Blanknight
Members-
Posts
7 -
Joined
-
Last visited
Content Type
Events
Profiles
Forums
Everything posted by Blanknight
-
[Security] Website blocked keeps popping up
Blanknight replied to Blanknight's topic in Resolved Malware Removal Logs
I see. Anyway, the computer is running perfectly now, no new problems detected. Truly, thanks a lot for fixing it for me. Take care, Blanknight -
[Security] Website blocked keeps popping up
Blanknight replied to Blanknight's topic in Resolved Malware Removal Logs
The problem seems to have been solved. What did you find? Anyway, here are the logs : -----------------------Fixlog------------------------------------- Resultado da Correção pela Farbar Recovery Scan Tool (x64) Versão: 20-05-2017 Executado por rahul_000 (21-05-2017 09:41:49) Run:1 Executando a partir de C:\Users\rahul_000\Desktop Perfis Carregados: UpdatusUser & rahul_000 (Perfis Disponíveis: UpdatusUser & rahul_000 & RahulCrescimento & rober) Modo da Inicialização: Normal ============================================== fixlist Conteúdo: ***************** Start CloseProcesses: CreateRestorePoint: C:\Program Files (x86)\vSnapshot\1.0.0.0\vSnapshotServ.exe C:\Program Files (x86)\vSnapshot AppInit_DLLs: C:\windows\system32\nvinitx.dll => Nenhum Arquivo AppInit_DLLs: , C:\WINDOWS\system32\nvinitx.dll => Nenhum Arquivo CHR HKLM\SOFTWARE\Policies\Google: Restrição <======= ATENÇÃO Tcpip\..\Interfaces\{2fa42369-3f9e-41da-bb45-7e31e1b0832d}: [DhcpNameServer] 8.8.8.8 C:\Users\rahul_000\ntuser.ini C:\Users\rahul_000\Setup.exe Task: {02D303F3-3C69-4F14-BFF2-A615D7B0427A} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Nenhum Arquivo <==== ATENÇÃO Task: {108899F4-9DBD-4A56-8078-D031DBB58EE4} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Nenhum Arquivo <==== ATENÇÃO Task: {23A268BE-2F0C-4556-81DC-88F0E6AC6FE6} - \WPD\SqmUpload_S-1-5-21-1114943301-3855528572-74286459-1002 -> Nenhum Arquivo <==== ATENÇÃO Task: {5875BEB2-AE4A-48CE-A311-1424DF477EB0} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Nenhum Arquivo <==== ATENÇÃO Task: {5F31DFC9-DFAA-40C8-9FCB-75943724E30B} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Nenhum Arquivo <==== ATENÇÃO Task: {6DDBC8B5-1673-40FE-B31F-A0ACD0B52EB2} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Nenhum Arquivo <==== ATENÇÃO Task: {7C2585A6-7A7A-4C2C-8579-23308E38BE66} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Nenhum Arquivo <==== ATENÇÃO Task: {822E8BA7-640B-41F0-B7D1-1C22BEAC1D50} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Nenhum Arquivo <==== ATENÇÃO Task: {8A56B1EB-46BD-42BB-AF59-FAA3E85A1475} - \WPD\SqmUpload_S-1-5-21-1114943301-3855528572-74286459-1005 -> Nenhum Arquivo <==== ATENÇÃO Task: {982D4B2E-742F-49BF-AB72-0F80153ADAD9} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Nenhum Arquivo <==== ATENÇÃO Task: {A6D71998-2CBE-46F5-AE13-BE8A8EF60B01} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Nenhum Arquivo <==== ATENÇÃO Task: {D27A8EBA-0DA7-4EBD-988C-954E84D8F688} - \GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-1114943301-3855528572-74286459-1002 -> Nenhum Arquivo <==== ATENÇÃO Task: {D3721019-67DC-4BC6-B6C8-50A720C41BA8} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Nenhum Arquivo <==== ATENÇÃO Task: {FBA9AECA-508A-494C-AA7C-6938F6C866E2} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Nenhum Arquivo <==== ATENÇÃO AlternateDataStreams: C:\Program Files (x86)\GbPlugin:IncompleteStartProcessProtection.cnt [10] AlternateDataStreams: C:\Program Files (x86)\GbPlugin:u6eBQrM0Z2K3FKLVBMG8dY3IkKT2rqFO+Sf68h8fDg== [32] AlternateDataStreams: C:\WINDOWS\system32\Drivers\gbpddfac64.sys:X5ZN8aGvT4 [2262] AlternateDataStreams: C:\WINDOWS\system32\Drivers\gbpddreg64.sys:X5ZN8aGvT4 [686] AlternateDataStreams: C:\WINDOWS\system32\Drivers\wsddfac.sys:X5ZN8aGXs4 [2410] AlternateDataStreams: C:\ProgramData\GbPlugin:IncompleteStartGbprcm.cnt [22] AlternateDataStreams: C:\Users\Todos os Usuários\GbPlugin:IncompleteStartGbprcm.cnt [22] FirewallRules: [{320D7F54-DCFE-4039-B98B-1BC98551FA4D}] => (Block) LPort=138 FirewallRules: [{4F78AADF-D272-4099-8354-37F271154D72}] => (Block) LPort=135 CMD: ipconfig /flushdns Hosts: EmptyTemp: end ***************** Processos fechados com sucesso. Ponto de Restauração criado com sucesso. C:\Program Files (x86)\vSnapshot\1.0.0.0\vSnapshotServ.exe => movido com sucesso C:\Program Files (x86)\vSnapshot => movido com sucesso "C:\windows\system32\nvinitx.dll" => Dados do Valor removido (a) com sucesso.. ", C:\WINDOWS\system32\nvinitx.dll" => Dados do Valor não encontrado (a). HKLM\SOFTWARE\Policies\Google => chave removido (a) com sucesso. HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2fa42369-3f9e-41da-bb45-7e31e1b0832d}\\DhcpNameServer => valor removido (a) com sucesso. C:\Users\rahul_000\ntuser.ini => movido com sucesso C:\Users\rahul_000\Setup.exe => movido com sucesso HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{02D303F3-3C69-4F14-BFF2-A615D7B0427A} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{02D303F3-3C69-4F14-BFF2-A615D7B0427A} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{108899F4-9DBD-4A56-8078-D031DBB58EE4} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{108899F4-9DBD-4A56-8078-D031DBB58EE4} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{23A268BE-2F0C-4556-81DC-88F0E6AC6FE6} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{23A268BE-2F0C-4556-81DC-88F0E6AC6FE6} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WPD\SqmUpload_S-1-5-21-1114943301-3855528572-74286459-1002 => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5875BEB2-AE4A-48CE-A311-1424DF477EB0} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5875BEB2-AE4A-48CE-A311-1424DF477EB0} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5F31DFC9-DFAA-40C8-9FCB-75943724E30B} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5F31DFC9-DFAA-40C8-9FCB-75943724E30B} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{6DDBC8B5-1673-40FE-B31F-A0ACD0B52EB2} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6DDBC8B5-1673-40FE-B31F-A0ACD0B52EB2} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{7C2585A6-7A7A-4C2C-8579-23308E38BE66} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7C2585A6-7A7A-4C2C-8579-23308E38BE66} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{822E8BA7-640B-41F0-B7D1-1C22BEAC1D50} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{822E8BA7-640B-41F0-B7D1-1C22BEAC1D50} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8A56B1EB-46BD-42BB-AF59-FAA3E85A1475} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8A56B1EB-46BD-42BB-AF59-FAA3E85A1475} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WPD\SqmUpload_S-1-5-21-1114943301-3855528572-74286459-1005 => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{982D4B2E-742F-49BF-AB72-0F80153ADAD9} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{982D4B2E-742F-49BF-AB72-0F80153ADAD9} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A6D71998-2CBE-46F5-AE13-BE8A8EF60B01} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A6D71998-2CBE-46F5-AE13-BE8A8EF60B01} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D27A8EBA-0DA7-4EBD-988C-954E84D8F688} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D27A8EBA-0DA7-4EBD-988C-954E84D8F688} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-1114943301-3855528572-74286459-1002 => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D3721019-67DC-4BC6-B6C8-50A720C41BA8} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D3721019-67DC-4BC6-B6C8-50A720C41BA8} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FBA9AECA-508A-494C-AA7C-6938F6C866E2} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FBA9AECA-508A-494C-AA7C-6938F6C866E2} => chave removido (a) com sucesso. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent => chave removido (a) com sucesso. C:\Program Files (x86)\GbPlugin => ":IncompleteStartProcessProtection.cnt" ADS removido (a) com sucesso.. C:\Program Files (x86)\GbPlugin => ":u6eBQrM0Z2K3FKLVBMG8dY3IkKT2rqFO+Sf68h8fDg==" ADS removido (a) com sucesso.. C:\WINDOWS\system32\Drivers\gbpddfac64.sys => ":X5ZN8aGvT4" ADS removido (a) com sucesso.. C:\WINDOWS\system32\Drivers\gbpddreg64.sys => ":X5ZN8aGvT4" ADS removido (a) com sucesso.. C:\WINDOWS\system32\Drivers\wsddfac.sys => ":X5ZN8aGXs4" ADS removido (a) com sucesso.. C:\ProgramData\GbPlugin => ":IncompleteStartGbprcm.cnt" ADS removido (a) com sucesso.. "C:\Users\Todos os Usuários\GbPlugin" => ":IncompleteStartGbprcm.cnt" ADS não encontrado (a). HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{320D7F54-DCFE-4039-B98B-1BC98551FA4D} => valor removido (a) com sucesso. HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{4F78AADF-D272-4099-8354-37F271154D72} => valor removido (a) com sucesso. ========= ipconfig /flushdns ========= Configura‡ao de IP do Windows Libera‡ao do Cache do DNS Resolver bem-sucedida. ========= Fim de CMD: ========= C:\Windows\System32\Drivers\etc\hosts => movido com sucesso Hosts restaurado com sucesso. =========== EmptyTemp: ========== BITS transfer queue => 6053888 B DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 36089545 B Java, Flash, Steam htmlcache => 413274041 B Windows/system/drivers => 664971581 B Edge => 1760 B Chrome => 116461838 B Firefox => 29982626 B Opera => 727040 B Temp, IE cache, history, cookies, recent: Default => 0 B Users => 0 B ProgramData => 0 B Public => 0 B systemprofile => 0 B systemprofile32 => 0 B LocalService => 1642 B NetworkService => 3766 B UpdatusUser => 0 B rahul_000 => 22569697 B RahulCrescimento => 74205 B rober => 27591 B RecycleBin => 0 B EmptyTemp: => 1.2 GB de dados temporários Removidos. ================================ O sistema precisou ser reiniciado. ==== Fim de Fixlog 09:43:53 ==== ----------------------AdwCleaner Log-------------------------------------------------- # AdwCleaner v6.047 - Logfile created 21/05/2017 at 10:32:02 # Updated on 19/05/2017 by Malwarebytes # Database : 2017-05-19.1 [Server] # Operating System : Windows 10 Home Single Language (X64) # Username : rahul_000 - SYNC # Running from : C:\Users\rahul_000\Desktop\adwcleaner_6.047.exe # Mode: Clean # Support : https://www.malwarebytes.com/support ***** [ Services ] ***** [-] Service deleted: YSearchUtilSvc ***** [ Folders ] ***** [-] Folder deleted: C:\ProgramData\{82950f97-ad75-497b-8295-50f97ad73e5e} [-] Folder deleted: C:\Users\rahul_000\Unknown [-] Folder deleted: C:\Users\rahul_000\AppData\Local\YSearchUtil [-] Folder deleted: C:\StormAlert [-] Folder deleted: C:\ProgramData\IObit\ASCDownloader [-] Folder deleted: C:\Users\Public\Documents\Guid [-] Folder deleted: C:\Users\Public\Documents\pc faster [-] Folder deleted: C:\Program Files (x86)\Yahoo!\yset [-] Folder deleted: C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Local\YSearchUtil ***** [ Files ] ***** [-] File deleted: C:\END [-] File deleted: C:\Users\rahul_000\AppData\Roaming\Mozilla\Firefox\Profiles\61iwucp6.default-1491755514323\extensions\jid1-16aeif9OQIRKxA@jetpack.xpi ***** [ DLL ] ***** ***** [ WMI ] ***** ***** [ Shortcuts ] ***** ***** [ Scheduled Tasks ] ***** ***** [ Registry ] ***** [-] Key deleted: HKU\S-1-5-21-1114943301-3855528572-74286459-1002\Software\AppDataLow\Software\SpeedChecker [#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\SpeedChecker [-] Key deleted: HKLM\SOFTWARE\dllpop100 [-] Key deleted: HKLM\SOFTWARE\IOBIT\ASC [-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! SearchSet [#] Key deleted on reboot: [x64] HKCU\Software\AppDataLow\Software\SpeedChecker [-] Key deleted: [x64] HKLM\SOFTWARE\DtsEncodeTools [-] Data restored: [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] [-] Key deleted: HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.ascplugin.protect [-] Key deleted: HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh ***** [ Web browsers ] ***** [-] [C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: bopakagnckmlgajfccecajhnimjiiedh [-] [C:\Users\RahulCrescimento\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: br.ask.com [-] [C:\Users\rober\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: br.ask.com [-] [C:\Users\rober\AppData\Local\Google\Chrome\User Data\Default] [homepage] Deleted: hxxp://br.hao123.com/?tn=sdkw_inner_hp_09_hao123_br&guid=9f1c1506112b08bc455e8ac5b916a238 ************************* :: "Tracing" keys deleted :: Winsock settings cleared ************************* C:\AdwCleaner\AdwCleaner[C0].txt - [2812 Bytes] - [21/05/2017 10:32:02] C:\AdwCleaner\AdwCleaner[S0].txt - [3248 Bytes] - [21/05/2017 10:30:03] ########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [2958 Bytes] ########## -------------------------MSRT Log------------------------ --------------------------------------------------------------------------------------- Microsoft Windows Malicious Software Removal Tool v5.48, May 2017 (build 5.48.13801.0) Started On Sun May 21 10:44:47 2017 Engine: 1.1.13701.0 Signatures: 1.241.491.0 Run Mode: Interactive Graphical Mode Results Summary: ---------------- No infection found. Successfully Submitted MAPS Report Successfully Submitted Heartbeat Report Microsoft Windows Malicious Software Removal Tool Finished On Sun May 21 10:49:44 2017 Return code: 0 (0x0) MBScan.txt -
[Security] Website blocked keeps popping up
Blanknight replied to Blanknight's topic in Resolved Malware Removal Logs
That program is exactly my problem. I never installed it (probably came as a "freebie" in some download or another...my mistake) and do not trust it. I'm afraid of even tampering with the folder it is in...since that attack last week I started trying to be more careful with what I do in my computer, and not messing with unknown "exe" files is part of it... Should I just delete it? -
[Security] Website blocked keeps popping up
Blanknight replied to Blanknight's topic in Resolved Malware Removal Logs
You are a good guy. I like you. Sorry for the incovenience... Here they are : Resultado do exame da Farbar Recovery Scan Tool (FRST) (x64) Versão: 20-05-2017 Executado por rahul_000 (administrador) em SYNC (20-05-2017 22:29:58) Executando a partir de C:\Users\rahul_000\Desktop Perfis Carregados: UpdatusUser & rahul_000 & RahulCrescimento & rober (Perfis Disponíveis: UpdatusUser & rahul_000 & RahulCrescimento & rober) Platform: Windows 10 Home Single Language Versão 1703 (X64) Idioma: Português (Brasil) Internet Explorer Versão 11 (Navegador padrão: Chrome) Modo da Inicialização: Normal Tutorial da Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processos (Whitelisted) ================= (Se uma entrada for incluída na fixlist, o processo será fechado. O arquivo não será movido.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Intel Corporation) C:\Windows\System32\igfxCUIService.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe (Soluto) C:\Program Files\Soluto\SolutoLauncherService.exe (GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Samsung Electronics CO., LTD.) C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe () C:\Program Files (x86)\vSnapshot\1.0.0.0\vSnapshotServ.exe (AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe (Razer Inc.) C:\Program Files (x86)\Razer\Razer Cortex\RzKLService.exe (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe (AVAST Software s.r.o.) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe (SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (SurfRight B.V.) C:\Program Files\HitmanPro\HitmanPro.exe (GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe (Intel Corporation) C:\Windows\System32\igfxEM.exe (Intel Corporation) C:\Windows\System32\igfxHK.exe (Intel Corporation) C:\Windows\System32\igfxTray.exe (SAMSUNG Electronics co., LTD.) C:\ProgramData\Samsung\ShutdownEvent.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Soluto) C:\Program Files\Soluto\Soluto.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.15.597.0_x64__kzf8qxf38zg5c\SkypeHost.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe (GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Samsung Electronics CO., LTD.) C:\Program Files\Samsung\S Agent\CommonAgent.exe (Razer Inc.) C:\Program Files (x86)\Razer\Razer Cortex\main.exe (The CefSharp Authors) C:\Program Files (x86)\Razer\Razer Cortex\Cef\CefSharp.BrowserSubprocess.exe (Soluto) C:\Program Files\Soluto\SolutoService.exe (Microsoft Corporation) C:\Windows\System32\smartscreen.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (GlavSoft LLC.) C:\Program Files\Soluto\SolutoRemoteService.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\InstallAgent.exe (Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\Updates\16.0.7766.2084\OfficeClickToRun.exe ==================== Registro (Whitelisted) ==================== (Se uma entrada for incluída na fixlist, o ítem no Registro será restaurado para o padrão ou removido. O arquivo não será movido.) HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [629152 2017-03-19] (Microsoft Corporation) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [14040296 2015-08-28] (Realtek Semiconductor) HKLM\...\Run: [RtsCM] => C:\WINDOWS\RTSCM64.EXE [168152 2015-06-28] (Realtek Semiconductor Corp.) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1806136 2015-12-19] (NVIDIA Corporation) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2017-01-19] (Apple Inc.) HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [213824 2017-05-07] (AVAST Software) HKLM\...\Run: [Diebold - Warsaw] => C:\Program Files\Diebold\Warsaw\core.exe [954416 2017-01-19] (GAS Tecnologia LTDA) HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [3146704 2017-05-09] (Malwarebytes) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [67384 2017-01-13] (Apple Inc.) HKLM-x32\...\Run: [RazerCortex] => C:\Program Files (x86)\Razer\Razer Cortex\RazerCortex.exe [98256 2015-08-31] (Razer Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation) HKLM\...\Winlogon: [Userinit] c:\windows\system32\userinit.exe,c:\program files\soluto\soluto.exe /userinit, Winlogon\Notify\ GbPluginBb: C:\Program Files (x86)\GbPlugin\gbieh.dll [2016-06-16] (Banco do Brasil) HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe HKU\S-1-5-21-1114943301-3855528572-74286459-1001\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [517120 2017-03-19] (Microsoft Corporation) HKU\S-1-5-21-1114943301-3855528572-74286459-1002\...\Run: [DisplaySwitch] => C:\programdata\samsung\DisplaySwitch.exe [1758512 2013-12-10] (TODO: <Company name>) HKU\S-1-5-21-1114943301-3855528572-74286459-1002\...\Run: [Akamai NetSession Interface] => C:\Users\rahul_000\AppData\Local\Akamai\netsession_win.exe [4691384 2015-09-10] (Akamai Technologies, Inc.) HKU\S-1-5-21-1114943301-3855528572-74286459-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9532120 2017-04-11] (Piriform Ltd) HKU\S-1-5-21-1114943301-3855528572-74286459-1005\...\Run: [DisplaySwitch] => C:\programdata\samsung\DisplaySwitch.exe [1758512 2013-12-10] (TODO: <Company name>) HKU\S-1-5-21-1114943301-3855528572-74286459-1005\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [517120 2017-03-19] (Microsoft Corporation) HKU\S-1-5-21-1114943301-3855528572-74286459-1007\...\Run: [DisplaySwitch] => C:\programdata\samsung\DisplaySwitch.exe [1758512 2013-12-10] (TODO: <Company name>) HKU\S-1-5-21-1114943301-3855528572-74286459-1007\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [517120 2017-03-19] (Microsoft Corporation) AppInit_DLLs: C:\windows\system32\nvinitx.dll => Nenhum Arquivo AppInit_DLLs: , C:\WINDOWS\system32\nvinitx.dll => Nenhum Arquivo SSODL: EldosMountNotificator-cbfs5 - {9668EC9F-5899-4757-82EA-237145DF9C5F} - C:\windows\system32\cbfsMntNtf5.dll (EldoS Corporation) SSODL-x32: EldosMountNotificator-cbfs5 - {9668EC9F-5899-4757-82EA-237145DF9C5F} - C:\windows\SysWOW64\cbfsMntNtf5.dll (EldoS Corporation) ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\PROGRAM FILES (X86)\GbPlugin\gbieh.dll [1947872 2016-06-16] (Banco do Brasil) ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-05-07] (AVAST Software) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-05-07] (AVAST Software) ShellIconOverlayIdentifiers: [1EldosIconOverlay-cbfs5] -> {66F3BB48-A328-41F2-8885-B4843E8114A8} => C:\windows\system32\cbfsMntNtf5.dll [2014-03-06] (EldoS Corporation) ShellIconOverlayIdentifiers: [2EldosIconOverlay-cbfs5] -> {12E9C010-F44D-477F-BB6A-EF6827E4054E} => C:\windows\system32\cbfsMntNtf5.dll [2014-03-06] (EldoS Corporation) ShellIconOverlayIdentifiers: [BitcasaBadFileOverlay] -> {EC168C82-5053-422A-BB08-3CD9ACA22E85} => C:\Program Files\Bitcasa\ExplorerMenu.dll [2014-04-24] () ShellIconOverlayIdentifiers: [BitcasaIconOverlay] -> {A6975448-A999-49BB-B3E4-7730CF6A82C0} => C:\Program Files\Bitcasa\ExplorerMenu.dll [2014-04-24] () ShellIconOverlayIdentifiers: [BitcasaMirrorOverlay] -> {8C403C00-4544-4A53-879B-1949390CDE13} => C:\Program Files\Bitcasa\ExplorerMenu.dll [2014-04-24] () ShellIconOverlayIdentifiers: [BitcasaNotMirrored] -> {775CDDED-E6D2-4DD8-8C1F-158BEF44B62A} => C:\Program Files\Bitcasa\ExplorerMenu.dll [2014-04-24] () ShellIconOverlayIdentifiers: [BitcasaProgressOverlay] -> {6FB8D52A-0064-45B2-B687-F596FEAD09C2} => C:\Program Files\Bitcasa\ExplorerMenu.dll [2014-04-24] () ShellIconOverlayIdentifiers: [EldosIconOverlay-cbfs5] -> {E47A726D-C20B-468E-8C39-30A3D9C602D7} => C:\windows\system32\cbfsMntNtf5.dll [2014-03-06] (EldoS Corporation) ShellIconOverlayIdentifiers-x32: [1EldosIconOverlay-cbfs5] -> {66F3BB48-A328-41F2-8885-B4843E8114A8} => C:\windows\SysWOW64\cbfsMntNtf5.dll [2014-03-06] (EldoS Corporation) ShellIconOverlayIdentifiers-x32: [2EldosIconOverlay-cbfs5] -> {12E9C010-F44D-477F-BB6A-EF6827E4054E} => C:\windows\SysWOW64\cbfsMntNtf5.dll [2014-03-06] (EldoS Corporation) ShellIconOverlayIdentifiers-x32: [EldosIconOverlay-cbfs5] -> {E47A726D-C20B-468E-8C39-30A3D9C602D7} => C:\windows\SysWOW64\cbfsMntNtf5.dll [2014-03-06] (EldoS Corporation) Startup: C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nexon Launcher.lnk [2017-04-10] ShortcutTarget: Nexon Launcher.lnk -> C:\Program Files (x86)\NEXON\Nexon Launcher\nexon_launcher.exe () CHR HKLM\SOFTWARE\Policies\Google: Restrição <======= ATENÇÃO ==================== Internet (Whitelisted) ==================== (Se um ítem for incluído na fixlist, sendo um ítem do Registro, será removido ou restaurado para o padrão.) Tcpip\Parameters: [DhcpNameServer] 187.123.92.39 187.123.92.41 Tcpip\..\Interfaces\{04a777d4-1840-45a8-9147-51f2f4ded75a}: [DhcpNameServer] 187.123.92.39 187.123.92.41 Tcpip\..\Interfaces\{2fa42369-3f9e-41da-bb45-7e31e1b0832d}: [DhcpNameServer] 8.8.8.8 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://br.hao123.com/?tn=sdkw_inner_hp_09_hao123_br&guid=9f1c1506112b08bc455e8ac5b916a238 HKU\S-1-5-21-1114943301-3855528572-74286459-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung13.msn.com/?pc=smjb HKU\S-1-5-21-1114943301-3855528572-74286459-1005\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://samsung13.msn.com/?pc=smjb HKU\S-1-5-21-1114943301-3855528572-74286459-1005\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung13.msn.com/?pc=smjb HKU\S-1-5-21-1114943301-3855528572-74286459-1007\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung13.msn.com/?pc=smjb SearchScopes: HKU\S-1-5-21-1114943301-3855528572-74286459-1002 -> DefaultScope {4F38063C-1A55-4238-B2E5-26AB46200370} URL = SearchScopes: HKU\S-1-5-21-1114943301-3855528572-74286459-1002 -> {4F38063C-1A55-4238-B2E5-26AB46200370} URL = SearchScopes: HKU\S-1-5-21-1114943301-3855528572-74286459-1005 -> DefaultScope {4F38063C-1A55-4238-B2E5-26AB46200370} URL = SearchScopes: HKU\S-1-5-21-1114943301-3855528572-74286459-1005 -> {4F38063C-1A55-4238-B2E5-26AB46200370} URL = BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2017-04-03] (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_121\bin\ssv.dll [2017-03-02] (Oracle Corporation) BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2017-04-03] (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-03-02] (Oracle Corporation) BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.) BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2017-04-03] (Microsoft Corporation) BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540000} -> C:\PROGRAM FILES (X86)\GBPLUGIN\gbieh.dll [2016-06-16] (Banco do Brasil) BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2017-04-03] (Microsoft Corporation) Handler-x32: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll [2016-01-04] (Belarc, Inc.) Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-04-03] (Microsoft Corporation) Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-04-03] (Microsoft Corporation) Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-04-03] (Microsoft Corporation) Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-04-03] (Microsoft Corporation) FireFox: ======== FF ProfilePath: C:\Users\rahul_000\AppData\Roaming\Mozilla\Firefox\Profiles\61iwucp6.default-1491755514323 [2017-05-20] FF Homepage: Mozilla\Firefox\Profiles\61iwucp6.default-1491755514323 -> hxxp:www.fidonav.com FF HKU\S-1-5-21-1114943301-3855528572-74286459-1002\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi FF Extension: (McAfee Security Scan Plus) - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04] [não assinado] FF HKU\S-1-5-21-1114943301-3855528572-74286459-1005\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_25_0_0_171.dll [2017-05-15] () FF Plugin: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-03-02] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-03-02] (Oracle Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_171.dll [2017-05-15] () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-17] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-17] (Intel Corporation) FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2017-04-03] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-04-03] (Microsoft Corporation) FF Plugin-x32: @nexon.net/NxGame -> C:\ProgramData\NexonUS\NGM\npNxGameUS.dll [2015-03-22] (Nexon) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-04-05] (Adobe Systems Inc.) Chrome: ======= CHR DefaultProfile: Default CHR HomePage: Default -> hxxp://www.google.com.br/ CHR Profile: C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default [2017-05-20] CHR Extension: (Google Docs) - C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-22] CHR Extension: (Google Drive) - C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-22] CHR Extension: (YouTube) - C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25] CHR Extension: (Fire Dragon) - C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\cggmonnikkilkmkppbpjjbefmakjbcel [2015-11-18] CHR Extension: (Google Search) - C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27] CHR Extension: (Documentos Google off-line) - C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-21] CHR Extension: (Pagamentos da Chrome Web Store) - C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-04-12] CHR Extension: (Gmail) - C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-20] CHR Extension: (Chrome Media Router) - C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-13] CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - hxxp://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <não encontrado (a)> Opera: ======= OPR StartupUrls: "hxxp://br.hao123.com/?tn=sdkw_inner_hp_09_hao123_br&guid=9f1c1506112b08bc455e8ac5b916a238" OPR Session Restore: -> está habilitado. ==================== Serviços (Whitelisted) ==================== (Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.) R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7346208 2017-05-07] (AVAST Software s.r.o.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [263304 2017-05-07] (AVAST Software) R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3705536 2017-04-03] (Microsoft Corporation) R2 GbpSv; C:\Program Files (x86)\GbPlugin\gbpsv.exe [631520 2016-06-20] (GAS Tecnologia) R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [135488 2017-05-20] (SurfRight B.V.) R2 hshld; C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe [2757752 2016-06-29] (AnchorFree Inc.) S3 HssTrayService; C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE [103168 2016-06-29] () R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [329280 2016-02-19] (Intel Corporation) S3 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [Arquivo não assinado] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation) S3 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-17] (Intel Corporation) S3 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2585376 2015-03-26] (IObit) R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.) R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [188072 2015-08-15] () R2 RzKLService; C:\Program Files (x86)\Razer\Razer Cortex\RzKLService.exe [129168 2015-08-31] (Razer Inc.) R2 SolutoLauncherService; C:\Program Files\Soluto\SolutoLauncherService.exe [221728 2013-12-08] (Soluto) R3 SolutoRemoteService; C:\Program Files\Soluto\SolutoRemoteService.exe [1942016 2013-12-08] (GlavSoft LLC.) [Arquivo não assinado] R2 SWUpdateService; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [3196768 2015-11-06] (Samsung Electronics CO., LTD.) R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [256120 2016-02-01] (Synaptics Incorporated) R2 ThevSnapshotService; C:\Program Files (x86)\vSnapshot\1.0.0.0\vSnapshotServ.exe [152264 2016-12-24] () R2 Warsaw Technology; C:\Program Files\Diebold\Warsaw\core.exe [954416 2017-01-19] (GAS Tecnologia LTDA) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [342264 2017-03-19] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [102816 2017-03-19] (Microsoft Corporation) S3 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2014-06-17] (Atheros) [Arquivo não assinado] ===================== Drivers (Whitelisted) ====================== (Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.) R1 aswbidsdriver; C:\WINDOWS\system32\drivers\aswbidsdrivera.sys [311808 2017-05-07] (AVAST Software s.r.o.) R0 aswbidsh; C:\WINDOWS\system32\drivers\aswbidsha.sys [190256 2017-05-07] (AVAST Software s.r.o.) R0 aswblog; C:\WINDOWS\system32\drivers\aswbloga.sys [334576 2017-05-07] (AVAST Software s.r.o.) R0 aswbuniv; C:\WINDOWS\system32\drivers\aswbuniva.sys [49016 2017-05-07] (AVAST Software s.r.o.) S3 aswHwid; C:\WINDOWS\system32\drivers\aswHwid.sys [38296 2017-05-07] (AVAST Software) R1 aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [32600 2017-05-07] (AVAST Software) R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [128648 2017-05-07] (AVAST Software) R1 aswRdr; C:\WINDOWS\system32\drivers\aswRdr2.sys [101152 2017-05-07] (AVAST Software) R0 aswRvrt; C:\WINDOWS\system32\drivers\aswRvrt.sys [75704 2017-05-07] (AVAST Software) R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [1007160 2017-05-07] (AVAST Software) R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [569192 2017-05-07] (AVAST Software) R2 aswStm; C:\WINDOWS\system32\drivers\aswStm.sys [158880 2017-05-13] (AVAST Software) R0 aswVmm; C:\WINDOWS\system32\drivers\aswVmm.sys [339696 2017-05-07] (AVAST Software) R1 cbfs5; C:\windows\system32\drivers\cbfs5.sys [416960 2014-03-06] (EldoS Corporation) R3 cpuz136; C:\WINDOWS\TEMP\cpuz136\cpuz136_x64.sys [23856 2017-05-16] (CPUID) R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [77440 2017-05-09] () R1 gbpddfac; C:\WINDOWS\System32\drivers\gbpddfac64.sys [28888 2017-05-15] (GAS Tecnologia) R0 gbpddreg; C:\WINDOWS\System32\drivers\gbpddreg64.sys [29816 2017-05-15] (GAS Tecnologia) R3 GBPRCM; C:\Program Files (x86)\GbPlugin\gbprcm64.sys [29912 2015-09-22] (GAS Tecnologia) R1 HWiNFO32; C:\windows\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-06-28] (REALiX(tm)) R2 MBAMChameleon; C:\WINDOWS\system32\drivers\MBAMChameleon.sys [187320 2017-05-14] (Malwarebytes) R3 MBAMFarflt; C:\WINDOWS\system32\drivers\farflt.sys [113592 2017-05-15] (Malwarebytes) R3 MBAMProtection; C:\WINDOWS\system32\drivers\mbam.sys [43968 2017-05-15] (Malwarebytes) R0 MBAMSwissArmy; C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys [251832 2017-05-15] (Malwarebytes) R3 MBAMWebProtection; C:\WINDOWS\system32\drivers\mwac.sys [93624 2017-05-20] (Malwarebytes) R1 MpKsl983d8c65; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1B7E818A-197D-4748-B952-C07F6576E13A}\MpKsl983d8c65.sys [44928 2017-05-20] (Microsoft Corporation) R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nvsmwu.inf_amd64_be58e4780959fe55\nvlddmkm.sys [13754936 2016-09-12] (NVIDIA Corporation) R3 RadioHIDMini; C:\WINDOWS\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows (R) Win 7 DDK provider) R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [604160 2017-03-19] (Realtek ) R3 rtsuvc; C:\WINDOWS\system32\DRIVERS\rtsuvc.sys [2599128 2015-06-28] (Realtek Semiconductor Corp.) R2 rzpmgrk; C:\windows\system32\drivers\rzpmgrk.sys [37184 2015-06-13] (Razer, Inc.) S3 SDFRd; C:\WINDOWS\System32\drivers\SDFRd.sys [31128 2017-03-19] () R3 taphss6; C:\WINDOWS\System32\drivers\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.) S3 USBAAPL64; C:\WINDOWS\System32\Drivers\usbaapl64.sys [54784 2015-06-17] (Apple, Inc.) [Arquivo não assinado] R3 Warsaw_PP; C:\Program Files (x86)\GbPlugin\wsftprp64.sys [24792 2015-09-22] (GAS Tecnologia LTDA) S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44632 2017-03-19] (Microsoft Corporation) R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [294816 2017-03-19] (Microsoft Corporation) S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [121248 2017-03-19] (Microsoft Corporation) R1 wsddfac; C:\WINDOWS\System32\drivers\wsddfac.sys [28376 2017-05-15] (GAS Tecnologia) R1 wsddntf; C:\WINDOWS\system32\DRIVERS\wsddntf.sys [47176 2016-11-12] (GAS Tecnologia) R1 wsddpp; C:\WINDOWS\system32\drivers\wsddpp.sys [25184 2016-11-12] (GAS Tecnologia) R3 wsddprm; C:\WINDOWS\system32\drivers\wsddprm.sys [25184 2016-11-12] (GAS Tecnologia) S3 xhunter1; C:\WINDOWS\xhunter1.sys [36808 2016-07-28] (Wellbia.com Co., Ltd.) ==================== NetSvcs (Whitelisted) =================== (Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.) ==================== Um Mês Criados arquivos e pastas ======== (Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.) 2017-05-20 22:29 - 2017-05-20 22:30 - 00028809 _____ C:\Users\rahul_000\Desktop\FRST.txt 2017-05-20 22:29 - 2017-05-20 22:29 - 00000000 ____D C:\FRST 2017-05-20 22:28 - 2017-05-20 22:28 - 02429952 _____ (Farbar) C:\Users\rahul_000\Desktop\FRST64.exe 2017-05-20 22:27 - 2017-05-20 22:27 - 00000000 ___HD C:\OneDriveTemp 2017-05-20 09:36 - 2017-05-20 09:36 - 00003954 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1419515478 2017-05-20 09:36 - 2017-05-20 09:36 - 00001120 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2017-05-20 09:14 - 2017-05-20 09:14 - 00001962 _____ C:\Users\Public\Desktop\HitmanPro.lnk 2017-05-20 09:14 - 2017-05-20 09:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro 2017-05-20 09:14 - 2017-05-20 09:14 - 00000000 ____D C:\Program Files\HitmanPro 2017-05-20 09:13 - 2017-05-20 09:48 - 00000000 ____D C:\Users\Todos os Usuários\HitmanPro 2017-05-20 09:13 - 2017-05-20 09:48 - 00000000 ____D C:\ProgramData\HitmanPro 2017-05-20 09:02 - 2017-05-20 09:08 - 11584088 _____ (SurfRight B.V.) C:\Users\rahul_000\Downloads\hitmanpro_x64.exe 2017-05-18 07:30 - 2017-05-18 07:36 - 00001171 _____ C:\Users\Public\Desktop\Warcraft III - The Frozen Throne.lnk 2017-05-18 06:27 - 2017-05-18 07:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Warcraft III 2017-05-18 06:27 - 2017-05-18 07:36 - 00000000 ____D C:\Program Files (x86)\Warcraft III 2017-05-18 06:27 - 2017-05-18 06:33 - 00001126 _____ C:\Users\Public\Desktop\Warcraft III.lnk 2017-05-17 01:50 - 2017-05-17 01:50 - 00000000 ____D C:\Users\rahul_000\AppData\Local\DBG 2017-05-16 06:02 - 2017-05-16 06:02 - 00003276 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2 2017-05-16 06:02 - 2017-05-16 06:02 - 00002415 _____ C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2017-05-16 05:58 - 2017-05-16 05:58 - 00000000 ____D C:\Users\Todos os Usuários\Microsoft OneDrive 2017-05-16 05:58 - 2017-05-16 05:58 - 00000000 ____D C:\ProgramData\Microsoft OneDrive 2017-05-16 05:54 - 2017-05-16 05:54 - 00000451 _____ C:\WINDOWS\system32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat 2017-05-16 05:53 - 2017-05-16 05:53 - 00000020 ___SH C:\Users\rahul_000\ntuser.ini 2017-05-16 02:25 - 2017-05-16 02:25 - 00000000 ____D C:\Windows.old 2017-05-16 02:24 - 2017-05-16 02:24 - 23681024 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 23677440 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 21353200 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 20505600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 20374424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 19335168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 12787200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 11870208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 08320920 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 08244736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 07931392 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 07904784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 06759512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 06728192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 06292992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 05557760 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 05477088 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneCoreUAPCommonProxyStub.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 05225984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 04848440 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 04730368 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 04559360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 04469832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 04446208 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 04396032 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 04175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 03672064 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys 2017-05-16 02:24 - 2017-05-16 02:24 - 03667456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 03655680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 03307008 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 03116184 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 02969880 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreUIComponents.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 02957824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys 2017-05-16 02:24 - 2017-05-16 02:24 - 02859520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 02800128 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 02765824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Shell.UnifiedTile.CuratedTileCollections.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 02651648 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 02635336 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 02499584 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 02444192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys 2017-05-16 02:24 - 2017-05-16 02:24 - 02443776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 02435584 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 02399728 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 02330520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 02298880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 02259760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreUIComponents.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 02158544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 02085280 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 02077184 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2017-05-16 02:24 - 2017-05-16 02:24 - 02056192 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys 2017-05-16 02:24 - 2017-05-16 02:24 - 02008576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl 2017-05-16 02:24 - 2017-05-16 02:24 - 01886208 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01878016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01852776 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01839872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01803264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01760264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01657344 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsPrint.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01628160 _____ (Microsoft Corporation) C:\WINDOWS\system32\comsvcs.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01626624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01611776 _____ (Microsoft Corporation) C:\WINDOWS\system32\SpeechPal.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01605632 _____ (Microsoft Corporation) C:\WINDOWS\system32\quartz.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01604312 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01600512 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01583616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01557288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01518088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01506816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\quartz.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01468416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01463296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01433600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.Handlers.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01411128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01356800 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01325456 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01320352 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpx.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01302528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01295872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01293824 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01291776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01285120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01269760 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01260544 _____ (Microsoft Corporation) C:\WINDOWS\system32\GamePanel.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 01257472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01248768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01242624 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01147296 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 01103872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01087488 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01085440 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01075712 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01060352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsPrint.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01054208 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01051648 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01027584 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 01024416 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 01019904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00988168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00987648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00985600 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00980992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys 2017-05-16 02:24 - 2017-05-16 02:24 - 00974848 _____ (Microsoft Corporation) C:\WINDOWS\system32\mmgaserver.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 00970240 _____ (Microsoft Corporation) C:\WINDOWS\system32\autochk.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 00925696 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00923040 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00909312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autochk.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 00872472 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipSVC.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00840192 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00799232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00775824 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00751104 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00750560 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 00750080 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00741784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00731136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mmgaserver.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 00722944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys 2017-05-16 02:24 - 2017-05-16 02:24 - 00716440 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00712600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys 2017-05-16 02:24 - 2017-05-16 02:24 - 00708712 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00707072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 00687104 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00681984 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00673280 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00673112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppResolver.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00667040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00663040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00651680 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 00647168 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00646656 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockHostingFramework.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00636416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00626520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 00624640 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00605936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00599576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00590848 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00585728 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIRibbonRes.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbonRes.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00583160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00559000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 00545792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv 2017-05-16 02:24 - 2017-05-16 02:24 - 00543640 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00524800 _____ (Microsoft Corporation) C:\WINDOWS\system32\TileDataRepository.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00523296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppResolver.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00510976 _____ (Microsoft Corporation) C:\WINDOWS\system32\TDLMigration.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00507392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00476672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00457728 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00450048 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcdedit.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 00433664 _____ (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00429568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv 2017-05-16 02:24 - 2017-05-16 02:24 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00416256 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 00409600 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00409504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys 2017-05-16 02:24 - 2017-05-16 02:24 - 00406528 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputSwitch.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToManager.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00388000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS 2017-05-16 02:24 - 2017-05-16 02:24 - 00387928 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpps.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00386560 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00382368 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00373760 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 00364032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00362496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00358400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00354360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00354304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputSwitch.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsDocumentTargetPrint.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00338432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00334336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wc_storage.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00329728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00328704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationObjFactory.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00314880 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsEnvironment.Desktop.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00311192 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00301056 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseAppMgmtSvc.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00296448 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudBackupSettings.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00282112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEEventDispatcher.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00280064 _____ (Microsoft Corporation) C:\WINDOWS\system32\WiFiDisplay.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00266240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00252928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsDocumentTargetPrint.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00251904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Gaming.Preview.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00233472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WiFiDisplay.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00232960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00232960 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00232448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudBackupSettings.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00224256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Streaming.ps.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.AppDefaults.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00207264 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00203776 _____ (Microsoft Corporation) C:\WINDOWS\system32\PackageStateRoaming.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PackageStateRoaming.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00164864 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseModernAppMgmtCSP.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00155136 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEStoreEventHandlers.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00142240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wcifs.sys 2017-05-16 02:24 - 2017-05-16 02:24 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00119296 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataTimeUtil.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00118784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netvsc.sys 2017-05-16 02:24 - 2017-05-16 02:24 - 00105456 _____ (Microsoft Corporation) C:\WINDOWS\system32\imagehlp.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00096256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00095584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imagehlp.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00094720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmjpegdec.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\asycfilt.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00082944 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx 2017-05-16 02:24 - 2017-05-16 02:24 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmjpegdec.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00078848 _____ (Microsoft Corporation) C:\WINDOWS\system32\offreg.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00078336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\asycfilt.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00072192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx 2017-05-16 02:24 - 2017-05-16 02:24 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00057856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offreg.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00056832 _____ (Microsoft Corporation) C:\WINDOWS\system32\cldapi.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00050176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cldapi.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00050176 _____ (Microsoft Corporation) C:\WINDOWS\system32\catsrvps.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00047104 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00038912 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicRender.sys 2017-05-16 02:24 - 2017-05-16 02:24 - 00032004 _____ C:\WINDOWS\system32\edgehtmlpluginpolicy.bin 2017-05-16 02:24 - 2017-05-16 02:24 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\system32\odbcconf.dll 2017-05-16 02:24 - 2017-05-16 02:24 - 00027040 _____ (Microsoft Corporation) C:\WINDOWS\system32\browser_broker.exe 2017-05-16 02:24 - 2017-05-16 02:24 - 00025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\odbcconf.dll 2017-05-16 02:18 - 2017-05-16 02:18 - 00008192 _____ C:\WINDOWS\system32\config\userdiff 2017-05-16 02:18 - 2017-05-15 14:30 - 00000000 ____D C:\WINDOWS\ServiceProfiles 2017-05-16 02:15 - 2017-05-16 02:15 - 00000000 ____D C:\WINDOWS\SysWOW64\XPSViewer 2017-05-16 02:15 - 2017-05-16 02:15 - 00000000 ____D C:\Program Files\Reference Assemblies 2017-05-16 02:15 - 2017-05-16 02:15 - 00000000 ____D C:\Program Files\MSBuild 2017-05-16 02:15 - 2017-05-16 02:15 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies 2017-05-16 02:15 - 2017-05-16 02:15 - 00000000 ____D C:\Program Files (x86)\MSBuild 2017-05-16 02:14 - 2017-02-10 23:26 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll 2017-05-16 02:14 - 2017-02-10 23:26 - 00124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll 2017-05-16 02:14 - 2017-02-10 23:26 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe 2017-05-16 02:14 - 2017-02-10 23:21 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll 2017-05-16 02:14 - 2017-02-10 23:21 - 00103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll 2017-05-16 02:14 - 2017-02-10 23:21 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe 2017-05-15 15:20 - 2017-05-15 15:20 - 00000286 __RSH C:\Users\Todos os Usuários\ntuser.pol 2017-05-15 15:20 - 2017-05-15 15:20 - 00000286 __RSH C:\ProgramData\ntuser.pol 2017-05-15 15:14 - 2017-05-15 15:17 - 00019053 _____ C:\WINDOWS\diagwrn.xml 2017-05-15 15:14 - 2017-05-15 15:17 - 00019053 _____ C:\WINDOWS\diagerr.xml 2017-05-15 15:04 - 2017-05-20 08:54 - 00004166 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{3820EE0D-4461-46E7-B051-F1299219852E} 2017-05-15 15:04 - 2017-05-20 08:46 - 00004538 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player PPAPI Notifier 2017-05-15 15:04 - 2017-05-20 08:46 - 00004458 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater 2017-05-15 15:04 - 2017-05-16 05:53 - 00004268 _____ C:\WINDOWS\System32\Tasks\Avast Emergency Update 2017-05-15 15:04 - 2017-05-15 15:05 - 00003514 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA 2017-05-15 15:04 - 2017-05-15 15:05 - 00003268 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{7B31CF36-A6AB-4C23-BDF0-4AB1EB6CE01C} 2017-05-15 15:04 - 2017-05-15 15:05 - 00002874 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1114943301-3855528572-74286459-500 2017-05-15 15:04 - 2017-05-15 15:05 - 00002276 _____ C:\WINDOWS\System32\Tasks\Driver Booster SkipUAC (rahul_000) 2017-05-15 15:04 - 2017-05-15 15:04 - 00003482 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task 2017-05-15 15:04 - 2017-05-15 15:04 - 00003354 _____ C:\WINDOWS\System32\Tasks\SafeZone scheduled Autoupdate 1455278178 2017-05-15 15:04 - 2017-05-15 15:04 - 00003290 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore 2017-05-15 15:04 - 2017-05-15 15:04 - 00002936 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1114943301-3855528572-74286459-1002 2017-05-15 15:04 - 2017-05-15 15:04 - 00002876 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1114943301-3855528572-74286459-1005 2017-05-15 15:04 - 2017-05-15 15:04 - 00002568 _____ C:\WINDOWS\System32\Tasks\ShutdownOpt 2017-05-15 15:04 - 2017-05-15 15:04 - 00002514 _____ C:\WINDOWS\System32\Tasks\advRecovery 2017-05-15 15:04 - 2017-05-15 15:04 - 00002384 _____ C:\WINDOWS\System32\Tasks\SAgent 2017-05-15 15:04 - 2017-05-15 15:04 - 00002372 _____ C:\WINDOWS\System32\Tasks\DisplayChecker 2017-05-15 15:04 - 2017-05-15 15:04 - 00002280 _____ C:\WINDOWS\System32\Tasks\RTKCPL 2017-05-15 15:04 - 2017-05-15 15:04 - 00002250 _____ C:\WINDOWS\System32\Tasks\Uninstaller_SkipUac_rahul_000 2017-05-15 15:04 - 2017-05-15 15:04 - 00002216 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC 2017-05-15 15:04 - 2017-05-15 15:04 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2017-05-15 15:04 - 2017-05-15 15:04 - 00000000 ____D C:\WINDOWS\System32\Tasks\WPD 2017-05-15 15:04 - 2017-05-15 15:04 - 00000000 ____D C:\WINDOWS\System32\Tasks\SecTimeSync 2017-05-15 15:04 - 2017-05-15 15:04 - 00000000 ____D C:\WINDOWS\System32\Tasks\GenericSettingsHandler 2017-05-15 15:04 - 2017-05-15 15:04 - 00000000 ____D C:\WINDOWS\System32\Tasks\AVAST Software 2017-05-15 15:04 - 2017-05-15 15:04 - 00000000 ____D C:\WINDOWS\System32\Tasks\Apple 2017-05-15 15:04 - 2014-09-25 07:39 - 00003596 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2320355253-2224279592-2775355289-500 2017-05-15 15:04 - 2014-09-24 18:10 - 00003594 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-712471777-2381030718-1952048931-500 2017-05-15 15:01 - 2017-05-15 15:01 - 01840896 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2017-05-15 14:57 - 2017-05-15 14:57 - 00000020 ___SH C:\Users\UpdatusUser\ntuser.ini 2017-05-15 14:54 - 2017-05-15 14:54 - 00000000 ____D C:\Users\Public\Documents\Tools 2017-05-15 14:48 - 2017-05-15 14:48 - 00001576 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2017-05-15 14:41 - 2017-05-15 14:51 - 00000000 ____D C:\WINDOWS\system32\config\bbimigrate 2017-05-15 14:41 - 2017-05-15 14:41 - 00000000 ____D C:\Users\Todos os Usuários\USOShared 2017-05-15 14:41 - 2017-05-15 14:41 - 00000000 ____D C:\ProgramData\USOShared 2017-05-15 14:36 - 2017-05-17 01:50 - 00000000 ____D C:\Users\rahul_000 2017-05-15 14:36 - 2017-05-15 15:01 - 00000000 ____D C:\Users\UpdatusUser 2017-05-15 14:36 - 2017-05-15 15:01 - 00000000 ____D C:\Users\rober 2017-05-15 14:36 - 2017-05-15 14:58 - 00000000 ____D C:\Users\RahulCrescimento 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Modelos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Meus Documentos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Menu Iniciar 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Documents\Minhas Músicas 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Documents\Minhas Imagens 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Documents\Meus Vídeos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Dados de Aplicativos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Configurações Locais 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programas 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Local\Histórico 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Local\Dados de Aplicativos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Ambiente de Rede 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Ambiente de Impressão 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Modelos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Meus Documentos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Menu Iniciar 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Documents\Minhas Músicas 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Documents\Minhas Imagens 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Documents\Meus Vídeos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Dados de Aplicativos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Configurações Locais 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\AppData\Roaming\Microsoft\Windows\Start Menu\Programas 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\AppData\Local\Histórico 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\AppData\Local\Dados de Aplicativos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Ambiente de Rede 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Ambiente de Impressão 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Modelos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Meus Documentos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Menu Iniciar 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Documents\Minhas Músicas 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Documents\Minhas Imagens 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Documents\Meus Vídeos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Dados de Aplicativos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Configurações Locais 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\AppData\Roaming\Microsoft\Windows\Start Menu\Programas 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\AppData\Local\Histórico 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\AppData\Local\Dados de Aplicativos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Ambiente de Rede 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Ambiente de Impressão 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Modelos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Meus Documentos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Menu Iniciar 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Documents\Minhas Músicas 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Documents\Minhas Imagens 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Documents\Meus Vídeos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Dados de Aplicativos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Configurações Locais 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programas 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\AppData\Local\Histórico 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\AppData\Local\Dados de Aplicativos 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Ambiente de Rede 2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Ambiente de Impressão 2017-05-15 14:35 - 2017-05-15 14:42 - 00000000 ____D C:\Users\Todos os Usuários\NVIDIA 2017-05-15 14:35 - 2017-05-15 14:42 - 00000000 ____D C:\ProgramData\NVIDIA 2017-05-15 14:35 - 2017-05-15 14:35 - 00000000 ____D C:\Users\Todos os Usuários\NVIDIA Corporation 2017-05-15 14:35 - 2017-05-15 14:35 - 00000000 ____D C:\ProgramData\NVIDIA Corporation 2017-05-15 14:35 - 2017-05-15 14:35 - 00000000 ____D C:\Program Files\Common Files\Atheros 2017-05-15 14:35 - 2016-08-01 21:54 - 06386744 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll 2017-05-15 14:35 - 2016-08-01 21:54 - 02466360 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvc64.dll 2017-05-15 14:35 - 2016-08-01 21:54 - 01762752 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvcr.dll 2017-05-15 14:35 - 2016-08-01 21:54 - 01365048 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe 2017-05-15 14:35 - 2016-08-01 21:54 - 00547896 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshext.dll 2017-05-15 14:35 - 2016-08-01 21:54 - 00393784 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmctray.dll 2017-05-15 14:35 - 2016-08-01 21:54 - 00081856 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshextr.dll 2017-05-15 14:35 - 2016-08-01 21:54 - 00071224 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvshext.dll 2017-05-15 14:35 - 2016-07-28 22:02 - 07242545 _____ C:\WINDOWS\system32\nvcoproc.bin 2017-05-15 14:34 - 2017-05-15 14:42 - 00000000 ____D C:\Program Files\NVIDIA Corporation 2017-05-15 14:34 - 2017-05-15 14:42 - 00000000 ____D C:\Program Files\Intel 2017-05-15 14:34 - 2017-05-15 14:42 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation 2017-05-15 14:34 - 2017-03-19 05:56 - 02233344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll 2017-05-15 14:34 - 2016-02-19 03:09 - 00073360 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.DLL 2017-05-15 14:34 - 2016-02-19 03:09 - 00069776 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.DLL 2017-05-15 14:33 - 2017-05-15 14:33 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_SynTP_01011.Wdf 2017-05-15 14:33 - 2017-05-15 14:33 - 00000000 ____H C:\Users\Todos os Usuários\DP45977C.lfl 2017-05-15 14:33 - 2017-05-15 14:33 - 00000000 ____H C:\ProgramData\DP45977C.lfl 2017-05-15 14:33 - 2017-05-15 14:33 - 00000000 ____D C:\WINDOWS\SysWOW64\RTCOM 2017-05-15 14:33 - 2017-05-15 14:33 - 00000000 ____D C:\WINDOWS\system32\SRSLabs 2017-05-15 14:33 - 2017-05-15 14:33 - 00000000 ____D C:\Program Files\Realtek 2017-05-15 14:32 - 2017-05-15 14:32 - 00000000 ____D C:\Program Files\Synaptics 2017-05-15 14:30 - 2017-05-18 08:51 - 00000000 ____D C:\WINDOWS\system32\SleepStudy 2017-05-15 14:30 - 2017-05-15 14:52 - 00217384 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2017-05-15 12:35 - 2017-05-16 05:54 - 00000000 ___DC C:\WINDOWS\Panther 2017-05-15 12:35 - 2017-05-15 13:45 - 00000000 ___HD C:\$WINDOWS.~BT 2017-05-15 12:28 - 2017-05-15 12:34 - 00000036 _____ C:\WINDOWS\progress.ini 2017-05-15 10:30 - 2017-05-15 10:30 - 00000000 ____D C:\Users\rahul_000\AppData\Local\UNP 2017-05-15 10:13 - 2017-05-15 15:20 - 00000000 ___HD C:\$GetCurrent 2017-05-15 10:12 - 2017-05-16 05:54 - 00000000 ____D C:\Windows10Upgrade 2017-05-15 10:12 - 2017-05-15 10:12 - 06385872 _____ (Microsoft Corporation) C:\Users\rahul_000\Downloads\Windows10Upgrade9252.exe 2017-05-15 10:12 - 2017-05-15 10:12 - 00000751 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Assistente de Atualização do Windows 10.lnk 2017-05-15 10:12 - 2017-05-15 10:12 - 00000739 _____ C:\Users\rahul_000\Desktop\Assistente de Atualização do Windows 10.lnk 2017-05-14 20:52 - 2017-05-14 20:52 - 00187320 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMChameleon.sys 2017-05-14 20:51 - 2017-05-20 08:46 - 00093624 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys 2017-05-14 20:51 - 2017-05-15 14:54 - 00251832 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2017-05-14 20:51 - 2017-05-15 14:54 - 00113592 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys 2017-05-14 20:51 - 2017-05-15 14:54 - 00043968 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys 2017-05-14 20:51 - 2017-05-14 20:51 - 00001920 _____ C:\Users\Public\Desktop\Malwarebytes.lnk 2017-05-14 20:50 - 2017-05-15 14:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes 2017-05-14 20:50 - 2017-05-14 20:50 - 00000000 ____D C:\Users\Todos os Usuários\Malwarebytes 2017-05-14 20:50 - 2017-05-14 20:50 - 00000000 ____D C:\ProgramData\Malwarebytes 2017-05-14 20:50 - 2017-05-14 20:50 - 00000000 ____D C:\Program Files\Malwarebytes 2017-05-14 20:50 - 2017-05-09 16:37 - 00077440 _____ C:\WINDOWS\system32\Drivers\mbae64.sys 2017-05-14 20:48 - 2017-05-14 21:16 - 391760698 _____ C:\Users\rahul_000\Downloads\windows10.0-kb4013429-x64_ddc8596f88577ab739cade1d365956a74598e710.msu (1).crdownload 2017-05-14 20:45 - 2017-05-14 20:49 - 63035592 _____ (Malwarebytes ) C:\Users\rahul_000\Downloads\mb3-setup-35891.35891-3.1.2.1733.exe 2017-05-14 11:49 - 2017-05-14 11:59 - 00000000 ____D C:\WINDOWS\Microsoft Antimalware 2017-05-13 18:32 - 2017-05-13 18:32 - 08536298 _____ C:\Users\rahul_000\Downloads\4019472.csv 2017-05-13 18:31 - 2017-05-13 18:31 - 07902204 _____ C:\Users\rahul_000\Downloads\4013429.csv 2017-05-13 17:50 - 2017-05-15 14:43 - 00000000 ____D C:\WINDOWS\system32\UNP 2017-05-13 17:50 - 2017-05-13 17:51 - 00000000 ____D C:\Program Files\UNP 2017-05-13 13:27 - 2017-05-13 13:27 - 00195346 _____ C:\Users\rahul_000\Downloads\wu170509 (2).diagcab 2017-05-13 11:38 - 2017-03-28 14:37 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\DdcWnsListener.dll 2017-05-13 11:38 - 2017-03-04 15:26 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll 2017-05-13 11:38 - 2017-03-04 15:18 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll 2017-05-13 11:06 - 2017-05-13 11:11 - 36310454 _____ C:\Users\rahul_000\Downloads\windows10.0-kb4013429-x64_ddc8596f88577ab739cade1d365956a74598e710.msu.crdownload 2017-05-13 11:06 - 2017-05-13 11:06 - 00195346 _____ C:\Users\rahul_000\Downloads\wu170509.diagcab 2017-05-13 11:06 - 2017-05-13 11:06 - 00195346 _____ C:\Users\rahul_000\Downloads\wu170509 (1).diagcab 2017-05-13 10:45 - 2017-05-13 10:45 - 00158880 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswstm.sys 2017-05-07 22:09 - 2017-05-07 22:09 - 00001094 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk 2017-05-07 22:09 - 2017-05-07 22:08 - 00569192 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys 2017-05-07 22:09 - 2017-05-07 22:08 - 00339696 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys 2017-05-07 22:09 - 2017-05-07 22:08 - 00128648 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys 2017-05-07 22:09 - 2017-05-07 22:08 - 00101152 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys 2017-05-07 22:09 - 2017-05-07 22:08 - 00075704 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys 2017-05-07 22:09 - 2017-05-07 22:08 - 00038296 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys 2017-05-07 22:09 - 2017-05-07 22:07 - 01007160 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys 2017-05-07 22:09 - 2017-05-07 22:07 - 00334576 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswbloga.sys 2017-05-07 22:09 - 2017-05-07 22:07 - 00311808 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswbidsdrivera.sys 2017-05-07 22:09 - 2017-05-07 22:07 - 00190256 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswbidsha.sys 2017-05-07 22:09 - 2017-05-07 22:07 - 00049016 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswbuniva.sys 2017-05-07 22:09 - 2017-05-07 22:07 - 00032600 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswKbd.sys 2017-05-07 22:08 - 2017-05-07 22:08 - 00400456 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe 2017-04-29 22:14 - 2017-04-29 22:14 - 00000000 ____D C:\Users\rahul_000\Desktop\Rpg Maker 2017-04-29 21:42 - 2017-04-29 21:46 - 09390592 _____ (Piriform Ltd) C:\Users\rahul_000\Downloads\ccsetup529pro.exe ==================== Um Mês Modificados arquivos e pastas ======== (Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.) 2017-05-20 22:28 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\AppReadiness 2017-05-20 22:27 - 2014-12-25 22:40 - 00000000 ___RD C:\Users\rahul_000\OneDrive 2017-05-20 22:19 - 2014-09-24 14:08 - 00000000 ____D C:\Users\Todos os Usuários\WinClon 2017-05-20 22:19 - 2014-09-24 14:08 - 00000000 ____D C:\ProgramData\WinClon 2017-05-20 22:16 - 2015-12-01 23:37 - 00000000 __SHD C:\Users\rahul_000\IntelGraphicsProfiles 2017-05-20 09:43 - 2014-12-25 23:09 - 00002270 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2017-05-20 09:36 - 2014-12-25 22:49 - 00000000 ____D C:\Program Files (x86)\Opera 2017-05-20 09:34 - 2017-03-19 06:03 - 00000000 ___HD C:\Program Files\WindowsApps 2017-05-20 09:31 - 2015-06-09 04:01 - 00000000 ____D C:\Users\rahul_000\AppData\Local\Battle.net 2017-05-20 09:27 - 2017-03-04 23:23 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\vSnapshot 2017-05-20 09:08 - 2016-11-21 04:24 - 00000000 ____D C:\Program Files (x86)\Heroes of the Storm 2017-05-20 08:53 - 2015-11-28 00:58 - 00000000 ____D C:\Program Files (x86)\Battle.net 2017-05-20 08:50 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\appcompat 2017-05-20 08:45 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed 2017-05-20 08:45 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\Macromed 2017-05-20 08:43 - 2017-03-19 06:01 - 00000000 ____D C:\WINDOWS\INF 2017-05-17 01:44 - 2017-03-19 05:51 - 00000000 ____D C:\WINDOWS\CbsTemp 2017-05-17 01:37 - 2016-10-20 08:20 - 00000000 ____D C:\Users\rahul_000\AppData\Local\ConnectedDevicesPlatform 2017-05-16 06:17 - 2014-12-25 22:31 - 00000000 ____D C:\Users\rahul_000\AppData\Local\Packages 2017-05-16 05:56 - 2017-03-19 06:03 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel 2017-05-16 05:55 - 2014-11-06 00:06 - 00000000 __RHD C:\Users\Public\AccountPictures 2017-05-16 02:29 - 2017-03-19 06:03 - 00028672 _____ C:\WINDOWS\system32\config\BCD-Template 2017-05-16 02:25 - 2017-03-19 06:06 - 00000000 ____D C:\WINDOWS\Setup 2017-05-16 02:25 - 2017-03-19 06:03 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12 2017-05-16 02:25 - 2017-03-19 06:03 - 00000000 ___SD C:\WINDOWS\system32\F12 2017-05-16 02:25 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\SysWOW64\Dism 2017-05-16 02:25 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns 2017-05-16 02:25 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\appraiser 2017-05-16 02:25 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\ShellExperiences 2017-05-16 02:25 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\Provisioning 2017-05-16 02:25 - 2017-03-19 06:03 - 00000000 ____D C:\Program Files\Windows Photo Viewer 2017-05-16 02:25 - 2017-03-19 06:03 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer 2017-05-16 02:25 - 2017-03-18 20:40 - 00000000 ____D C:\WINDOWS\system32\Dism 2017-05-16 02:15 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\SysWOW64\MUI 2017-05-16 02:15 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\MUI 2017-05-16 02:15 - 2017-03-19 05:56 - 00465408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnet.dll 2017-05-16 02:15 - 2017-03-19 05:56 - 00389632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnet.dll 2017-05-16 02:15 - 2017-03-19 05:56 - 00217600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplayx.dll 2017-05-16 02:15 - 2017-03-19 05:56 - 00067584 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnathlp.dll 2017-05-16 02:15 - 2017-03-19 05:56 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnathlp.dll 2017-05-16 02:15 - 2017-03-19 05:56 - 00046592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpwsockx.dll 2017-05-16 02:15 - 2017-03-19 05:56 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnsvr.exe 2017-05-16 02:15 - 2017-03-19 05:56 - 00024576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpmodemx.dll 2017-05-16 02:15 - 2017-03-19 05:56 - 00022528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnsvr.exe 2017-05-16 02:15 - 2017-03-19 05:56 - 00020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplaysvr.exe 2017-05-16 02:15 - 2017-03-19 05:56 - 00010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhupnp.dll 2017-05-16 02:15 - 2017-03-19 05:56 - 00010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhpast.dll 2017-05-16 02:15 - 2017-03-19 05:56 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhupnp.dll 2017-05-16 02:15 - 2017-03-19 05:56 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhpast.dll 2017-05-16 02:15 - 2017-03-19 05:56 - 00006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnlobby.dll 2017-05-16 02:15 - 2017-03-19 05:56 - 00006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnaddr.dll 2017-05-16 02:15 - 2017-03-19 05:56 - 00005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnlobby.dll 2017-05-16 02:15 - 2017-03-19 05:56 - 00005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnaddr.dll 2017-05-15 15:19 - 2017-03-19 06:03 - 00000000 ____D C:\Program Files\Windows NT 2017-05-15 15:18 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\WinBioDatabase 2017-05-15 15:18 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\Registration 2017-05-15 15:18 - 2017-03-18 20:40 - 00008192 _____ C:\WINDOWS\system32\config\ELAM 2017-05-15 15:17 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\rescache 2017-05-15 15:05 - 2017-03-20 13:03 - 00000000 ____D C:\WINDOWS\HoloShell 2017-05-15 15:04 - 2015-12-01 23:31 - 00023056 _____ C:\WINDOWS\system32\emptyregdb.dat 2017-05-15 15:03 - 2016-07-16 20:47 - 00000000 ____D C:\WINDOWS\system32\Tasks_Migrated 2017-05-15 15:02 - 2017-03-19 06:03 - 00000000 __RHD C:\Users\Public\Libraries 2017-05-15 15:01 - 2017-03-20 13:00 - 00793804 _____ C:\WINDOWS\system32\prfh0416.dat 2017-05-15 15:01 - 2017-03-20 13:00 - 00156854 _____ C:\WINDOWS\system32\prfc0416.dat 2017-05-15 14:55 - 2016-04-20 23:00 - 00029816 _____ (GAS Tecnologia) C:\WINDOWS\system32\Drivers\gbpddreg64.sys 2017-05-15 14:55 - 2016-04-20 23:00 - 00028888 _____ (GAS Tecnologia) C:\WINDOWS\system32\Drivers\gbpddfac64.sys 2017-05-15 14:55 - 2016-04-20 22:59 - 00000000 ____D C:\Program Files (x86)\GbPlugin 2017-05-15 14:54 - 2017-01-11 06:40 - 00028376 _____ (GAS Tecnologia) C:\WINDOWS\system32\Drivers\wsddfac.sys 2017-05-15 14:54 - 2016-04-20 22:59 - 00000000 ____D C:\Users\Todos os Usuários\GbPlugin 2017-05-15 14:54 - 2016-04-20 22:59 - 00000000 ____D C:\ProgramData\GbPlugin 2017-05-15 14:51 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\FxsTmp 2017-05-15 14:51 - 2017-03-18 20:40 - 01048576 _____ C:\WINDOWS\system32\config\BBI 2017-05-15 14:51 - 2016-01-18 03:51 - 00000000 ____D C:\WINDOWS\SysWOW64\NV 2017-05-15 14:51 - 2016-01-18 03:51 - 00000000 ____D C:\WINDOWS\system32\NV 2017-05-15 14:43 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy 2017-05-15 14:43 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\spool 2017-05-15 14:43 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\oobe 2017-05-15 14:43 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\NDF 2017-05-15 14:43 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\InputMethod 2017-05-15 14:43 - 2016-11-12 21:05 - 00000000 ____D C:\WINDOWS\SysWOW64\Cef 2017-05-15 14:43 - 2015-12-09 09:56 - 00000000 ____D C:\WINDOWS\system32\MpEngineStore 2017-05-15 14:43 - 2015-07-02 01:21 - 00000000 __SHD C:\WINDOWS\SysWOW64\AI_RecycleBin 2017-05-15 14:43 - 2015-06-29 03:37 - 00000000 ____D C:\WINDOWS\SysWOW64\Hotspot Shield 2017-05-15 14:43 - 2014-12-31 10:07 - 00000000 ____D C:\WINDOWS\SysWOW64\GPBAK 2017-05-15 14:43 - 2014-12-28 18:29 - 00000000 ____D C:\WINDOWS\SysWOW64\vbox 2017-05-15 14:43 - 2014-12-28 18:29 - 00000000 ____D C:\WINDOWS\system32\vbox 2017-05-15 14:43 - 2014-12-28 09:41 - 00000000 ____D C:\WINDOWS\system32\MRT 2017-05-15 14:43 - 2013-08-23 00:36 - 00000000 ____D C:\WINDOWS\system32\WindowsInternal.Inbox.Shared 2017-05-15 14:43 - 2013-08-23 00:36 - 00000000 ____D C:\WINDOWS\system32\WindowsInternal.Inbox.Media.Shared 2017-05-15 14:42 - 2017-04-10 01:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2017-05-15 14:42 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\LiveKernelReports 2017-05-15 14:42 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\InputMethod 2017-05-15 14:42 - 2017-03-19 06:03 - 00000000 ____D C:\Users\Todos os Usuários\regid.1991-06.com.microsoft 2017-05-15 14:42 - 2017-03-19 06:03 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft 2017-05-15 14:42 - 2017-03-19 06:03 - 00000000 ____D C:\Program Files\Common Files\microsoft shared 2017-05-15 14:42 - 2017-03-05 03:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2017-05-15 14:42 - 2017-01-23 08:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft II 2017-05-15 14:42 - 2016-12-03 08:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime 2017-05-15 14:42 - 2016-11-19 18:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Overwatch 2017-05-15 14:42 - 2016-10-25 23:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends 2017-05-15 14:42 - 2016-10-03 08:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Speccy 2017-05-15 14:42 - 2016-06-05 19:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2017-05-15 14:42 - 2016-04-03 08:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ferramentas do Microsoft Office 2016 2017-05-15 14:42 - 2016-03-26 11:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Visual Studio Code 2017-05-15 14:42 - 2016-02-05 09:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ChessBase 2017-05-15 14:42 - 2015-12-23 10:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RPG Maker MV 2017-05-15 14:42 - 2015-12-23 06:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN 2017-05-15 14:42 - 2015-11-16 07:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotspot Shield 2017-05-15 14:42 - 2015-10-13 08:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SQUARE ENIX 2017-05-15 14:42 - 2015-09-26 10:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer 2017-05-15 14:42 - 2015-09-05 11:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone 2017-05-15 14:42 - 2015-07-10 01:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Synthesia 2017-05-15 14:42 - 2015-07-05 06:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software 2017-05-15 14:42 - 2015-07-02 01:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Soluto 2017-05-15 14:42 - 2015-06-27 22:05 - 00000000 ____D C:\Users\Todos os Usuários\regid.1986-12.com.adobe 2017-05-15 14:42 - 2015-06-27 22:05 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe 2017-05-15 14:42 - 2015-06-09 10:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft 2017-05-15 14:42 - 2015-06-09 04:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net 2017-05-15 14:42 - 2015-05-26 10:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iExplorer 2017-05-15 14:42 - 2015-05-06 04:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus 2017-05-15 14:42 - 2015-02-21 23:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RPG Maker VX Ace 2017-05-15 14:42 - 2014-12-28 18:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR 2017-05-15 14:42 - 2014-12-28 01:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2017-05-15 14:42 - 2014-12-26 23:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam 2017-05-15 14:42 - 2014-12-26 07:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NEXON 2017-05-15 14:42 - 2014-09-24 13:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung 2017-05-15 14:42 - 2014-09-24 13:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitcasa 2017-05-15 14:41 - 2017-03-19 06:03 - 00000000 ____D C:\Users\Todos os Usuários\USOPrivate 2017-05-15 14:41 - 2017-03-19 06:03 - 00000000 ____D C:\ProgramData\USOPrivate 2017-05-15 14:41 - 2013-08-23 00:36 - 00000000 ___HD C:\WINDOWS\system32\GroupPolicy 2017-05-15 14:40 - 2016-04-20 22:49 - 00000000 ____D C:\Users\rober\AppData\Local\Packages 2017-05-15 14:39 - 2016-05-18 10:43 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.5 2017-05-15 14:39 - 2015-12-01 02:48 - 00000000 ___RD C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices 2017-05-15 14:39 - 2015-11-16 07:33 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nexon 2017-05-15 14:39 - 2015-07-15 10:37 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client 2017-05-15 14:39 - 2015-07-12 06:07 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam 2017-05-15 14:39 - 2014-12-28 18:42 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Level Up! Games 2017-05-15 14:39 - 2014-12-28 18:32 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR 2017-05-15 14:39 - 2014-12-28 09:33 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Level Up! Gerenciador 2017-05-15 14:38 - 2015-06-07 02:11 - 00000000 ___RD C:\Users\RahulCrescimento\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices 2017-05-15 14:38 - 2015-05-19 23:10 - 00000000 ____D C:\Users\RahulCrescimento\AppData\Local\Packages 2017-05-15 14:35 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\Help 2017-05-15 14:35 - 2017-03-18 20:40 - 00000000 ____D C:\WINDOWS\system32\Sysprep 2017-05-15 14:35 - 2015-01-16 00:06 - 00000000 ____D C:\temp 2017-05-15 09:51 - 2014-12-26 23:12 - 00000000 ____D C:\Program Files (x86)\Steam 2017-05-15 09:48 - 2016-06-05 19:22 - 00000000 ____D C:\Program Files\CCleaner 2017-05-14 21:10 - 2014-12-30 03:37 - 00000000 ____D C:\Users\Todos os Usuários\Browser 2017-05-14 21:10 - 2014-12-30 03:37 - 00000000 ____D C:\ProgramData\Browser 2017-05-13 18:00 - 2014-12-28 18:29 - 00532136 _____ (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe 2017-05-13 11:45 - 2014-12-28 09:41 - 156335152 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2017-05-13 11:04 - 2015-01-10 05:30 - 00000000 ____D C:\Users\Todos os Usuários\Skype 2017-05-13 11:04 - 2015-01-10 05:30 - 00000000 ____D C:\ProgramData\Skype 2017-05-13 11:03 - 2017-04-10 01:30 - 00000000 ___RD C:\Program Files (x86)\Skype 2017-05-13 10:06 - 2015-06-29 03:34 - 00000000 ____D C:\Users\rahul_000\AppData\Local\ElevatedDiagnostics 2017-05-06 08:56 - 2016-02-01 10:27 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\Bioshock2Steam 2017-05-03 07:00 - 2014-09-24 14:17 - 00000000 ____D C:\Program Files (x86)\Microsoft Office 2017-04-29 22:56 - 2015-07-12 05:57 - 00000000 ____D C:\Users\rahul_000\AppData\Local\Steam 2017-04-29 22:11 - 2015-12-23 06:34 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\vlc 2017-04-29 22:10 - 2015-10-07 03:46 - 00000000 ____D C:\Users\rahul_000\Desktop\Old 2017-04-29 21:47 - 2016-06-05 19:22 - 00000865 _____ C:\Users\Public\Desktop\CCleaner.lnk 2017-04-29 05:29 - 2017-01-12 10:07 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\Curse Client 2017-04-28 10:30 - 2015-06-09 04:09 - 00000000 ____D C:\Program Files (x86)\World of Warcraft 2017-04-28 09:02 - 2017-01-23 07:45 - 00000000 ____D C:\Program Files (x86)\StarCraft II 2017-04-24 09:30 - 2015-09-05 11:09 - 00000000 ____D C:\Program Files (x86)\Hearthstone ==================== Arquivos na raiz de alguns diretórios ======= 2017-05-15 14:33 - 2017-05-15 14:33 - 0000000 ____H () C:\ProgramData\DP45977C.lfl 2014-09-24 14:02 - 2013-02-19 16:34 - 2064264 _____ (Samsung Electronics) C:\ProgramData\MakeMarkerFile.exe 2014-09-24 14:02 - 2013-01-12 23:51 - 0003004 _____ () C:\ProgramData\MakeMarkerFile.xml 2015-07-02 01:21 - 2015-07-02 01:21 - 0000098 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc 2016-06-12 08:18 - 2016-06-12 08:18 - 0000016 _____ () C:\ProgramData\mntemp Arquivos para serem movidos ou deletados: ==================== C:\Users\rahul_000\Setup.exe ==================== Bamital & volsnap ====================== (Não há correção automática para arquivos que não passaram na verificação.) C:\WINDOWS\system32\winlogon.exe => O arquivo é assinado digitalmente C:\WINDOWS\system32\wininit.exe => O arquivo é assinado digitalmente C:\WINDOWS\explorer.exe => O arquivo é assinado digitalmente C:\WINDOWS\SysWOW64\explorer.exe => O arquivo é assinado digitalmente C:\WINDOWS\system32\svchost.exe => O arquivo é assinado digitalmente C:\WINDOWS\SysWOW64\svchost.exe => O arquivo é assinado digitalmente C:\WINDOWS\system32\services.exe => O arquivo é assinado digitalmente C:\WINDOWS\system32\User32.dll => O arquivo é assinado digitalmente C:\WINDOWS\SysWOW64\User32.dll => O arquivo é assinado digitalmente C:\WINDOWS\system32\userinit.exe => O arquivo é assinado digitalmente C:\WINDOWS\SysWOW64\userinit.exe => O arquivo é assinado digitalmente C:\WINDOWS\system32\rpcss.dll => O arquivo é assinado digitalmente C:\WINDOWS\system32\dnsapi.dll => O arquivo é assinado digitalmente C:\WINDOWS\SysWOW64\dnsapi.dll => O arquivo é assinado digitalmente C:\WINDOWS\system32\Drivers\volsnap.sys => O arquivo é assinado digitalmente LastRegBack: 2017-05-15 14:30 ==================== Fim de FRST.txt ============================ MBlog.txt Addition.txt -
[Security] Website blocked keeps popping up
Blanknight replied to Blanknight's topic in Resolved Malware Removal Logs
Yes, that is correct. I'm currently based in Brazil. Any suggestions on how to change it? I can't seem to change the display language, Windows 10 is not helping on that regard. If nothing is possible, should I just do a clean install of Windows? -
[Security] Website blocked keeps popping up
Blanknight replied to Blanknight's topic in Resolved Malware Removal Logs
I seem to have a problem. The FarBar Recovery Scan Tool is making the logs in portuguese, not in english. How do I change? I downloading right now the update to change the language of my system, but will that change FRST language? -
Hello, MalwareBytes keeps blocking a website called "rtp.vscreenshot.com". The IP and ports use always change each time. I ran a threat scan with MalwareBytes and found nothing, but on the basis of it, the problem is a file called "vSnapshot.exe" on Program Files(x86). I'm afraid it is a rootkit/spyware. If that's the case how should I proceed? Edit : I'm currently offline on my computer, and the pop-ups stopped. If I go online again, they start again. Edit 2 : I ran HitmanPro as well and it found nothing.