Resultado do exame da Farbar Recovery Scan Tool (FRST) (x64) Versão: 08-07-2017
Executado por cassia (ATENÇÃO: O usuário não é o administrador) em ACER (08-07-2017 19:21:05)
Executando a partir de C:\Users\cassia\Downloads
Perfis Carregados: cassia (Perfis Disponíveis: Ativa FM & cassia)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Idioma: Português (Brasil)
Internet Explorer Versão 11 (Navegador padrão: Chrome)
Modo da Inicialização: Normal
Tutorial da Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processos (Whitelisted) =================

(Se uma entrada for incluída na fixlist, o processo será fechado. O arquivo não será movido.)

Falha ao acessar processo -> smss.exe
Falha ao acessar processo -> csrss.exe
Falha ao acessar processo -> wininit.exe
Falha ao acessar processo -> csrss.exe
Falha ao acessar processo -> services.exe
Falha ao acessar processo -> lsass.exe
Falha ao acessar processo -> lsm.exe
Falha ao acessar processo -> winlogon.exe
Falha ao acessar processo -> svchost.exe
Falha ao acessar processo -> svchost.exe
Falha ao acessar processo -> svchost.exe
Falha ao acessar processo -> svchost.exe
Falha ao acessar processo -> svchost.exe
Falha ao acessar processo -> svchost.exe
Falha ao acessar processo -> svchost.exe
Falha ao acessar processo -> spoolsv.exe
Falha ao acessar processo -> svchost.exe
Falha ao acessar processo -> PresentationFontCache.exe
Falha ao acessar processo -> mdm.exe
Falha ao acessar processo -> svchost.exe
Falha ao acessar processo -> svchost.exe
Falha ao acessar processo -> WUDFHost.exe
Falha ao acessar processo -> TrustedInstaller.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hola Networks Ltd.) C:\Program Files\Hola\app\hola.exe
(Spotify Ltd) C:\Users\cassia\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.569\SSScheduler.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
() C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe
(Node.js) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\libs\node.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
Falha ao acessar processo -> SearchIndexer.exe
Falha ao acessar processo -> wmpnetwk.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Falha ao acessar processo -> svchost.exe
Falha ao acessar processo -> svchost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Falha ao acessar processo -> mscorsvw.exe
Falha ao acessar processo -> mscorsvw.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
Falha ao acessar processo -> SearchProtocolHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Falha ao acessar processo -> WmiPrvSE.exe
Falha ao acessar processo -> SearchFilterHost.exe

==================== Registro (Whitelisted) ====================

(Se uma entrada for incluída na fixlist, o ítem no Registro será restaurado para o padrão ou removido. O arquivo não será movido.)

HKLM\...\Run: [hola] => C:\Program Files\Hola\app\hola.exe [2168416 2017-02-22] (Hola Networks Ltd.) <==== ATENÇÃO
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-03-22] (Adobe Systems Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [303928 2017-05-09] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation)
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [67896 2017-05-09] (Apple Inc.)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2313408 2016-04-07] (Adobe Systems Incorporated)
HKLM-x32\...\RunOnce: [Lemelako] => C:\Windows\SysWOW64\wscript.exe /E:vbscript /B "C:\Users\ATIVAF~1\AppData\Local\2F6B34~1\Lirip.dat"
HKLM-x32\...\RunOnce: [Godoherepo] => C:\Windows\SysWOW64\wscript.exe /E:vbscript /B "C:\Users\ATIVAF~1\AppData\Local\12C4D9~1\Canag.dat"
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [134784 2014-02-25] (Atheros Communications)
HKU\S-1-5-21-148412566-1961663863-3645598996-1004\...\Run: [Spotify Web Helper] => C:\Users\cassia\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1562224 2017-06-26] (Spotify Ltd)
HKU\S-1-5-21-148412566-1961663863-3645598996-1004\...\Run: [Spotify] => C:\Users\cassia\AppData\Roaming\Spotify\Spotify.exe [7047792 2017-06-26] (Spotify Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2017-06-01]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.569\SSScheduler.exe (McAfee, Inc.)
GroupPolicy: Restrição <==== ATENÇÃO
CHR HKLM\SOFTWARE\Policies\Google: Restrição <==== ATENÇÃO

==================== Internet (Whitelisted) ====================

(Se um ítem for incluído na fixlist, sendo um ítem do Registro, será removido ou restaurado para o padrão.)

Hosts: Há mais de uma entrada no Hosts. Veja a seção Hosts do Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{46275234-4B52-4703-9D7A-A1BCE429F3D2}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{D841DA09-9F60-4905-A0A6-D4A7E1B81A50}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://br.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_bxinw_16_48&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0D0CtD0E0AtC0AyDtDzytC0F0FzzzytBtN0D0Tzu0StCyBzyzytN1L2XzutAtFtByDtFtCtFyDtBtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2SyBtBtD0AtCyEtCzztGtD0F0EtCtGzyyBtDzztGtA0FyB0AtGzy0DyB0CyEyCyB0DyEyDyC0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0E0F0C0B0ByCyDtGtB0E0C0AtGyEzz0EtAtGzyyDzy0CtGtDzz0AyB0F0EyE0E0FyB0A0D2QtN0A0LzuyE%26cr%3D1187110427%26a%3Dwbf_bxinw_16_48%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://br.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_bxinw_16_48&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0D0CtD0E0AtC0AyDtDzytC0F0FzzzytBtN0D0Tzu0StCyBzyzytN1L2XzutAtFtByDtFtCtFyDtBtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2SyBtBtD0AtCyEtCzztGtD0F0EtCtGzyyBtDzztGtA0FyB0AtGzy0DyB0CyEyCyB0DyEyDyC0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0E0F0C0B0ByCyDtGtB0E0C0AtGyEzz0EtAtGzyyDzy0CtGtDzz0AyB0F0EyE0E0FyB0A0D2QtN0A0LzuyE%26cr%3D1187110427%26a%3Dwbf_bxinw_16_48%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate
HKU\S-1-5-21-148412566-1961663863-3645598996-1004\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pt-br/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_bxinw_16_48&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0D0CtD0E0AtC0AyDtDzytC0F0FzzzytBtN0D0Tzu0StCyBzyzytN1L2XzutAtFtByDtFtCtFyDtBtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2SyBtBtD0AtCyEtCzztGtD0F0EtCtGzyyBtDzztGtA0FyB0AtGzy0DyB0CyEyCyB0DyEyDyC0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0E0F0C0B0ByCyDtGtB0E0C0AtGyEzz0EtAtGzyyDzy0CtGtDzz0AyB0F0EyE0E0FyB0A0D2QtN0A0LzuyE%26cr%3D1187110427%26a%3Dwbf_bxinw_16_48%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_bxinw_16_48&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0D0CtD0E0AtC0AyDtDzytC0F0FzzzytBtN0D0Tzu0StCyBzyzytN1L2XzutAtFtByDtFtCtFyDtBtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2SyBtBtD0AtCyEtCzztGtD0F0EtCtGzyyBtDzztGtA0FyB0AtGzy0DyB0CyEyCyB0DyEyDyC0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0E0F0C0B0ByCyDtGtB0E0C0AtGyEzz0EtAtGzyyDzy0CtGtDzz0AyB0F0EyE0E0FyB0A0D2QtN0A0LzuyE%26cr%3D1187110427%26a%3Dwbf_bxinw_16_48%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_bxinw_16_48&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0D0CtD0E0AtC0AyDtDzytC0F0FzzzytBtN0D0Tzu0StCyBzyzytN1L2XzutAtFtByDtFtCtFyDtBtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2SyBtBtD0AtCyEtCzztGtD0F0EtCtGzyyBtDzztGtA0FyB0AtGzy0DyB0CyEyCyB0DyEyDyC0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0E0F0C0B0ByCyDtGtB0E0C0AtGyEzz0EtAtGzyyDzy0CtGtDzz0AyB0F0EyE0E0FyB0A0D2QtN0A0LzuyE%26cr%3D1187110427%26a%3Dwbf_bxinw_16_48%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_bxinw_16_48&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1Qzu0D0CtD0E0AtC0AyDtDzytC0F0FzzzytBtN0D0Tzu0StCyBzyzytN1L2XzutAtFtByDtFtCtFyDtBtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2SyBtBtD0AtCyEtCzztGtD0F0EtCtGzyyBtDzztGtA0FyB0AtGzy0DyB0CyEyCyB0DyEyDyC0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0D0E0F0C0B0ByCyDtGtB0E0C0AtGyEzz0EtAtGzyyDzy0CtGtDzz0AyB0F0EyE0E0FyB0A0D2QtN0A0LzuyE%26cr%3D1187110427%26a%3Dwbf_bxinw_16_48%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll => Nenhum Arquivo
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-12-01] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-12-01] (Oracle Corporation)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF DefaultProfile: xdpug4z7.default
FF ProfilePath: C:\Users\cassia\AppData\Roaming\Mozilla\Firefox\Profiles\xdpug4z7.default [2017-07-08]
FF NewTab: Mozilla\Firefox\Profiles\xdpug4z7.default -> about:newtab
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_26_0_0_131.dll [2017-06-22] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [Nenhum Arquivo]
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2016-04-07] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_26_0_0_131.dll [2017-06-22] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-12-01] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-12-01] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-01] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-01] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2013-09-22] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-04-04] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2016-04-07] (Adobe Systems)
StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR NewTab: Default ->  Not-active:"chrome-extension://bahkljhhdeciiaodlkppoonappfnheoi/content/newtab.html"
CHR DefaultSearchURL: Default -> hxxp://srch.bar/{searchTerms}
CHR DefaultSearchKeyword: Default -> Yahoo
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
CHR Profile: C:\Users\cassia\AppData\Local\Google\Chrome\User Data\Default [2017-07-08]
CHR Extension: (Google Drive) - C:\Users\cassia\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-12-01]
CHR Extension: (Search Manager) - C:\Users\cassia\AppData\Local\Google\Chrome\User Data\Default\Extensions\bahkljhhdeciiaodlkppoonappfnheoi [2017-06-16]
CHR Extension: (Hola) - C:\Users\cassia\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkommgglgedojaffpdbadghkofkjfiej [2016-02-26]
CHR Extension: (YouTube) - C:\Users\cassia\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-17]
CHR Extension: (Google Search) - C:\Users\cassia\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-12-01]
CHR Extension: (Tweetdeck Select All) - C:\Users\cassia\AppData\Local\Google\Chrome\User Data\Default\Extensions\dleejkmcjjocedkijmfieejigibnhcpf [2016-05-31]
CHR Extension: (ZenMate VPN - Best Cyber Security & Unblock) - C:\Users\cassia\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdcgdnkidjaadafnichfpabhfomcebme [2017-06-12]
CHR Extension: (TweetDeck by Twitter) - C:\Users\cassia\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbdpomandigafcibbmofojjchbcdagbl [2015-12-19]
CHR Extension: (Pagamentos da Chrome Web Store) - C:\Users\cassia\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-18]
CHR Extension: (Gmail) - C:\Users\cassia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-07-22]
CHR Extension: (Chrome Media Router) - C:\Users\cassia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-07-08]
CHR HKLM\...\Chrome\Extension: [ehlceeijggpdgfcefmipcmdelickjgfg] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ehlceeijggpdgfcefmipcmdelickjgfg] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [npdicihegicnhaangkdmcgbjceoemeoo] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx

==================== Serviços (Whitelisted) ====================

(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)

S4 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [694464 2016-04-07] (Adobe Systems Incorporated)
S4 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2246256 2017-05-18] (Adobe Systems, Incorporated)
S4 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2017-04-03] (Apple Inc.)
S4 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [319104 2014-02-25] (Windows (R) Win 7 DDK provider) [Arquivo não assinado]
S4 ByteFenceService; C:\Program Files\ByteFence\ByteFenceService.exe [146400 2016-12-18] (Byte Technologies LLC)
S4 DisplayLinkService; C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [8988048 2013-04-03] (DisplayLink Corp.)
S4 hola_svc; C:\Program Files\Hola\app\hola_svc.exe [5622368 2017-02-22] (Hola Networks Ltd.) <==== ATENÇÃO
S4 hola_updater; C:\Program Files\Hola\app\hola_updater.exe [5491328 2016-04-12] (Hola Networks Ltd.) <==== ATENÇÃO
R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R2 lmhosts; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-13] (Microsoft Corporation)
S4 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.569\McCHSvc.exe [404376 2017-05-25] (McAfee, Inc.)
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [Arquivo não assinado]
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-13] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
R2 nsi; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-13] (Microsoft Corporation)
S4 rtop; C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe [304456 2017-02-03] ()
S4 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10884848 2017-05-23] (TeamViewer GmbH)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S4 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.3.0.5\WsAppService.exe [415232 2016-08-09] (Wondershare) [Arquivo não assinado]
S4 WsDrvInst; C:\Program Files (x86)\Wondershare\Dr.Fone para iOS\DriverInstall.exe [97792 2016-10-15] (Wondershare) [Arquivo não assinado]

===================== Drivers (Whitelisted) ======================

(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)

S3 DisplayLinkUsbIo_x64; C:\Windows\System32\DRIVERS\DisplayLinkUsbIo_x64_7.2.46733.0.sys [44944 2016-07-19] ()

==================== NetSvcs (Whitelisted) ===================

(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)


==================== Três Meses Criados arquivos e pastas ========

(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)

2017-07-08 19:21 - 2017-07-08 19:21 - 00019683 _____ C:\Users\cassia\Downloads\FRST.txt
2017-07-08 19:20 - 2017-07-08 19:21 - 00000000 ____D C:\FRST
2017-07-08 19:20 - 2017-07-08 19:20 - 02437120 _____ (Farbar) C:\Users\cassia\Downloads\FRST64.exe
2017-07-08 19:20 - 2017-07-08 19:20 - 01782784 _____ (Farbar) C:\Users\cassia\Downloads\FRST.exe
2017-07-08 19:18 - 2017-07-08 19:19 - 00000869 _____ C:\Users\cassia\Downloads\FSS.txt
2017-07-08 19:18 - 2017-07-08 19:18 - 00899584 _____ (Farbar) C:\Users\cassia\Downloads\FSS.exe
2017-07-08 19:18 - 2017-07-08 19:18 - 00899584 _____ (Farbar) C:\Users\cassia\Downloads\FSS (1).exe
2017-07-08 19:04 - 2017-07-08 19:13 - 00000000 ___HD C:\Users\Public\Documents\AdobeGC
2017-06-26 19:20 - 2017-06-26 19:20 - 00001139 _____ C:\Users\Public\Desktop\DLL-Files.com Client.lnk
2017-06-26 19:20 - 2017-06-26 19:20 - 00000000 ____D C:\Users\Ativa FM\AppData\Roaming\DLL-files.com
2017-06-26 19:20 - 2017-06-26 19:20 - 00000000 ____D C:\Users\Ativa FM\AppData\Roaming\DFXCT
2017-06-26 19:20 - 2017-06-26 19:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DLL-Files.com Client
2017-06-26 19:20 - 2017-06-26 19:20 - 00000000 ____D C:\Program Files (x86)\DLL-Files.com Client
2017-06-26 19:19 - 2017-06-26 19:19 - 02786824 _____ (DLL-Files.com Client ) C:\Users\cassia\Downloads\clientsetup_d-0 (3).exe
2017-06-26 19:19 - 2017-06-26 19:19 - 02786824 _____ (DLL-Files.com Client ) C:\Users\cassia\Downloads\clientsetup_d-0 (2).exe
2017-06-25 20:57 - 2017-06-25 20:57 - 00000844 _____ C:\Users\cassia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Tor Browser.lnk
2017-06-25 20:57 - 2017-06-25 20:57 - 00000796 _____ C:\Users\cassia\Desktop\Start Tor Browser.lnk
2017-06-25 20:56 - 2017-06-25 20:56 - 00000000 ____D C:\Users\cassia\Desktop\Tor Browser
2017-06-25 20:53 - 2017-06-25 20:55 - 54270000 _____ C:\Users\cassia\Downloads\torbrowser-install-7.0.1_en-US.exe
2017-06-15 19:03 - 2017-06-15 19:03 - 00001859 _____ C:\Users\Public\Desktop\QuickTime Player.lnk
2017-06-15 19:03 - 2017-06-15 19:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2017-06-15 19:03 - 2017-06-15 19:03 - 00000000 ____D C:\Program Files (x86)\QuickTime
2017-06-15 17:22 - 2015-10-13 01:57 - 00950720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2017-06-12 23:01 - 2016-04-06 12:27 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2017-06-12 22:59 - 2015-11-03 16:04 - 00241664 _____ (Microsoft Corporation) C:\Windows\system32\els.dll
2017-06-12 22:59 - 2015-11-03 15:55 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\els.dll
2017-06-12 22:41 - 2016-04-09 01:20 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2017-06-12 22:41 - 2016-04-09 00:52 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2017-06-12 22:30 - 2017-06-12 22:34 - 259195720 _____ (Apple Inc.) C:\Users\cassia\Downloads\iTunes64Setup (1).exe
2017-06-12 22:28 - 2017-06-12 22:28 - 02786824 _____ (DLL-Files.com Client ) C:\Users\cassia\Downloads\clientsetup_d-0 (1).exe
2017-06-12 22:26 - 2017-06-12 22:26 - 02786824 _____ (DLL-Files.com Client ) C:\Users\cassia\Downloads\clientsetup_d-0.exe
2017-06-12 22:20 - 2017-06-12 22:36 - 00001767 _____ C:\Users\Public\Desktop\iTunes.lnk
2017-06-12 22:20 - 2017-06-12 22:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-06-12 22:20 - 2017-06-12 22:35 - 00000000 ____D C:\Program Files\iTunes
2017-06-12 22:20 - 2017-06-12 22:20 - 00000000 ____D C:\Program Files\iPod
2017-06-12 22:19 - 2017-06-12 22:19 - 00000000 ____D C:\Program Files\Bonjour
2017-06-12 22:19 - 2017-06-12 22:19 - 00000000 ____D C:\Program Files (x86)\Bonjour
2017-06-12 22:19 - 2017-06-12 22:19 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2017-06-12 22:14 - 2017-06-12 22:17 - 259195720 _____ (Apple Inc.) C:\Users\cassia\Downloads\iTunes64Setup.exe
2017-06-01 14:58 - 2017-06-01 14:58 - 00000000 ____D C:\Users\Todos os Usuários\McAfee Security Scan
2017-06-01 14:58 - 2017-06-01 14:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2017-06-01 14:58 - 2017-06-01 14:58 - 00000000 ____D C:\ProgramData\McAfee Security Scan

==================== Três Meses Modificados arquivos e pastas ========

(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)

2017-07-08 19:15 - 2015-07-22 21:52 - 00000000 ____D C:\Users\cassia\AppData\Local\Spotify
2017-07-08 19:15 - 2009-07-14 01:45 - 00014192 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-07-08 19:15 - 2009-07-14 01:45 - 00014192 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-07-08 19:12 - 2015-04-24 08:58 - 00736844 _____ C:\Windows\system32\perfh00A.dat
2017-07-08 19:12 - 2015-04-24 08:58 - 00734886 _____ C:\Windows\system32\perfh013.dat
2017-07-08 19:12 - 2015-04-24 08:58 - 00675142 _____ C:\Windows\system32\perfh00E.dat
2017-07-08 19:12 - 2015-04-24 08:58 - 00660228 _____ C:\Windows\system32\perfh005.dat
2017-07-08 19:12 - 2015-04-24 08:58 - 00472890 _____ C:\Windows\system32\perfh00B.dat
2017-07-08 19:12 - 2015-04-24 08:58 - 00383732 _____ C:\Windows\system32\perfh00D.dat
2017-07-08 19:12 - 2015-04-24 08:58 - 00170726 _____ C:\Windows\system32\perfc00E.dat
2017-07-08 19:12 - 2015-04-24 08:58 - 00157926 _____ C:\Windows\system32\perfc00A.dat
2017-07-08 19:12 - 2015-04-24 08:58 - 00152554 _____ C:\Windows\system32\perfc013.dat
2017-07-08 19:12 - 2015-04-24 08:58 - 00140878 _____ C:\Windows\system32\perfc005.dat
2017-07-08 19:12 - 2015-04-24 08:58 - 00100972 _____ C:\Windows\system32\perfc00B.dat
2017-07-08 19:12 - 2015-04-24 08:58 - 00084210 _____ C:\Windows\system32\perfc00D.dat
2017-07-08 19:12 - 2015-04-24 00:12 - 00731434 _____ C:\Windows\system32\perfh010.dat
2017-07-08 19:12 - 2015-04-24 00:12 - 00146298 _____ C:\Windows\system32\perfc010.dat
2017-07-08 19:12 - 2015-04-24 00:09 - 00737104 _____ C:\Windows\system32\perfh00C.dat
2017-07-08 19:12 - 2015-04-24 00:09 - 00470402 _____ C:\Windows\system32\perfh001.dat
2017-07-08 19:12 - 2015-04-24 00:09 - 00149032 _____ C:\Windows\system32\perfc00C.dat
2017-07-08 19:12 - 2015-04-24 00:09 - 00094224 _____ C:\Windows\system32\perfc001.dat
2017-07-08 19:12 - 2015-04-24 00:03 - 00688596 _____ C:\Windows\system32\perfh007.dat
2017-07-08 19:12 - 2015-04-24 00:03 - 00148568 _____ C:\Windows\system32\perfc007.dat
2017-07-08 19:12 - 2009-07-14 14:55 - 00705268 _____ C:\Windows\system32\prfh0416.dat
2017-07-08 19:12 - 2009-07-14 14:55 - 00147108 _____ C:\Windows\system32\prfc0416.dat
2017-07-08 19:12 - 2009-07-14 02:13 - 09262172 _____ C:\Windows\system32\PerfStringBackup.INI
2017-07-08 19:12 - 2009-07-14 00:20 - 00000000 ____D C:\Windows\inf
2017-07-08 19:07 - 2015-07-22 21:40 - 00000000 ____D C:\Users\cassia\AppData\Roaming\Spotify
2017-07-08 19:07 - 2009-07-14 02:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-07-08 19:05 - 2015-04-24 13:19 - 00000000 ____D C:\Users\Todos os Usuários\Package Cache
2017-07-08 19:05 - 2015-04-24 13:19 - 00000000 ____D C:\ProgramData\Package Cache
2017-07-08 19:05 - 2015-04-24 13:09 - 00000000 ____D C:\Users\Todos os Usuários\Avira
2017-07-08 19:05 - 2015-04-24 13:09 - 00000000 ____D C:\ProgramData\Avira
2017-07-08 19:04 - 2015-07-22 21:40 - 00000000 ____D C:\Users\cassia\AppData\Local\Adobe
2017-07-08 19:03 - 2016-01-19 08:11 - 00000000 ____D C:\Users\Todos os Usuários\AVAST Software
2017-07-08 19:03 - 2016-01-19 08:11 - 00000000 ____D C:\ProgramData\AVAST Software
2017-07-08 18:55 - 2016-12-04 13:48 - 00000984 _____ C:\Windows\Tasks\Yahoo! Powered sinam.job
2017-07-07 19:04 - 2016-01-19 15:45 - 00002195 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-07-07 19:04 - 2015-04-26 18:03 - 00002207 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-06-26 07:44 - 2015-04-26 18:27 - 00000412 _____ C:\Windows\Tasks\DriverEasy Scheduled Scan.job
2017-06-25 22:02 - 2016-01-19 19:38 - 00000000 ____D C:\Users\cassia\AppData\Local\CrashDumps
2017-06-25 19:11 - 2016-05-20 18:21 - 00000000 ___RD C:\Users\cassia\Creative Cloud Files
2017-06-25 19:01 - 2016-12-31 19:46 - 00000000 ____D C:\Users\cassia\Downloads\tatuagens
2017-06-25 18:22 - 2009-07-14 15:11 - 00000000 ____D C:\Program Files\Windows Journal
2017-06-23 01:52 - 2015-12-19 02:31 - 00000000 ____D C:\Program Files (x86)\Steam
2017-06-22 18:55 - 2015-04-26 18:23 - 00803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-06-22 18:55 - 2015-04-26 18:23 - 00144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-06-22 18:55 - 2015-04-26 18:23 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2017-06-22 18:55 - 2015-04-26 18:23 - 00000000 ____D C:\Windows\system32\Macromed
2017-06-22 18:48 - 2016-12-04 13:48 - 00000000 ____D C:\Users\Todos os Usuários\{CF7A0A19-4538-80DF-C3FE-1E9D59BC9553}
2017-06-22 18:48 - 2016-12-04 13:48 - 00000000 ____D C:\ProgramData\{CF7A0A19-4538-80DF-C3FE-1E9D59BC9553}
2017-06-22 18:30 - 2015-07-22 21:24 - 00000000 ____D C:\Users\Ativa FM\AppData\Roaming\Spotify
2017-06-22 18:27 - 2016-12-04 13:48 - 00000000 ____D C:\Program Files\ByteFence
2017-06-15 19:00 - 2015-04-23 22:14 - 00000000 ____D C:\Users\Ativa FM
2017-06-12 22:45 - 2017-04-08 16:50 - 00000985 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 12.lnk
2017-06-12 22:45 - 2015-05-07 15:44 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2017-06-12 22:20 - 2016-02-27 13:37 - 00000000 ____D C:\Users\Todos os Usuários\Apple Computer
2017-06-12 22:20 - 2016-02-27 13:37 - 00000000 ____D C:\ProgramData\Apple Computer
2017-06-12 22:19 - 2016-10-01 16:00 - 00000000 ____D C:\Program Files\Common Files\Apple
2017-06-12 22:19 - 2016-02-27 13:36 - 00002519 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2017-06-12 22:19 - 2016-02-27 13:36 - 00000000 ____D C:\Users\Todos os Usuários\Apple
2017-06-12 22:19 - 2016-02-27 13:36 - 00000000 ____D C:\ProgramData\Apple

==================== Arquivos na raiz de alguns diretórios =======

2015-11-19 06:24 - 2015-11-19 06:24 - 0000000 _____ () C:\Users\cassia\AppData\Local\{3DFF3A4D-1523-44BC-A818-C2550900E7F4}
2016-01-27 23:49 - 2016-01-27 23:49 - 0000000 _____ () C:\Users\cassia\AppData\Local\{52DF84A0-E35C-4C3F-A1D9-FEF1EE8724C7}
2015-10-19 17:03 - 2015-10-19 17:03 - 0000000 _____ () C:\Users\cassia\AppData\Local\{655D7189-9230-4DDB-B92F-19390697DC60}

Arquivos para serem movidos ou deletados:
====================
C:\Program Files\Hola\app\hola.exe


==================== Bamital & volsnap ======================

(Não há correção automática para arquivos que não passaram na verificação.)

C:\Windows\system32\winlogon.exe => O arquivo é assinado digitalmente
C:\Windows\system32\wininit.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\wininit.exe => O arquivo é assinado digitalmente
C:\Windows\explorer.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\explorer.exe => O arquivo é assinado digitalmente
C:\Windows\system32\svchost.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\svchost.exe => O arquivo é assinado digitalmente
C:\Windows\system32\services.exe => O arquivo é assinado digitalmente
C:\Windows\system32\User32.dll => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\User32.dll => O arquivo é assinado digitalmente
C:\Windows\system32\userinit.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\userinit.exe => O arquivo é assinado digitalmente
C:\Windows\system32\rpcss.dll => O arquivo é assinado digitalmente
C:\Windows\system32\dnsapi.dll => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\dnsapi.dll => O arquivo é assinado digitalmente
C:\Windows\system32\Drivers\volsnap.sys => O arquivo é assinado digitalmente


ATENÇÃO: ==> Não foi possível acessar BCD. O usuário não é o administrador

==================== Fim de FRST.txt ============================