Resultado do exame da Farbar Recovery Scan Tool (FRST) (x64) Versão: 15-03-2017 Executado por User (administrador) em USER-PC (12-04-2017 15:01:44) Executando a partir de C:\Users\User\Downloads Perfis Carregados: User (Perfis Disponíveis: User) Platform: Windows 7 Home Basic Service Pack 1 (X64) Idioma: Português (Brasil) Internet Explorer Versão 8 (Navegador padrão: Chrome) Modo da Inicialização: Normal Tutorial da Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processos (Whitelisted) ================= (Se uma entrada for incluída na fixlist, o processo será fechado. O arquivo não será movido.) (GAS Tecnologia) C:\Program Files (x86)\GbPlugin\GbpSv.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Cyberlink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe (BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Agent.exe () C:\Program Files (x86)\Aiseesoft Studio\Aiseesoft FoneLab\AppService.exe (BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe (Byte Technologies LLC) C:\Program Files\ByteFence\ByteFenceService.exe () C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe () C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe () C:\Program Files\ByteFence\rtop\bin\rtop_bg.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (Tenorshare Co,Ltd) C:\Users\User\AppData\Roaming\Tenorshare\Service\configs\TenorshareWinAdService.exe (GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe () C:\Program Files (x86)\WeatherTool\2.0.1.5000183\WeatherService.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (ShenZhen Enode Techology co,.Ltd) C:\Program Files (x86)\WeatherTool\2.0.1.5000183\weather_lite.exe (Wondershare) C:\Program Files (x86)\Wondershare\WAF\2.4.2.223\WsAppService.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (GAS Tecnologia) C:\Program Files (x86)\GbPlugin\GbpSv.exe (Wondershare) C:\Program Files (x86)\Wondershare\Dr.Fone para iOS\iphoneRecovery_DrFoneForiOS.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Wondershare) C:\Program Files (x86)\Wondershare\WAF\2.4.2.223\WsAppClient.exe () C:\Program Files (x86)\Wondershare\Dr.Fone para iOS\CrashService.exe (Microsoft Corporation) C:\Windows\System32\msiexec.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registro (Whitelisted) ==================== (Se uma entrada for incluída na fixlist, o ítem no Registro será restaurado para o padrão ou removido. O arquivo não será movido.) HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [112512 2010-03-13] (Microsoft Corporation) HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [213824 2017-04-12] (AVAST Software) HKLM\...\Run: [Diebold - Warsaw] => C:\Program Files\Diebold\Warsaw\core.exe [925744 2016-06-23] (GAS Tecnologia LTDA) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-03-22] (Apple Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation) HKLM-x32\...\Run: [RemoteControl] => C:\Program Files (x86)\CyberLink\PowerDVD\PDVDServ.exe [71216 2007-03-14] (Cyberlink Corp.) HKLM-x32\...\Run: [LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD\Language\Language.exe [52256 2007-01-08] () HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [888344 2016-01-07] (BlueStack Systems, Inc.) HKLM-x32\...\Run: [SilentCleanService] => C:\Program Files (x86)\iMobie\PhoneRescue\${CHECK_RUNSERVICE_NAME} HKLM-x32\...\Run: [Aiseesoft FoneLabAppService] => C:\Program Files (x86)\Aiseesoft Studio\Aiseesoft FoneLab\AppService.exe [88024 2016-12-01] () Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\ GbPluginCef: C:\Program Files (x86)\GbPlugin\gbiehCef.dll [2016-08-10] (Caixa Economica Federal) HKU\S-1-5-21-3055871558-2611501432-2681443660-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [57981568 2015-09-27] (Skype Technologies S.A.) HKU\S-1-5-21-3055871558-2611501432-2681443660-1000\...\Run: [OfficeSyncProcess] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [908160 2010-03-16] (Microsoft Corporation) HKU\S-1-5-21-3055871558-2611501432-2681443660-1000\...\Run: [Chromium] => c:\users\user\appdata\local\chromium\application\chrome.exe --auto-launch-at-startup --profile-directory=Default --restore-last-session HKU\S-1-5-21-3055871558-2611501432-2681443660-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Ribbons.scr [241664 2010-11-20] (Microsoft Corporation) ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399003} - C:\Program Files (x86)\GbPlugin\gbiehcef.dll [1903328 2016-08-10] (Caixa Economica Federal) ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-04-12] (AVAST Software) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-04-12] (AVAST Software) GroupPolicy: Restrição <======= ATENÇÃO ==================== Internet (Whitelisted) ==================== (Se um ítem for incluído na fixlist, sendo um ítem do Registro, será removido ou restaurado para o padrão.) Hosts: Há mais de uma entrada no Hosts. Veja a seção Hosts do Addition.txt Tcpip\Parameters: [DhcpNameServer] 107.172.88.85 69.162.64.232 Tcpip\..\Interfaces\{827F76D0-2A80-46A2-A92F-24D8BA16BF07}: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{A8853EA6-148F-435A-BC2D-694FF85B8418}: [NameServer] 8.8.8.8,8.8.4.4 Tcpip\..\Interfaces\{A8853EA6-148F-435A-BC2D-694FF85B8418}: [DhcpNameServer] 107.172.88.85 69.162.64.232 Tcpip\..\Interfaces\{B22D0C39-FA2E-49B7-88B9-85DE6BBD15E6}: [DhcpNameServer] 192.168.2.1 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://br.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_sumsca_17_15¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtD0B0FzyyBtDyCyDyEzy0FyEyEtD0CtN0D0Tzu0StCzytBzztN1L2XzutAtFtBzytFtAtFyDtBtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2StCyEtDzz0D0B0CyEtGtByEyDtBtG0D0AzzzztGyCyD0BtBtGyE0D0C0EyDtAtCtByEtCtD0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDzztB0E0CyCyB0DtG0EtByD0AtGyEyC0BtBtGzz0CtD0EtG0CyD0F0DtCtD0EyBtD0CtDtB2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtByCzztA%26cr%3D385381798%26a%3Dwbf_sumsca_17_15%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BBasic HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://br.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_sumsca_17_15¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtD0B0FzyyBtDyCyDyEzy0FyEyEtD0CtN0D0Tzu0StCzytBzztN1L2XzutAtFtBzytFtAtFyDtBtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2StCyEtDzz0D0B0CyEtGtByEyDtBtG0D0AzzzztGyCyD0BtBtGyE0D0C0EyDtAtCtByEtCtD0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDzztB0E0CyCyB0DtG0EtByD0AtGyEyC0BtBtGzz0CtD0EtG0CyD0F0DtCtD0EyBtD0CtDtB2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtByCzztA%26cr%3D385381798%26a%3Dwbf_sumsca_17_15%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BBasic HKU\S-1-5-21-3055871558-2611501432-2681443660-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pt-br/?ocid=iehp SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_sumsca_17_15¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtD0B0FzyyBtDyCyDyEzy0FyEyEtD0CtN0D0Tzu0StCzytBzztN1L2XzutAtFtBzytFtAtFyDtBtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2StCyEtDzz0D0B0CyEtGtByEyDtBtG0D0AzzzztGyCyD0BtBtGyE0D0C0EyDtAtCtByEtCtD0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDzztB0E0CyCyB0DtG0EtByD0AtGyEyC0BtBtGzz0CtD0EtG0CyD0F0DtCtD0EyBtD0CtDtB2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtByCzztA%26cr%3D385381798%26a%3Dwbf_sumsca_17_15%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BBasic&p={searchTerms} SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_sumsca_17_15¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtD0B0FzyyBtDyCyDyEzy0FyEyEtD0CtN0D0Tzu0StCzytBzztN1L2XzutAtFtBzytFtAtFyDtBtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2StCyEtDzz0D0B0CyEtGtByEyDtBtG0D0AzzzztGyCyD0BtBtGyE0D0C0EyDtAtCtByEtCtD0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDzztB0E0CyCyB0DtG0EtByD0AtGyEyC0BtBtGzz0CtD0EtG0CyD0F0DtCtD0EyBtD0CtDtB2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtByCzztA%26cr%3D385381798%26a%3Dwbf_sumsca_17_15%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BBasic&p={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_sumsca_17_15¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtD0B0FzyyBtDyCyDyEzy0FyEyEtD0CtN0D0Tzu0StCzytBzztN1L2XzutAtFtBzytFtAtFyDtBtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2StCyEtDzz0D0B0CyEtGtByEyDtBtG0D0AzzzztGyCyD0BtBtGyE0D0C0EyDtAtCtByEtCtD0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDzztB0E0CyCyB0DtG0EtByD0AtGyEyC0BtBtGzz0CtD0EtG0CyD0F0DtCtD0EyBtD0CtDtB2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtByCzztA%26cr%3D385381798%26a%3Dwbf_sumsca_17_15%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BBasic&p={searchTerms} SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_sumsca_17_15¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtD0B0FzyyBtDyCyDyEzy0FyEyEtD0CtN0D0Tzu0StCzytBzztN1L2XzutAtFtBzytFtAtFyDtBtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2StCyEtDzz0D0B0CyEtGtByEyDtBtG0D0AzzzztGyCyD0BtBtGyE0D0C0EyDtAtCtByEtCtD0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDzztB0E0CyCyB0DtG0EtByD0AtGyEyC0BtBtGzz0CtD0EtG0CyD0F0DtCtD0EyBtD0CtDtB2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtByCzztA%26cr%3D385381798%26a%3Dwbf_sumsca_17_15%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BBasic&p={searchTerms} SearchScopes: HKU\S-1-5-21-3055871558-2611501432-2681443660-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_sumsca_17_15¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtD0B0FzyyBtDyCyDyEzy0FyEyEtD0CtN0D0Tzu0StCzytBzztN1L2XzutAtFtBzytFtAtFyDtBtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2StCyEtDzz0D0B0CyEtGtByEyDtBtG0D0AzzzztGyCyD0BtBtGyE0D0C0EyDtAtCtByEtCtD0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDzztB0E0CyCyB0DtG0EtByD0AtGyEyC0BtBtGzz0CtD0EtG0CyD0F0DtCtD0EyBtD0CtDtB2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtByCzztA%26cr%3D385381798%26a%3Dwbf_sumsca_17_15%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BBasic&p={searchTerms} SearchScopes: HKU\S-1-5-21-3055871558-2611501432-2681443660-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_sumsca_17_15¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtD0B0FzyyBtDyCyDyEzy0FyEyEtD0CtN0D0Tzu0StCzytBzztN1L2XzutAtFtBzytFtAtFyDtBtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2StCyEtDzz0D0B0CyEtGtByEyDtBtG0D0AzzzztGyCyD0BtBtGyE0D0C0EyDtAtCtByEtCtD0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDzztB0E0CyCyB0DtG0EtByD0AtGyEyC0BtBtGzz0CtD0EtG0CyD0F0DtCtD0EyBtD0CtDtB2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtByCzztA%26cr%3D385381798%26a%3Dwbf_sumsca_17_15%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BBasic&p={searchTerms} BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_121\bin\ssv.dll [2017-01-05] (Oracle Corporation) BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2017-04-12] (AVAST Software) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-01-05] (Oracle Corporation) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll [2017-01-05] (Oracle Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2017-04-12] (AVAST Software) BHO-x32: Auxiliar de Conexão do Windows Live ID -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation) BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540003} -> C:\Program Files (x86)\GbPlugin\gbiehcef.dll [2016-08-10] (Caixa Economica Federal) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-01-05] (Oracle Corporation) Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-20] (Microsoft Corporation) Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-20] (Microsoft Corporation) Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-20] (Microsoft Corporation) Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-20] (Microsoft Corporation) StartMenuInternet: IEXPLORE.EXE - iexplore.exe FireFox: ======== FF DefaultProfile: 3nm7eri0.default FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\3nm7eri0.default [2017-04-12] FF SelectedSearchEngine: Mozilla\Firefox\Profiles\3nm7eri0.default -> Yahoo! Powered FF DefaultSearchEngine: Mozilla\Firefox\Profiles\3nm7eri0.default -> Yahoo! Powered FF Homepage: Mozilla\Firefox\Profiles\3nm7eri0.default -> hxxps://br.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_sumsca_17_15¶m1=1¶m2=f%3D1%26b%3DFirefox%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0FtD0B0FzyyBtDyCyDyEzy0FyEyEtD0CtN0D0Tzu0StCzytBzztN1L2XzutAtFtBzytFtAtFyDtBtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2StCyEtDzz0D0B0CyEtGtByEyDtBtG0D0AzzzztGyCyD0BtBtGyE0D0C0EyDtAtCtByEtCtD0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyDzztB0E0CyCyB0DtG0EtByD0AtGyEyC0BtBtGzz0CtD0EtG0CyD0F0DtCtD0EyBtD0CtDtB2QtN0A0LzuyEtN1B2Z1V1T1S1NzutCtByCzztA%26cr%3D385381798%26a%3Dwbf_sumsca_17_15%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BBasic FF Keyword.URL: Mozilla\Firefox\Profiles\3nm7eri0.default -> user_pref("keyword.URL", true); FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\3nm7eri0.default\searchplugins\yahoo! powered.xml [2017-04-12] FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF48 FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF48 [2017-04-12] FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF48 FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF48 [2017-04-12] FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF48 FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF48 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_23_0_0_207.dll [2017-01-05] () FF Plugin: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-01-05] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-01-05] (Oracle Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_207.dll [2017-01-05] () FF Plugin-x32: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-01-05] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-01-05] (Oracle Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-03-23] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-03-23] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2017-03-28] (Adobe Systems Inc.) StartMenuInternet: FIREFOX.EXE - firefox.exe Chrome: ======= CHR StartupUrls: Default -> "hxxp://www.google.com/" CHR DefaultSearchURL: Default -> hxxp://srch.bar/{searchTerms} CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms} CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default [2017-04-12] CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-04-12] CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-04-12] CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-04-12] CHR Extension: (Documentos Google off-line) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-04-12] CHR Extension: (Pagamentos da Chrome Web Store) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-04-12] CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-04-12] CHR Extension: (Chrome Media Router) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-04-12] CHR HKLM\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx CHR HKU\S-1-5-21-3055871558-2611501432-2681443660-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx ==================== Serviços (Whitelisted) ==================== (Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.) S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-03-17] (Apple Inc.) S3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7398336 2017-04-12] (AVAST Software s.r.o.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [261712 2017-04-12] (AVAST Software) S3 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [433688 2016-01-07] (BlueStack Systems, Inc.) R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [413208 2016-01-07] (BlueStack Systems, Inc.) R2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [859672 2016-01-07] (BlueStack Systems, Inc.) R2 ByteFenceService; C:\Program Files\ByteFence\ByteFenceService.exe [147936 2017-04-03] (Byte Technologies LLC) R2 GbpSv; C:\Program Files (x86)\GbPlugin\GbpSv.exe [631520 2016-08-10] (GAS Tecnologia) R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe [272024 2007-05-13] () R2 rtop; C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe [304456 2017-04-12] () R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [6942480 2016-03-02] (TeamViewer GmbH) R2 TenorshareWinAdService; C:\Users\User\AppData\Roaming\Tenorshare\Service\configs\TenorshareWinAdService.exe [40448 2016-12-28] (Tenorshare Co,Ltd) [Arquivo não assinado] R2 Warsaw Technology; C:\Program Files\Diebold\Warsaw\core.exe [925744 2016-06-23] (GAS Tecnologia LTDA) R2 WeatherLiteService; C:\Program Files (x86)\WeatherTool\2.0.1.5000183\WeatherService.exe [149136 2017-03-31] () S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-13] (Microsoft Corporation) R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.4.2.223\WsAppService.exe [473312 2017-03-20] (Wondershare) S2 WsDrvInst; C:\Program Files (x86)\Wondershare\Wondershare Dr.Fone para iOS (Portuguese)\Library\DriverInstaller\DriverInstall.exe [119008 2017-04-10] (Wondershare) ===================== Drivers (Whitelisted) ====================== (Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.) R1 aswbidsdriver; C:\Windows\system32\drivers\aswbidsdrivera.sys [307736 2017-04-12] (AVAST Software s.r.o.) R0 aswbidsh; C:\Windows\system32\drivers\aswbidsha.sys [189768 2017-04-12] (AVAST Software s.r.o.) R0 aswblog; C:\Windows\system32\drivers\aswbloga.sys [334088 2017-04-12] (AVAST Software s.r.o.) R0 aswbuniv; C:\Windows\system32\drivers\aswbuniva.sys [48528 2017-04-12] (AVAST Software s.r.o.) S3 aswHdsKe; C:\Windows\system32\drivers\aswHdsKe.sys [85552 2017-01-24] (AVAST Software) S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [38296 2017-04-12] (AVAST Software) R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [32600 2017-04-12] (AVAST Software) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [127112 2017-04-12] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [101152 2017-04-12] (AVAST Software) R0 aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [75704 2017-04-12] (AVAST Software) R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1005048 2017-04-12] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [556784 2017-04-12] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [164064 2017-04-12] (AVAST Software) R0 aswVmm; C:\Windows\system32\drivers\aswVmm.sys [339696 2017-04-12] (AVAST Software) R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [154680 2016-01-07] (BlueStack Systems) R3 GBPRCM; C:\Program Files (x86)\GbPlugin\gbprcm64.sys [29912 2016-08-10] (GAS Tecnologia) R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [178976 2015-07-28] (Intel Corporation) R3 Warsaw_PP; C:\Program Files (x86)\GbPlugin\wsftprp64.sys [24792 2016-08-10] (GAS Tecnologia LTDA) R1 wsddfac; C:\Windows\System32\drivers\wsddfac.sys [101080 2017-04-12] (GAS Tecnologia) R1 wsddntf; C:\Windows\System32\DRIVERS\wsddntf.sys [36984 2016-06-16] (GAS Tecnologia) R1 wsddpp; C:\Windows\system32\drivers\wsddpp.sys [97376 2016-06-08] (GAS Tecnologia) S1 gbpddfac; system32\drivers\gbpddfac64.sys [X] S0 gbpddreg; system32\drivers\gbpddreg64.sys [X] ==================== NetSvcs (Whitelisted) =================== (Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.) ==================== Um Mês Criados arquivos e pastas ======== (Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.) 2017-04-12 21:36 - 2017-04-12 21:36 - 00000000 ____D C:\Users\Todos os Usuários\Package Cache 2017-04-12 21:36 - 2017-04-12 21:36 - 00000000 ____D C:\ProgramData\Package Cache 2017-04-12 21:34 - 2017-04-12 21:34 - 00001704 _____ C:\Users\Public\Desktop\dr.fone toolkit para iOS.lnk 2017-04-12 21:33 - 2017-04-12 21:33 - 00001432 _____ C:\Users\Public\Desktop\Aiseesoft FoneLab.lnk 2017-04-12 21:33 - 2017-04-12 21:33 - 00000000 ____D C:\Users\User\AppData\Local\Aiseesoft Studio 2017-04-12 21:33 - 2017-04-12 21:33 - 00000000 ____D C:\Users\Todos os Usuários\Aiseesoft Studio 2017-04-12 21:33 - 2017-04-12 21:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Aiseesoft 2017-04-12 21:33 - 2017-04-12 21:33 - 00000000 ____D C:\ProgramData\Aiseesoft Studio 2017-04-12 21:33 - 2017-04-12 21:33 - 00000000 ____D C:\Program Files (x86)\Aiseesoft Studio 2017-04-12 21:32 - 2017-04-12 21:36 - 14749120 _____ (Microsoft Corporation) C:\Users\User\Downloads\vc_redist.x64.exe 2017-04-12 21:32 - 2017-04-12 21:33 - 01269096 _____ (Kadamefu ) C:\Users\User\Downloads\CD 14 FEST CAR - NOVO PROGRESSO-PA.exe 2017-04-12 21:30 - 2017-04-12 21:30 - 00001162 _____ C:\Users\Public\Desktop\PhoneRescue.lnk 2017-04-12 21:30 - 2017-04-12 21:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iMobie 2017-04-12 21:30 - 2017-04-12 21:30 - 00000000 ____D C:\Program Files (x86)\iMobie 2017-04-12 21:27 - 2017-04-12 21:27 - 00001024 _____ C:\.rnd 2017-04-12 21:27 - 2017-04-12 21:27 - 00000000 ___HD C:\Program Files (x86)\GAS Tecnologia 2017-04-12 21:27 - 2017-04-12 21:27 - 00000000 ___HD C:\Program Files (x86)\Diebold 2017-04-12 21:27 - 2017-04-12 21:27 - 00000000 ____D C:\Program Files\Diebold 2017-04-12 21:27 - 2017-04-12 20:39 - 00101080 _____ (GAS Tecnologia) C:\Windows\system32\Drivers\wsddfac.sys 2017-04-12 21:27 - 2016-06-16 18:43 - 00036984 _____ (GAS Tecnologia) C:\Windows\system32\Drivers\wsddntf.sys 2017-04-12 21:27 - 2016-06-16 18:43 - 00008811 _____ C:\Windows\system32\Drivers\wsddntf.cat 2017-04-12 21:27 - 2016-06-08 18:43 - 00097376 ____N (GAS Tecnologia) C:\Windows\system32\Drivers\wsddpp.sys 2017-04-12 21:26 - 2017-04-12 21:27 - 00003352 _____ C:\Windows\System32\Tasks\DllKitPRO 2017-04-12 21:26 - 2017-04-12 21:26 - 01164944 _____ C:\Users\User\Downloads\drfone_setup_full1579 (3).exe 2017-04-12 21:26 - 2017-04-12 21:26 - 01164944 _____ C:\Users\User\Downloads\drfone_setup_full1579 (2).exe 2017-04-12 21:26 - 2017-04-12 21:26 - 00000000 ____D C:\Users\User\Downloads\vcruntime140 2017-04-12 21:26 - 2017-04-12 21:26 - 00000000 ____D C:\Users\User\AppData\Local\{003ACA6A-C058-424D-B955-A82DE5375C64} 2017-04-12 21:25 - 2017-04-12 21:26 - 01164944 _____ C:\Users\User\Downloads\drfone_setup_full1579 (1).exe 2017-04-12 21:25 - 2017-04-12 21:25 - 00001029 _____ C:\Users\User\Desktop\Dll Kit Pro.lnk 2017-04-12 21:25 - 2017-04-12 21:25 - 00000000 ____D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dll Kit Pro 2017-04-12 21:25 - 2016-01-30 11:04 - 00000000 ____D C:\Users\User\Downloads\CD Festa Automotiva 2016 (Gilberto & Duarth) 2017-04-12 21:23 - 2017-04-12 21:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare 2017-04-12 21:23 - 2017-04-12 21:33 - 00000000 ____D C:\Users\Todos os Usuários\Wondershare 2017-04-12 21:23 - 2017-04-12 21:33 - 00000000 ____D C:\ProgramData\Wondershare 2017-04-12 21:23 - 2017-04-12 21:33 - 00000000 ____D C:\Program Files (x86)\Wondershare 2017-04-12 21:23 - 2017-04-12 21:23 - 00001318 _____ C:\Users\Public\Desktop\Wondershare Dr.Fone para iOS.lnk 2017-04-12 21:23 - 2017-04-12 21:23 - 00000000 ___HD C:\Program Files (x86)\Dr.Fone_Temp 2017-04-12 21:23 - 2017-04-12 20:43 - 00000000 ____D C:\Users\User\AppData\Roaming\Wondershare 2017-04-12 21:23 - 2017-01-12 11:45 - 00076384 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\SysWOW64\libusb0.dll 2017-04-12 21:23 - 2017-01-12 11:45 - 00052832 _____ (hxxp://libusb-win32.sourceforge.net) C:\Windows\SysWOW64\Drivers\libusb0.sys 2017-04-12 21:23 - 2015-02-27 10:35 - 00000232 _____ C:\Windows\SysWOW64\dllhost.exe.config 2017-04-12 21:21 - 2017-04-12 21:22 - 00047223 _____ C:\Users\User\Downloads\vcruntime140.zip 2017-04-12 21:21 - 2017-04-12 21:21 - 00000000 ___HD C:\tenorshare_iphone data recover 2017-04-12 21:21 - 2017-04-12 21:21 - 00000000 ____D C:\Users\Todos os Usuários\GAS Tecnologia 2017-04-12 21:21 - 2017-04-12 21:21 - 00000000 ____D C:\ProgramData\GAS Tecnologia 2017-04-12 21:21 - 2017-04-12 20:40 - 00000000 ____D C:\Users\Todos os Usuários\GbPlugin 2017-04-12 21:21 - 2017-04-12 20:40 - 00000000 ____D C:\ProgramData\GbPlugin 2017-04-12 21:21 - 2017-04-12 20:40 - 00000000 ____D C:\Program Files (x86)\GbPlugin 2017-04-12 21:20 - 2017-04-12 21:32 - 00000000 ____D C:\Users\Public\Documents\Wondershare 2017-04-12 21:20 - 2017-04-12 21:21 - 01164944 _____ C:\Users\User\Downloads\drfone_setup_full1579.exe 2017-04-12 21:20 - 2017-04-12 21:20 - 01256080 _____ C:\Users\User\Downloads\drfone-for-ios_setup_full2445.exe 2017-04-12 21:19 - 2017-04-12 21:26 - 00000000 ____D C:\Users\User\AppData\Roaming\DFXCT 2017-04-12 21:19 - 2017-04-12 21:19 - 00001129 _____ C:\Users\Public\Desktop\DLL-Files.com Client.lnk 2017-04-12 21:19 - 2017-04-12 21:19 - 00000000 ____D C:\Users\User\AppData\Roaming\DLL-files.com 2017-04-12 21:19 - 2017-04-12 21:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DLL-Files.com Client 2017-04-12 21:18 - 2017-04-12 21:25 - 00000000 ____D C:\Program Files (x86)\DllKitPRO 2017-04-12 21:18 - 2017-04-12 21:19 - 00000000 ____D C:\Program Files (x86)\DLL-Files.com Client 2017-04-12 21:17 - 2017-04-12 21:18 - 02891312 _____ (CAIXA) C:\Users\User\Downloads\GBPCEF.exe 2017-04-12 21:16 - 2017-04-12 21:16 - 65606077 _____ C:\Users\User\Downloads\CD Festa Automotiva 2016 Gilberto Duarth.RAR 2017-04-12 21:16 - 2017-04-12 21:16 - 00904176 _____ C:\Users\User\Downloads\dllkit-setup.exe 2017-04-12 21:16 - 2017-04-12 21:16 - 00000000 ____D C:\Users\User\AppData\Local\iMobie_Inc 2017-04-12 21:15 - 2017-04-12 21:16 - 02786824 _____ (DLL-Files.com Client ) C:\Users\User\Downloads\clientsetup_d-0.exe 2017-04-12 21:15 - 2017-04-12 21:15 - 00000000 ____D C:\Users\User\AppData\Roaming\iMobie 2017-04-12 21:11 - 2017-04-12 21:11 - 00019093 _____ C:\Users\User\Downloads\audioclip-1492132444000-11776.mp4 2017-04-12 21:11 - 2017-04-12 21:11 - 00019093 _____ C:\Users\User\Downloads\audioclip-1492132444000-11776 (2).mp4 2017-04-12 21:11 - 2017-04-12 21:11 - 00019093 _____ C:\Users\User\Downloads\audioclip-1492132444000-11776 (1).mp4 2017-04-12 21:10 - 2017-04-12 21:29 - 27618088 _____ (Aiseesoft Studio ) C:\Users\User\Downloads\Setup_pt_Aiseesoft_FoneLab.exe 2017-04-12 21:09 - 2017-04-12 21:38 - 00000000 ____D C:\Users\User\Downloads\CD 14° FEST CAR - NOVO PROGRESSO-PA 2017-04-12 21:09 - 2017-04-12 21:09 - 00002519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk 2017-04-12 21:09 - 2017-04-12 21:09 - 00000000 ____D C:\Windows\System32\Tasks\Apple 2017-04-12 21:09 - 2017-04-12 21:09 - 00000000 ____D C:\Users\User\AppData\Local\Apple 2017-04-12 21:09 - 2017-04-12 21:09 - 00000000 ____D C:\Program Files (x86)\Apple Software Update 2017-04-12 21:09 - 2017-04-12 20:51 - 00000000 ____D C:\Users\User\AppData\Roaming\Apple Computer 2017-04-12 21:07 - 2017-04-12 21:07 - 01041944 _____ (iMobie Inc.) C:\Users\User\Downloads\phonerescue-setup.exe 2017-04-12 21:07 - 2017-04-12 20:49 - 00000000 ____D C:\Users\Todos os Usuários\Apple Computer 2017-04-12 21:07 - 2017-04-12 20:49 - 00000000 ____D C:\ProgramData\Apple Computer 2017-04-12 21:06 - 2017-04-12 21:07 - 00000000 ____D C:\Program Files\Bonjour 2017-04-12 21:06 - 2017-04-12 21:07 - 00000000 ____D C:\Program Files (x86)\Bonjour 2017-04-12 21:05 - 2017-04-12 21:06 - 00000000 ____D C:\Program Files\Common Files\Apple 2017-04-12 21:04 - 2017-04-12 21:06 - 00000000 ____D C:\Users\Todos os Usuários\Apple 2017-04-12 21:04 - 2017-04-12 21:06 - 00000000 ____D C:\ProgramData\Apple 2017-04-12 21:02 - 2017-04-12 20:41 - 257659208 _____ (Apple Inc.) C:\Users\User\Downloads\iTunes64Setup.exe 2017-04-12 20:58 - 2017-04-12 21:01 - 14749120 _____ (Microsoft Corporation) C:\Users\User\Downloads\vc_redist.x64 (1).exe 2017-04-12 20:57 - 2017-04-12 15:00 - 02424832 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe 2017-04-12 20:56 - 2017-04-12 20:56 - 00000000 ____D C:\Users\Todos os Usuários\ByteFence 2017-04-12 20:56 - 2017-04-12 20:56 - 00000000 ____D C:\ProgramData\ByteFence 2017-04-12 20:54 - 2017-04-12 21:26 - 00000000 ____D C:\Users\User\AppData\Roaming\WeatherTool 2017-04-12 20:54 - 2017-04-12 20:54 - 00000000 ____D C:\Users\Public\Documents\Tools 2017-04-12 20:54 - 2017-04-12 20:54 - 00000000 ____D C:\Users\Public\Documents\Guid 2017-04-12 20:54 - 2017-04-12 20:54 - 00000000 ____D C:\Program Files (x86)\WeatherTool 2017-04-12 20:53 - 2017-04-12 20:53 - 00000000 ____D C:\Program Files (x86)\iTunes 2017-04-12 20:52 - 2017-04-12 20:52 - 90080626 _____ C:\Users\User\Downloads\CD 14 FEST CAR - NOVO PROGRESSO-PA.RAR 2017-04-12 20:52 - 2017-04-12 20:52 - 01269096 _____ (Kadamefu ) C:\Users\User\Downloads\CD Festa Automotiva 2016 Gilberto Duarth (1).exe 2017-04-12 20:51 - 2017-04-12 20:51 - 01269096 _____ (Kadamefu ) C:\Users\User\Downloads\CD Festa Automotiva 2016 Gilberto Duarth.exe 2017-04-12 20:50 - 2017-04-12 20:50 - 00001753 _____ C:\Users\Public\Desktop\iTunes.lnk 2017-04-12 20:50 - 2017-04-12 20:50 - 00000000 ____D C:\Users\User\Documents\Wondershare Dr.Fone for iOS 2017-04-12 20:50 - 2017-04-12 20:50 - 00000000 ____D C:\Users\User\AppData\Roaming\HMYGSetting 2017-04-12 20:50 - 2017-04-12 20:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2017-04-12 20:49 - 2017-04-12 20:50 - 00000000 ____D C:\Program Files\iTunes 2017-04-12 20:49 - 2017-04-12 20:49 - 00000000 ____D C:\Program Files\iPod 2017-04-12 20:47 - 2017-04-12 20:43 - 00000000 ___HD C:\Wondershare_DrFone_Tool_Backup 2017-04-12 20:47 - 2017-04-12 20:43 - 00000000 ____D C:\Users\User\AppData\Local\chromium 2017-04-12 20:46 - 2017-04-12 20:46 - 00001049 _____ C:\Users\Public\Desktop\Booking.com.lnk 2017-04-12 20:46 - 2017-04-12 20:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Booking.com 2017-04-12 20:45 - 2017-04-12 20:46 - 00000000 ____D C:\Program Files (x86)\Booking.com 2017-04-12 20:45 - 2017-04-12 20:45 - 00003364 _____ C:\Windows\System32\Tasks\ByteFence 2017-04-12 20:44 - 2017-04-12 21:31 - 00000000 ____D C:\Tenorshare 2017-04-12 20:43 - 2017-04-12 21:10 - 00000000 ____D C:\Program Files\ByteFence 2017-04-12 20:43 - 2017-04-12 20:55 - 00000000 ____D C:\Wondershare_DrFone_temp 2017-04-12 20:42 - 2017-04-12 20:42 - 00000000 ____D C:\Users\User\.android 2017-04-12 20:41 - 2017-04-12 20:40 - 00399944 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2017-04-12 20:40 - 2017-04-12 20:40 - 00000000 ____D C:\Users\Todos os Usuários\SWCUTemp 2017-04-12 20:40 - 2017-04-12 20:40 - 00000000 ____D C:\ProgramData\SWCUTemp 2017-04-12 20:39 - 2017-04-12 20:39 - 00004340 _____ C:\Windows\System32\Tasks\Yahoo! Powered tosel 2017-04-12 20:39 - 2017-04-12 20:39 - 00000000 ____D C:\Users\Todos os Usuários\{73E4B687-F9A6-3C41-7F60-A203E52229CD} 2017-04-12 20:39 - 2017-04-12 20:39 - 00000000 ____D C:\ProgramData\{73E4B687-F9A6-3C41-7F60-A203E52229CD} 2017-04-12 20:38 - 2017-04-12 20:43 - 00000000 ____D C:\Users\User\AppData\Local\{1AA62CFA-3E0E-4042-5396-65AA77FE9932} 2017-04-12 20:38 - 2017-04-12 20:38 - 00000286 __RSH C:\Users\Todos os Usuários\ntuser.pol 2017-04-12 20:38 - 2017-04-12 20:38 - 00000286 __RSH C:\ProgramData\ntuser.pol 2017-04-12 15:01 - 2017-04-12 15:02 - 00027094 _____ C:\Users\User\Downloads\FRST.txt 2017-04-12 15:01 - 2017-04-12 15:01 - 00000000 ____D C:\FRST 2017-03-23 17:59 - 2017-01-24 07:54 - 00085552 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHdsKe.sys 2017-03-23 17:39 - 2017-03-23 17:39 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task 2017-03-15 12:55 - 2017-03-15 12:55 - 00000000 ___SD C:\Users\User\Documents\Minhas fontes de dados 2017-03-15 12:06 - 2017-03-15 12:06 - 00000017 _____ C:\Users\User\AppData\Local\resmon.resmoncfg ==================== Um Mês Modificados arquivos e pastas ======== (Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.) 2017-04-12 21:26 - 2017-01-24 07:51 - 00000000 ____D C:\Users\User\Documents\WebCam Media 2017-04-12 21:11 - 2017-01-24 08:01 - 00000000 ____D C:\Program Files (x86)\UltData 2017-04-12 21:03 - 2017-01-05 13:12 - 00000000 ____D C:\Users\User\AppData\Local\Google 2017-04-12 20:57 - 2017-01-05 13:16 - 00002193 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2017-04-12 20:56 - 2017-01-05 12:46 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2017-04-12 20:56 - 2009-07-14 01:45 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2017-04-12 20:56 - 2009-07-14 01:45 - 00014016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2017-04-12 20:55 - 2009-07-14 00:20 - 00000000 ____D C:\Windows\system32\NDF 2017-04-12 20:52 - 2017-01-24 08:36 - 00000157 _____ C:\Users\User\Documents\CAIXA INTERNET BANKING E FACEBOOK DA VITORIA.txt 2017-04-12 20:44 - 2017-01-24 07:44 - 00000000 ____D C:\Users\Todos os Usuários\BlueStacksSetup 2017-04-12 20:44 - 2017-01-24 07:44 - 00000000 ____D C:\ProgramData\BlueStacksSetup 2017-04-12 20:44 - 2009-07-14 14:55 - 00663804 _____ C:\Windows\system32\prfh0416.dat 2017-04-12 20:44 - 2009-07-14 14:55 - 00128094 _____ C:\Windows\system32\prfc0416.dat 2017-04-12 20:44 - 2009-07-14 02:13 - 01517030 _____ C:\Windows\system32\PerfStringBackup.INI 2017-04-12 20:44 - 2009-07-14 00:20 - 00000000 ____D C:\Windows\inf 2017-04-12 20:43 - 2017-01-05 13:10 - 00110432 _____ C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT 2017-04-12 20:43 - 2017-01-05 12:40 - 00000000 ____D C:\Users\User\AppData\Roaming\Skype 2017-04-12 20:41 - 2017-01-24 08:34 - 00003914 _____ C:\Windows\System32\Tasks\Avast Emergency Update 2017-04-12 20:41 - 2017-01-24 07:48 - 00000198 _____ C:\Windows\Tasks\AutoKMS.job 2017-04-12 20:41 - 2017-01-05 13:05 - 00164064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys 2017-04-12 20:40 - 2017-01-05 13:05 - 00556784 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys 2017-04-12 20:40 - 2017-01-05 13:05 - 00339696 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys 2017-04-12 20:40 - 2017-01-05 13:05 - 00127112 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2017-04-12 20:40 - 2017-01-05 13:05 - 00101152 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2017-04-12 20:40 - 2017-01-05 13:05 - 00075704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys 2017-04-12 20:40 - 2017-01-05 13:05 - 00038296 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys 2017-04-12 20:39 - 2017-01-24 08:34 - 00334088 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbloga.sys 2017-04-12 20:39 - 2017-01-24 08:34 - 00307736 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidsdrivera.sys 2017-04-12 20:39 - 2017-01-24 08:34 - 00189768 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidsha.sys 2017-04-12 20:39 - 2017-01-24 08:34 - 00048528 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbuniva.sys 2017-04-12 20:39 - 2017-01-05 13:06 - 00003896 _____ C:\Windows\System32\Tasks\SafeZone scheduled Autoupdate 1483632387 2017-04-12 20:39 - 2017-01-05 13:05 - 01005048 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys 2017-04-12 20:39 - 2017-01-05 13:05 - 00032600 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys 2017-04-12 20:39 - 2017-01-05 12:58 - 00000000 ____D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite 2017-04-12 20:39 - 2009-07-14 02:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2017-04-12 20:39 - 2009-07-14 01:45 - 00411080 _____ C:\Windows\system32\FNTCACHE.DAT 2017-04-12 20:38 - 2009-07-14 00:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy 2017-04-12 20:38 - 2009-07-14 00:20 - 00000000 ____D C:\Windows\SysWOW64\GroupPolicy 2017-03-23 18:02 - 2017-01-05 13:00 - 00000000 ____D C:\Users\User\AppData\Local\Windows Live 2017-03-23 17:47 - 2017-01-05 13:05 - 00000000 ____D C:\Users\User\AppData\Local\Microsoft Help 2017-03-23 17:42 - 2017-01-05 13:16 - 00003500 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2017-03-23 17:42 - 2017-01-05 13:16 - 00003372 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2017-03-23 17:36 - 2009-07-14 02:08 - 00032586 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2017-03-15 12:06 - 2009-07-14 00:20 - 00000000 ____D C:\Windows\Registration 2017-03-15 10:06 - 2017-01-05 13:04 - 00000000 ____D C:\Users\Todos os Usuários\AVAST Software 2017-03-15 10:06 - 2017-01-05 13:04 - 00000000 ____D C:\ProgramData\AVAST Software ==================== Arquivos na raiz de alguns diretórios ======= 2017-01-05 13:02 - 2012-06-06 17:17 - 0043256 _____ () C:\Program Files\oemlogo.bmp 2017-03-15 12:06 - 2017-03-15 12:06 - 0000017 _____ () C:\Users\User\AppData\Local\resmon.resmoncfg Alguns arquivos em TEMP: ==================== 2017-04-12 20:52 - 2017-04-12 20:52 - 0015872 _____ () C:\Users\User\AppData\Local\Temp\efsh6ugt.dll 2017-04-12 20:40 - 2017-04-12 21:04 - 257659208 _____ (Apple Inc.) C:\Users\User\AppData\Local\Temp\iTunesLatest.exe 2017-03-29 22:50 - 2017-03-29 22:50 - 1128792 _____ (Google Inc.) C:\Users\User\AppData\Local\Temp\{F2546CA4-658B-4C65-8CE5-33B6F705E757}-GoogleUpdateSetup.exe ==================== Bamital & volsnap ====================== (Não há correção automática para arquivos que não passaram na verificação.) C:\Windows\system32\winlogon.exe => O arquivo é assinado digitalmente C:\Windows\system32\wininit.exe => O arquivo é assinado digitalmente C:\Windows\SysWOW64\wininit.exe => O arquivo é assinado digitalmente C:\Windows\explorer.exe => O arquivo é assinado digitalmente C:\Windows\SysWOW64\explorer.exe => O arquivo é assinado digitalmente C:\Windows\system32\svchost.exe => O arquivo é assinado digitalmente C:\Windows\SysWOW64\svchost.exe => O arquivo é assinado digitalmente C:\Windows\system32\services.exe => O arquivo é assinado digitalmente C:\Windows\system32\User32.dll => O arquivo é assinado digitalmente C:\Windows\SysWOW64\User32.dll => O arquivo é assinado digitalmente C:\Windows\system32\userinit.exe => O arquivo é assinado digitalmente C:\Windows\SysWOW64\userinit.exe => O arquivo é assinado digitalmente C:\Windows\system32\rpcss.dll => O arquivo é assinado digitalmente C:\Windows\system32\dnsapi.dll => O arquivo é assinado digitalmente C:\Windows\SysWOW64\dnsapi.dll => O arquivo é assinado digitalmente C:\Windows\system32\Drivers\volsnap.sys => O arquivo é assinado digitalmente LastRegBack: 2017-03-23 18:31 ==================== Fim de FRST.txt ============================