃO S2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.2.4.1\WsAppService.exe [417792 2016-07-12] (Wondershare) [Arquivo não assinado] R2 XBox; C:\Program Files\XBox\XBLive.exe [7068160 2017-02-14] (Microsoft Corporation) [Arquivo não assinado] ===================== Drivers (Whitelisted) ====================== (Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.) R3 GBPRCM; C:\Program Files (x86)\GbPlugin\gbprcm64.sys [29912 2015-09-03] (GAS Tecnologia) R2 KuaiZipDrive; C:\Windows\system32\drivers\KuaiZipDrive.sys [92832 2017-03-21] (WinMount International Inc) R1 Lace514; C:\Windows\System32\drivers\Lace_wpf_x64.sys [69400 2017-03-01] (Lace514) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation) S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation) R3 Warsaw_PP; C:\Program Files (x86)\GbPlugin\wsftprp64.sys [24792 2014-11-03] (GAS Tecnologia LTDA) R1 wsddfac; C:\Windows\System32\drivers\wsddfac.sys [101080 2017-03-21] (GAS Tecnologia) R1 wsddntf; C:\Windows\System32\DRIVERS\wsddntf.sys [36984 2016-06-16] (GAS Tecnologia) S1 wsddpp; C:\Windows\system32\drivers\wsddpp.sys [97376 2016-06-08] (GAS Tecnologia) S1 gbpddfac; system32\drivers\gbpddfac64.sys [X] S0 gbpddreg; system32\drivers\gbpddreg64.sys [X] S4 ucdrv; \??\C:\Program Files (x86)\UCBrowser\Security:ucdrv-x64.sys [X] <==== ATENÇÃO ==================== NetSvcs (Whitelisted) =================== (Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.) ==================== Um Mês Criados arquivos e pastas ======== (Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.) 2017-03-21 20:35 - 2017-03-21 20:35 - 00016422 _____ C:\Users\Renato\AppData\Roaming\88604368358d1b8b5f36ce 2017-03-21 15:07 - 2017-03-21 15:08 - 00025845 _____ C:\Users\Renato\Downloads\FRST.txt 2017-03-21 15:07 - 2017-03-21 15:07 - 00000000 ____D C:\FRST 2017-03-21 15:06 - 2017-03-21 15:07 - 02424832 _____ (Farbar) C:\Users\Renato\Downloads\FRST64.exe 2017-03-21 15:02 - 2017-03-21 15:02 - 00000000 ____D C:\Users\Renato\AppData\Local\ElevatedDiagnostics 2017-03-21 15:01 - 2017-03-21 15:01 - 00170240 _____ C:\Users\Renato\AppData\Local\GDIPFONTCACHEV1.DAT 2017-03-21 15:01 - 2017-03-21 15:01 - 00002117 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk 2017-03-21 15:01 - 2017-03-21 15:01 - 00001945 _____ C:\Windows\epplauncher.mif 2017-03-21 15:01 - 2017-03-21 15:01 - 00000000 ____D C:\Program Files\Microsoft Security Client 2017-03-21 15:01 - 2017-03-21 15:01 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client 2017-03-21 15:00 - 2017-03-21 15:01 - 15083200 _____ (Microsoft Corporation) C:\Users\Renato\Downloads\mseinstall.exe 2017-03-21 14:46 - 2017-03-21 15:05 - 00016708 _____ C:\Windows\System32\Tasks\47o751o563t157-dll 2017-03-21 14:40 - 2017-03-21 14:40 - 00003154 _____ C:\Windows\System32\Tasks\{CA5F38A2-BA0E-42A7-852A-90DC65B25F7C} 2017-03-21 14:16 - 2017-03-21 14:16 - 00001996 _____ C:\Windows\System32\Tasks\mG41sVNMLM 2017-03-21 14:15 - 2017-03-21 14:48 - 00000000 ____D C:\Program Files (x86)\jsXuLWuidd 2017-03-21 14:08 - 2017-03-21 14:13 - 00000000 ____D C:\Users\Renato\AppData\Roaming\Chomdom 2017-03-21 14:08 - 2017-03-21 14:08 - 00006078 _____ C:\Windows\System32\Tasks\Motupyanegcult Cache 2017-03-21 14:08 - 2017-03-21 14:08 - 00000000 ____D C:\Program Files (x86)\Motupyanegcult Cache 2017-03-21 14:07 - 2017-03-21 14:33 - 00000000 ____D C:\Program Files (x86)\Qejisyfank 2017-03-21 14:07 - 2017-03-21 14:08 - 00000000 ____D C:\Users\Renato\AppData\Local\Prermerward 2017-03-21 14:07 - 2017-03-21 14:07 - 00002920 _____ C:\Windows\System32\Tasks\osTip 2017-03-21 14:07 - 2017-03-21 14:07 - 00000000 ____D C:\Users\Renato\AppData\Local\CEF 2017-03-21 14:06 - 2017-03-21 14:33 - 00000000 __SHD C:\Users\Todos os Usuários\WindowsMsg 2017-03-21 14:06 - 2017-03-21 14:33 - 00000000 __SHD C:\ProgramData\WindowsMsg 2017-03-21 14:02 - 2017-03-21 14:33 - 00000000 ____D C:\Program Files (x86)\Stukatprjertion Update 2017-03-21 14:02 - 2017-03-21 14:10 - 00000000 ____D C:\Users\Renato\AppData\Roaming\Chesoty 2017-03-21 14:02 - 2017-03-21 14:02 - 00006058 _____ C:\Windows\System32\Tasks\Stukatprjertion Update 2017-03-21 14:02 - 2017-03-21 14:02 - 00000000 ____D C:\Users\Renato\AppData\Local\UCBrowser 2017-03-21 14:01 - 2017-03-21 14:33 - 00000000 ____D C:\Users\Renato\AppData\Roaming\excdir 2017-03-21 14:01 - 2017-03-21 14:33 - 00000000 ____D C:\Program Files (x86)\Vehotherdreguty 2017-03-21 14:01 - 2017-03-21 14:03 - 00000000 ____D C:\Users\Renato\AppData\Local\Phihavhiied 2017-03-21 14:00 - 2017-03-21 14:33 - 00000000 ____D C:\Users\Renato\AppData\Roaming\KuaiZip 2017-03-21 14:00 - 2017-03-21 14:33 - 00000000 ____D C:\Program Files\¿ìѹ 2017-03-21 14:00 - 2017-03-21 14:00 - 00092832 _____ (WinMount International Inc) C:\Windows\system32\Drivers\KuaiZipDrive.sys 2017-03-21 14:00 - 2017-03-21 14:00 - 00003378 _____ C:\Windows\System32\Tasks\KuaiZip_Update 2017-03-21 14:00 - 2017-03-21 14:00 - 00000000 ____D C:\Users\Renato\AppData\Roaming\Softlink 2017-03-21 13:58 - 2017-03-21 14:33 - 00000000 __SHD C:\Users\Renato\AppData\Local\svchost 2017-03-21 13:58 - 2017-03-21 14:33 - 00000000 ____D C:\Users\Renato\AppData\Roaming\UCChannel 2017-03-21 13:57 - 2017-03-21 15:08 - 00016708 _____ C:\Windows\System32\Tasks\47o751o563t157 2017-03-21 13:57 - 2017-03-21 14:33 - 00000000 ___HD C:\Users\Todos os Usuários\47o751o563t157 2017-03-21 13:57 - 2017-03-21 14:33 - 00000000 ___HD C:\ProgramData\47o751o563t157 2017-03-21 13:57 - 2017-03-21 14:33 - 00000000 ____D C:\Users\Todos os Usuários\RegisterObject 2017-03-21 13:57 - 2017-03-21 14:33 - 00000000 ____D C:\Users\Renato\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk 2017-03-21 13:57 - 2017-03-21 14:33 - 00000000 ____D C:\ProgramData\RegisterObject 2017-03-21 13:57 - 2017-03-21 14:14 - 00000000 ____D C:\Windows\system32\SSL 2017-03-21 13:57 - 2017-03-21 13:57 - 01620992 _____ C:\Users\Todos os Usuários\service.exe 2017-03-21 13:57 - 2017-03-21 13:57 - 01620992 _____ C:\ProgramData\service.exe 2017-03-21 13:57 - 2017-03-21 13:57 - 01466213 _____ C:\Windows\csrss.exe 2017-03-21 13:57 - 2017-03-21 13:57 - 00177152 _____ C:\Windows\svchost.exe 2017-03-21 13:57 - 2017-03-21 13:57 - 00073216 _____ C:\Windows\taskmgr.exe 2017-03-21 13:57 - 2017-03-21 13:57 - 00000000 ____D C:\Windows\Azart 2017-03-21 13:56 - 2017-03-21 14:50 - 00000000 ____D C:\Users\Renato\AppData\Roaming\WMPNetworkAcSvc 2017-03-21 13:56 - 2017-03-21 14:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Jogotempo 2017-03-21 13:56 - 2017-03-21 14:33 - 00000000 ____D C:\Program Files\XBox 2017-03-21 13:56 - 2017-03-21 14:33 - 00000000 ____D C:\Program Files (x86)\Jogotempo 2017-03-21 13:56 - 2017-03-21 14:33 - 00000000 ____D C:\Program Files (x86)\BeCleaner 2017-03-21 13:55 - 2017-03-21 14:51 - 00000034 _____ C:\Users\Public\Documents\{DE764086-1C0A-4DD3-90BA-0B93BDD794BE} 2017-03-21 13:55 - 2017-03-21 14:33 - 00000000 ____D C:\Users\Todos os Usuários\Windows Security 2017-03-21 13:55 - 2017-03-21 14:33 - 00000000 ____D C:\ProgramData\Windows Security 2017-03-21 13:55 - 2017-03-21 13:55 - 00005074 _____ C:\Windows\System32\Tasks\Ckibugh 2017-03-21 13:54 - 2017-03-21 13:54 - 01262952 _____ C:\Users\Renato\Downloads\Vegas_Pro_14_2016_Crack_e_Serial.zip 2017-03-21 13:46 - 2017-03-21 13:46 - 09274608 _____ (Piriform Ltd) C:\Users\Renato\Downloads\ccsetup528.exe 2017-03-21 13:45 - 2017-03-20 20:18 - 00003879 _____ C:\Users\Renato\Downloads\SetupCcleaner.js 2017-03-21 13:41 - 2017-03-21 13:41 - 00000000 _____ C:\Users\Renato\AppData\Roaming\ax 2017-03-21 13:40 - 2017-03-21 13:40 - 00002999 _____ C:\Users\Renato\Downloads\SetupCcleaner.zip 2017-03-21 13:40 - 2017-03-21 13:40 - 00000000 _____ C:\Users\Todos os Usuários\Block 2017-03-21 13:40 - 2017-03-21 13:40 - 00000000 _____ C:\ProgramData\Block 2017-03-21 13:33 - 2017-03-21 13:33 - 00001374 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk 2017-03-21 13:33 - 2017-03-21 13:33 - 00001305 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk 2017-03-21 13:28 - 2017-03-21 13:28 - 01232106 _____ (Rasecadi ) C:\Users\Renato\Downloads\windows_movie_maker_1185436195 (2).exe 2017-03-21 13:25 - 2017-03-21 14:25 - 00000264 _____ C:\Windows\Tasks\{27CF2902-E889-0B48-0CFD-7205D36734C5}.job 2017-03-21 13:25 - 2017-03-21 13:25 - 00003208 _____ C:\Windows\System32\Tasks\{27CF2902-E889-0B48-0CFD-7205D36734C5} 2017-03-21 13:24 - 2017-03-21 13:24 - 01820656 _____ (Program ) C:\Users\Renato\Downloads\Baixaki_windows-movie-maker (3).exe 2017-03-21 13:23 - 2017-03-21 13:39 - 00000000 ____D C:\Users\Renato\AppData\Local\{879BB1C7-A333-DD7F-CEAB-F897EAC3040F} 2017-03-21 13:23 - 2017-03-21 13:23 - 00000372 __RSH C:\Users\Todos os Usuários\ntuser.pol 2017-03-21 13:23 - 2017-03-21 13:23 - 00000372 __RSH C:\ProgramData\ntuser.pol 2017-03-21 13:21 - 2017-03-21 13:21 - 01232106 _____ (Rasecadi ) C:\Users\Renato\Downloads\windows_movie_maker_1185436195 (1).exe 2017-03-21 13:17 - 2017-03-21 13:17 - 01232106 _____ (Rasecadi ) C:\Users\Renato\Downloads\windows_movie_maker_1185436195.exe 2017-03-21 13:13 - 2017-03-21 14:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2017-03-21 12:58 - 2017-03-21 12:58 - 01820656 _____ (Program ) C:\Users\Renato\Downloads\Baixaki_windows-movie-maker (2).exe 2017-03-21 12:57 - 2017-03-21 12:57 - 01820656 _____ (Program ) C:\Users\Renato\Downloads\Baixaki_windows-movie-maker (1).exe 2017-03-21 12:56 - 2017-03-21 14:33 - 00000000 ____D C:\Users\Renato\AppData\Local\LikeToles01a 2017-03-21 12:56 - 2017-03-21 12:56 - 00000000 _____ C:\Users\Renato\AppData\Local\Z10AABC21.abp 2017-03-21 12:55 - 2017-03-21 12:55 - 00339548 _____ C:\Users\Renato\Downloads\Adobe.zip 2017-03-21 12:52 - 2017-03-21 12:52 - 12633944 _____ (Microsoft Corporation) C:\Users\Renato\Downloads\mm20esn.exe 2017-03-21 12:45 - 2017-03-21 12:48 - 00000001 _____ C:\Users\Renato\AppData\Roaming\d3a42cab 2017-03-21 12:44 - 2017-03-21 14:33 - 00000000 ____D C:\Users\Renato\AppData\Roaming\c4dRcR 2017-03-21 12:44 - 2017-03-21 14:33 - 00000000 ____D C:\Users\Renato\AppData\Roaming\aXqlp1 2017-03-21 12:44 - 2017-03-21 12:44 - 01242312 _____ (Microsoft Corporation) C:\Users\Renato\Downloads\Baixaki_windows-movie-maker [1].exe 2017-03-21 12:44 - 2017-03-21 12:44 - 00000262 _____ C:\Users\Renato\AppData\Roaming\54dc8dd1 2017-03-21 12:43 - 2017-03-21 13:00 - 01242312 _____ (Microsoft Corporation) C:\Users\Renato\Downloads\Baixaki_windows-movie-maker.exe 2017-03-21 12:42 - 2017-03-21 12:42 - 00039949 _____ C:\Users\Renato\Downloads\Flash_Player_App.V.1.2.51.7.3.2.098.zip 2017-03-21 12:42 - 2017-03-21 12:42 - 00039949 _____ C:\Users\Renato\Downloads\Flash_Player_App.V.1.2.51.7.3.2.098 (1).zip 2017-03-21 12:39 - 2017-03-21 12:39 - 03774684 _____ C:\Users\Renato\Downloads\❤Mensagem apaixonada❤.mp4 2017-03-21 12:30 - 2017-03-21 12:31 - 46252218 _____ C:\Users\Renato\Downloads\Marília Mendonça - De Quem É A Culpa - DVD Realidade.mp4 2017-03-21 12:29 - 2017-03-21 12:30 - 42771788 _____ C:\Users\Renato\Downloads\Matheus & Kauan - Te Assumi Pro Brasil – Na Praia 2 - Ao Vivo.mp4 2017-03-21 08:34 - 2017-03-21 08:34 - 00117258 _____ C:\Users\Renato\Downloads\Oficio circular 010.2016 destinado as Prefeituras.pdf 2017-03-20 15:54 - 2017-03-20 15:54 - 00088590 _____ C:\Users\Renato\Downloads\Logos - Jesúpolis - Fundo.cdr 2017-03-20 14:33 - 2017-03-20 14:33 - 00094720 _____ C:\Users\Renato\Downloads\Proposta_Pregao_N_0052017.xls 2017-03-20 14:33 - 2017-03-20 14:33 - 00044032 _____ C:\Users\Renato\Downloads\Credenciamento_Pregao_N_0052017.xls 2017-03-20 10:09 - 2017-03-20 10:09 - 04202108 _____ C:\Users\Renato\Downloads\ATA DE JULGAMENTO DE RECURSO ADMINISTRATIVO.pdf 2017-03-20 10:09 - 2017-03-20 10:09 - 00631038 _____ C:\Users\Renato\Downloads\EDITAL PREGAO N005 2017 MEDICAMENTOS.pdf 2017-03-20 10:09 - 2017-03-20 10:09 - 00556247 _____ C:\Users\Renato\Downloads\EDITAL CONVITE N002 2017 MATERIAL ELETRICO.pdf 2017-03-18 12:47 - 2017-03-18 12:47 - 00000000 _____ C:\Users\Renato\AppData\Local\{6A1E4698-5084-468C-82A4-3B0F8247ACD9} 2017-03-17 16:43 - 2017-03-17 16:43 - 03229883 _____ C:\Windows\b1bebf2044efde9047ffff42064b4a7d.exe 2017-03-15 17:14 - 2017-03-15 17:14 - 00097576 _____ C:\Users\Renato\Downloads\Lista 4 Construção FGTS Agehab 2017.pdf 2017-03-15 16:57 - 2017-03-15 16:58 - 00000000 ____D C:\Users\Renato\Desktop\LILIAN 2017-03-10 13:39 - 2017-03-10 13:39 - 02726729 _____ C:\Users\Renato\Downloads\ATA CPL CADASTRAMENTO PROFISSIONAIS SAUDE.pdf 2017-03-09 16:42 - 2017-03-09 16:42 - 00030949 _____ C:\Users\Renato\Desktop\I N.pdf 2017-03-09 16:02 - 2017-03-09 16:02 - 00086729 _____ C:\Users\Renato\Downloads\Logos - Jesúpolis - secretaria da saúde.cdr 2017-03-09 15:28 - 2017-03-09 15:28 - 00015099 _____ C:\Users\Renato\Downloads\Minuta Fatura - Jesúpolis 2017 (2).odt 2017-03-09 15:27 - 2017-03-09 15:27 - 00015099 _____ C:\Users\Renato\Downloads\Minuta Fatura - Jesúpolis 2017.odt 2017-03-09 15:27 - 2017-03-09 15:27 - 00015099 _____ C:\Users\Renato\Downloads\Minuta Fatura - Jesúpolis 2017 (1).odt 2017-03-07 15:56 - 2017-03-07 15:56 - 00655888 _____ C:\Users\Renato\Downloads\Ofício Provinha Brasil.pdf 2017-03-06 15:58 - 2017-03-06 15:59 - 49459683 _____ C:\Users\Renato\Downloads\Henrique e Juliano - VIDINHA DE BALADA - DVD O Céu Explica Tudo.mp4 2017-03-06 15:31 - 2017-03-06 15:31 - 00111177 _____ C:\Users\Renato\Downloads\Danfe.pdf 2017-03-06 14:58 - 2017-03-06 14:58 - 00321802 _____ C:\Users\Renato\Downloads\Edital Credenciamento 2017 (1).pdf 2017-03-06 10:14 - 2017-03-06 10:14 - 01070917 _____ C:\Users\Renato\Downloads\RECURSO CONTRA DECISAO DE INABILITACAO.pdf 2017-03-06 10:14 - 2017-03-06 10:14 - 00436588 _____ C:\Users\Renato\Downloads\DESPACHO CPL.pdf 2017-03-06 08:22 - 2017-03-06 08:22 - 00276651 _____ C:\Users\Renato\Downloads\JESUPOLIS (1).pdf 2017-03-03 16:22 - 2017-03-03 16:22 - 00505062 _____ C:\Users\Renato\Downloads\Documento(24).pdf 2017-03-03 16:22 - 2017-03-03 16:22 - 00286213 _____ C:\Users\Renato\Downloads\FUNDO MUNICIPAL DE ASSISTENCIA JESUPOLIS 8786.pdf 2017-03-03 16:22 - 2017-03-03 16:22 - 00282969 _____ C:\Users\Renato\Downloads\PREFEITURA MUNICIPAL DE JESUPOLIS.pdf 2017-03-03 16:22 - 2017-03-03 16:22 - 00282856 _____ C:\Users\Renato\Downloads\FUNDO MUNICIPAL DE JESUPOLIS 8785.pdf 2017-03-03 16:22 - 2017-03-03 16:22 - 00012991 _____ C:\Users\Renato\Downloads\FUNDO MUNICIPAL DE SAUDE DE JESUPOLIS-10.411.406.0001-10.pdf 2017-03-03 16:22 - 2017-03-03 16:22 - 00012990 _____ C:\Users\Renato\Downloads\FUNDO MUN. DE ASSIST. SOCIAL D JESUPOLIS-13.608.402.0001-15.pdf 2017-03-03 16:22 - 2017-03-03 16:22 - 00012978 _____ C:\Users\Renato\Downloads\PREFEITURA MUNICIPAL DE JESUPOLIS-37.623.501.0001-34.pdf 2017-03-03 11:09 - 2017-01-04 15:02 - 01678023 _____ C:\Users\Renato\Desktop\QUINTO TERMO ADITIVO EMERSON.pdf 2017-03-03 11:09 - 2016-09-15 15:29 - 01380344 _____ C:\Users\Renato\Desktop\QUARTO TERMO ADITIVO PRAÇA LUIZ DE MATTOS.pdf 2017-03-03 11:09 - 2016-06-10 17:05 - 04109078 _____ C:\Users\Renato\Desktop\TERCEIRO TERMO ADITIVO PRAÇA LUIZ DE MATTOS.pdf 2017-03-03 11:09 - 2016-02-19 11:34 - 03979138 _____ C:\Users\Renato\Desktop\SEGUNDO TERMO ADITIVO EMERSON.pdf 2017-03-03 11:08 - 2015-10-29 14:52 - 00226462 _____ C:\Users\Renato\Desktop\1º TERMO ADITIVO AO CONTRATO Nº23 2015.pdf 2017-03-03 11:07 - 2015-05-18 12:15 - 09462331 _____ C:\Users\Renato\Desktop\CONTRATO Nº23 2015 EMERSON CARDOSO.pdf 2017-03-02 10:35 - 2017-03-02 10:35 - 00000001 _____ C:\Users\Renato\Downloads\Lei Orçamentária Anual - LOA.pdf 2017-03-02 10:35 - 2017-03-02 10:35 - 00000001 _____ C:\Users\Renato\Downloads\Altera├º├Áes da Lei do PPA.pdf 2017-03-01 14:32 - 2017-03-01 14:32 - 00069400 _____ (Lace514) C:\Windows\system32\Drivers\Lace_wpf_x64.sys 2017-02-23 17:07 - 2017-02-23 17:08 - 00000000 ____D C:\Users\TEMP 2017-02-23 10:50 - 2017-02-23 10:50 - 00321802 _____ C:\Users\Renato\Downloads\Edital Credenciamento 2017.pdf 2017-02-22 15:34 - 2017-02-22 15:46 - 00419350 _____ C:\Users\Renato\Desktop\Sem título-1.cdr 2017-02-22 15:34 - 2017-02-22 15:34 - 00410277 _____ C:\Users\Renato\Desktop\Cópia_de_segurança_de_Sem título-1.cdr 2017-02-22 13:29 - 2017-02-22 13:29 - 00067951 _____ C:\Users\Renato\Downloads\DAS-PGMEI-14932096000130 (4).pdf 2017-02-22 13:25 - 2017-02-22 13:25 - 00151001 _____ C:\Users\Renato\Downloads\DAS-PGMEI-14932096000130 (3).pdf 2017-02-22 13:24 - 2017-02-22 13:24 - 00067963 _____ C:\Users\Renato\Downloads\DAS-PGMEI-14932096000130 (2).pdf 2017-02-22 13:23 - 2017-02-22 13:23 - 00076284 _____ C:\Users\Renato\Downloads\DAS-PGMEI-14932096000130.pdf 2017-02-22 13:23 - 2017-02-22 13:23 - 00076284 _____ C:\Users\Renato\Downloads\DAS-PGMEI-14932096000130 (1).pdf 2017-02-21 16:32 - 2017-02-21 16:32 - 00034480 _____ C:\Users\Renato\Desktop\Guia_DUAM_2017-02-21_1632.pdf 2017-02-21 16:30 - 2017-02-21 16:30 - 00292258 _____ C:\Users\Renato\Downloads\NF 188 9MED 01 2017.pdf 2017-02-21 08:32 - 2017-02-21 08:32 - 00153365 _____ C:\Users\Renato\Downloads\TERMO DE DESISTÊNCIA.pdf 2017-02-20 17:12 - 2017-02-20 17:12 - 00406676 _____ C:\Users\Renato\Downloads\PAVIMENTAÇÃO JESÚPOLIS - TSD - AGETOP - 13.02.17.pdf 2017-02-20 13:56 - 2017-02-20 13:56 - 00159092 _____ C:\Users\Renato\Downloads\DAS-PGMEI-18842862000127.pdf 2017-02-20 09:18 - 2017-03-20 15:55 - 00002505 _____ C:\Users\Renato\Desktop\SBArrecadacao - Atalho.lnk 2017-02-20 09:18 - 2017-02-20 09:18 - 00360048 _____ C:\Users\Renato\Downloads\JESUPOLIS 02 2017.pdf ==================== Um Mês Modificados arquivos e pastas ======== (Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.) 2017-03-21 15:07 - 2009-07-14 01:45 - 00013424 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2017-03-21 15:07 - 2009-07-14 01:45 - 00013424 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2017-03-21 15:02 - 2009-07-14 00:20 - 00000000 ____D C:\Windows\system32\NDF 2017-03-21 15:01 - 2009-07-14 00:20 - 00000000 ____D C:\Windows\inf 2017-03-21 14:50 - 2009-07-29 13:08 - 00703370 _____ C:\Windows\system32\prfh0416.dat 2017-03-21 14:50 - 2009-07-29 13:08 - 00146156 _____ C:\Windows\system32\prfc0416.dat 2017-03-21 14:50 - 2009-07-14 02:13 - 01628224 _____ C:\Windows\system32\PerfStringBackup.INI 2017-03-21 14:48 - 2015-08-28 16:21 - 00000000 ____D C:\Users\Todos os Usuários\GbPlugin 2017-03-21 14:48 - 2015-08-28 16:21 - 00000000 ____D C:\ProgramData\GbPlugin 2017-03-21 14:48 - 2009-07-14 02:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD 2017-03-21 14:47 - 2009-07-14 01:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2017-03-21 14:46 - 2015-08-28 16:21 - 00000000 ____D C:\Program Files (x86)\GbPlugin 2017-03-21 14:45 - 2016-10-25 15:51 - 00101080 _____ (GAS Tecnologia) C:\Windows\system32\Drivers\wsddfac.sys 2017-03-21 14:45 - 2009-07-14 02:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2017-03-21 14:44 - 2015-06-24 15:28 - 00000000 ____D C:\Users\Renato\Documents\Visual Studio 2008 2017-03-21 14:44 - 2015-06-24 14:45 - 00000000 ____D C:\Users\Todos os Usuários\Microsoft Help 2017-03-21 14:33 - 2016-09-26 10:11 - 00000000 ____D C:\Users\Todos os Usuários\Protexis 2017-03-21 14:33 - 2016-09-26 10:11 - 00000000 ____D C:\ProgramData\Protexis 2017-03-21 14:33 - 2016-08-31 16:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2017-03-21 14:33 - 2016-08-31 16:23 - 00000000 ____D C:\Program Files\CCleaner 2017-03-21 14:33 - 2015-06-24 14:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2017-03-21 14:33 - 2015-06-24 13:44 - 00000000 ____D C:\Users\Renato 2017-03-21 14:33 - 2009-07-14 04:45 - 00000000 ___RD C:\Users\Public\Recorded TV 2017-03-21 14:33 - 2009-07-14 00:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy 2017-03-21 14:33 - 2009-07-14 00:20 - 00000000 ____D C:\Windows\SysWOW64\GroupPolicy 2017-03-21 14:33 - 2009-07-14 00:20 - 00000000 ____D C:\Windows\registration 2017-03-21 14:07 - 2015-06-24 14:17 - 00002389 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2017-03-21 14:01 - 2016-12-12 11:57 - 00000000 ____D C:\Users\Renato\AppData\LocalLow\Mozilla 2017-03-21 14:01 - 2015-06-24 14:33 - 00001323 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2017-03-21 13:32 - 2015-06-24 14:46 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition 2017-03-21 13:30 - 2015-08-22 17:34 - 01595976 _____ C:\Windows\SysWOW64\PerfStringBackup.INI 2017-03-21 09:37 - 2015-07-08 09:13 - 00000000 ____D C:\SIGEPTEMP 2017-03-20 15:55 - 2016-12-20 16:58 - 00002015 _____ C:\Users\Renato\Desktop\PProtocolo - Atalho.lnk 2017-03-20 15:34 - 2015-09-25 08:33 - 00000000 ____D C:\Users\Renato\Desktop\DOCUMENTOS DIVERSOS 2017-03-14 11:09 - 2015-06-24 14:21 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2017-03-14 11:09 - 2015-06-24 14:21 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2017-03-14 11:09 - 2015-06-24 14:21 - 00004384 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2017-03-14 11:09 - 2015-06-24 14:21 - 00000000 ____D C:\Windows\SysWOW64\Macromed 2017-03-14 11:09 - 2015-06-24 14:21 - 00000000 ____D C:\Windows\system32\Macromed ==================== Arquivos na raiz de alguns diretórios ======= 2017-03-21 12:44 - 2017-03-21 12:44 - 0000262 _____ () C:\Users\Renato\AppData\Roaming\54dc8dd1 2017-03-21 20:35 - 2017-03-21 20:35 - 0016422 _____ () C:\Users\Renato\AppData\Roaming\88604368358d1b8b5f36ce 2017-03-21 13:41 - 2017-03-21 13:41 - 0000000 _____ () C:\Users\Renato\AppData\Roaming\ax 2017-03-21 12:45 - 2017-03-21 12:48 - 0000001 _____ () C:\Users\Renato\AppData\Roaming\d3a42cab 2015-07-07 11:37 - 2015-07-07 11:37 - 0018003 _____ () C:\Users\Renato\AppData\Roaming\unins000.dat 2017-03-21 12:56 - 2017-03-21 12:56 - 0000000 _____ () C:\Users\Renato\AppData\Local\Z10AABC21.abp 2017-03-18 12:47 - 2017-03-18 12:47 - 0000000 _____ () C:\Users\Renato\AppData\Local\{6A1E4698-5084-468C-82A4-3B0F8247ACD9} 2017-03-21 13:40 - 2017-03-21 13:40 - 0000000 _____ () C:\ProgramData\Block 2016-02-11 12:46 - 2016-02-11 12:47 - 0000358 _____ () C:\ProgramData\hpzinstall.log 2017-03-21 13:57 - 2017-03-21 13:57 - 1620992 _____ () C:\ProgramData\service.exe C:\Windows\svchost.exe ATENÇÃO ====> Check for partition/boot infection. Arquivos para serem movidos ou deletados: ==================== C:\Users\Renato\AppData\Local\Temp\00009360\msiql.exe C:\ProgramData\service.exe C:\Users\Todos os Usuários\service.exe C:\Windows\Tasks\{27CF2902-E889-0B48-0CFD-7205D36734C5}.job Alguns arquivos em TEMP: ==================== 2017-03-21 14:07 - 2017-03-21 14:07 - 0148992 _____ (5CQY7M9) C:\Users\Renato\AppData\Local\Temp\A4ZOCDQEAUVQ.exe 2017-03-21 13:56 - 2017-03-21 13:56 - 0856045 _____ ( ) C:\Users\Renato\AppData\Local\Temp\AutoTime51495.exe 2017-03-21 13:23 - 2017-03-21 13:23 - 1232106 _____ (Rasecadi ) C:\Users\Renato\AppData\Local\Temp\ICReinstall_windows_movie_maker_1185436195 (1).exe 2017-03-21 13:37 - 2017-03-21 13:37 - 1232106 _____ (Rasecadi ) C:\Users\Renato\AppData\Local\Temp\ICReinstall_windows_movie_maker_1185436195 (2).exe 2017-03-21 13:19 - 2017-03-21 13:19 - 1232106 _____ (Rasecadi ) C:\Users\Renato\AppData\Local\Temp\ICReinstall_windows_movie_maker_1185436195.exe 2017-03-21 13:55 - 2017-03-21 13:55 - 12698402 _____ ( ) C:\Users\Renato\AppData\Local\Temp\jg3.6.0.exe 2017-03-21 13:56 - 2017-03-21 13:56 - 0097280 _____ () C:\Users\Renato\AppData\Local\Temp\setup.exe 2017-03-21 13:57 - 2017-03-21 13:56 - 1199825 _____ () C:\Users\Renato\AppData\Local\Temp\unins000.exe 2017-03-21 13:56 - 2017-03-21 13:56 - 1247942 _____ (VideoBox ) C:\Users\Renato\AppData\Local\Temp\vbsetup.exe 2017-03-21 13:56 - 2017-03-21 13:57 - 10538775 _____ () C:\Users\Renato\AppData\Local\Temp\wajam_install.exe 2017-03-21 13:56 - 2017-03-21 13:56 - 0425674 _____ (WeMonetize ) C:\Users\Renato\AppData\Local\Temp\ZMDY5DA.exe ==================== Bamital & volsnap ====================== (Não há correção automática para arquivos que não passaram na verificação.) C:\Windows\system32\winlogon.exe => O arquivo é assinado digitalmente C:\Windows\system32\wininit.exe => O arquivo é assinado digitalmente C:\Windows\SysWOW64\wininit.exe => O arquivo é assinado digitalmente C:\Windows\explorer.exe => O arquivo é assinado digitalmente C:\Windows\SysWOW64\explorer.exe => O arquivo é assinado digitalmente C:\Windows\system32\svchost.exe => O arquivo é assinado digitalmente C:\Windows\SysWOW64\svchost.exe => O arquivo é assinado digitalmente C:\Windows\system32\services.exe => O arquivo é assinado digitalmente C:\Windows\system32\User32.dll => O arquivo é assinado digitalmente C:\Windows\SysWOW64\User32.dll => O arquivo é assinado digitalmente C:\Windows\system32\userinit.exe => O arquivo é assinado digitalmente C:\Windows\SysWOW64\userinit.exe => O arquivo é assinado digitalmente C:\Windows\system32\rpcss.dll => O arquivo é assinado digitalmente C:\Windows\system32\dnsapi.dll => O arquivo é assinado digitalmente C:\Windows\SysWOW64\dnsapi.dll => O arquivo é assinado digitalmente C:\Windows\system32\Drivers\volsnap.sys => O arquivo é assinado digitalmente LastRegBack: 2017-03-14 08:21 ==================== Fim de FRST.txt ============================