[Security] Website blocked keeps popping up

[Blanknight]

Hello, 

MalwareBytes keeps blocking a website called "rtp.vscreenshot.com". The IP and ports use always change each time.

 

I ran a threat scan with MalwareBytes and found nothing, but on the basis of it, the problem is a file called "vSnapshot.exe" on Program Files(x86).

I'm afraid it is a rootkit/spyware. If that's the case how should I proceed?

 

Edit : I'm currently offline on my computer, and the pop-ups stopped. If I go online again, they start again.

Edit 2 : I ran HitmanPro as well and it found nothing.

Edited May 20, 2017 by Blanknight

[kevinf80]

Hello Blanknight and welcome to Malwarebytes, My screen name is kevinf80, i`m here to help clean up your system. Make sure to run all scans from accounts with Administrator status, continue as follows please: Anyone other than the original starter of this thread please DO NOT follow the instructions and advice posted as replies here, my help and advice is NOT related to your system and will probably cause more harm than good... Change the download folder setting in the Default Browser only. so all of the tools we may use are saved to the Desktop: Google Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser. Choose Settings. at the bottom of the screen click the "Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK. Mozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser. Choose Options. In the downloads section, click the Browse button, click on the Desktop folder and the click the "Select Folder" button. Click OK to get out of the Options menu. Internet Explorer - Click the Tools menu in the upper right-corner of the browser. Select View downloads. Select the Options link in the lower left of the window. Click Browse and select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen. NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop. Change default download folder location in Edge -Boot to a user account with admin status, select start > file explorer > right click on "Downloads" folder and select "Properties" In the new window select "Location" tab > clear the text field box and type in or copy/paste %userprofile%\Desktop > select "Apply" then "OK" Be aware you are not changing the Browser download folder location, you are changing the user’s download directory location..... Next, Follow the instructions in the following link to show hidden files: http://www.howtogeek.com/howto/windows-vista/show-hidden-files-and-folders-in-windows-vista/ Next, Download Farbar Recovery Scan Tool and save it to your desktop. Alternative download option: http://www.techspot.com/downloads/6731-farbar-recovery-scan-tool.html Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way... Be aware FRST must be run from an account with Administrator status...   Double-click to run it. When the tool opens click Yes to disclaimer.(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.) Make sure Addition.txt is checkmarked under "Optional scans" Press Scan button to run the tool.... It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply. The tool will also make a log named (Addition.txt) Please attach that log to your reply. Next, Open Malwarebytes, select > Reports > then checkmark (tick) most recent "Website Block" entry > then select "View Report" > "Export" > Text File (*.txt) name and save that file to Desktop or somewhere of your choice, attach the last 3 to your reply... Let me see those logs... Thank you, Kevin..

[Blanknight]

I seem to have a problem. The FarBar Recovery Scan Tool is making the logs in portuguese, not in english. How do I change? I downloading right now the update to change the language of my system, but will that change FRST language?

[kevinf80]

Not sure why that should happen, is the native language Portuguese where you are based..?

[Blanknight]

Yes, that is correct. I'm currently based in Brazil. Any suggestions on how to change it? I can't seem to change the display language, Windows 10 is not helping on that regard.

 

If nothing is possible, should I just do a clean install of Windows?

[kevinf80]

Just post the logs in Portuguese, i`m sure we`ll be ok with Google translator..

[Blanknight]

You are a good guy. I like you. Sorry for the incovenience...

 

Here they are :

Resultado do exame da Farbar Recovery Scan Tool (FRST) (x64) Versão: 20-05-2017
Executado por rahul_000 (administrador) em SYNC (20-05-2017 22:29:58)
Executando a partir de C:\Users\rahul_000\Desktop
Perfis Carregados: UpdatusUser & rahul_000 & RahulCrescimento & rober (Perfis Disponíveis: UpdatusUser & rahul_000 & RahulCrescimento & rober)
Platform: Windows 10 Home Single Language Versão 1703 (X64) Idioma: Português (Brasil)
Internet Explorer Versão 11 (Navegador padrão: Chrome)
Modo da Inicialização: Normal
Tutorial da Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processos (Whitelisted) =================

(Se uma entrada for incluída na fixlist, o processo será fechado. O arquivo não será movido.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(Soluto) C:\Program Files\Soluto\SolutoLauncherService.exe
(GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Samsung Electronics CO., LTD.) C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe
() C:\Program Files (x86)\vSnapshot\1.0.0.0\vSnapshotServ.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Razer Cortex\RzKLService.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(AVAST Software s.r.o.) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
() C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\HitmanPro.exe
(GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(SAMSUNG Electronics co., LTD.) C:\ProgramData\Samsung\ShutdownEvent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Soluto) C:\Program Files\Soluto\Soluto.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.15.597.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\S Agent\CommonAgent.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Razer Cortex\main.exe
(The CefSharp Authors) C:\Program Files (x86)\Razer\Razer Cortex\Cef\CefSharp.BrowserSubprocess.exe
(Soluto) C:\Program Files\Soluto\SolutoService.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(GlavSoft LLC.) C:\Program Files\Soluto\SolutoRemoteService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgentUserBroker.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\Updates\16.0.7766.2084\OfficeClickToRun.exe

==================== Registro (Whitelisted) ====================

(Se uma entrada for incluída na fixlist, o ítem no Registro será restaurado para o padrão ou removido. O arquivo não será movido.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [629152 2017-03-19] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [14040296 2015-08-28] (Realtek Semiconductor)
HKLM\...\Run: [RtsCM] => C:\WINDOWS\RTSCM64.EXE [168152 2015-06-28] (Realtek Semiconductor Corp.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1806136 2015-12-19] (NVIDIA Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2017-01-19] (Apple Inc.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [213824 2017-05-07] (AVAST Software)
HKLM\...\Run: [Diebold - Warsaw] => C:\Program Files\Diebold\Warsaw\core.exe [954416 2017-01-19] (GAS Tecnologia LTDA)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [3146704 2017-05-09] (Malwarebytes)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [67384 2017-01-13] (Apple Inc.)
HKLM-x32\...\Run: [RazerCortex] => C:\Program Files (x86)\Razer\Razer Cortex\RazerCortex.exe [98256 2015-08-31] (Razer Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
HKLM\...\Winlogon: [Userinit] c:\windows\system32\userinit.exe,c:\program files\soluto\soluto.exe /userinit,
Winlogon\Notify\ GbPluginBb: C:\Program Files (x86)\GbPlugin\gbieh.dll [2016-06-16] (Banco do Brasil)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
HKU\S-1-5-21-1114943301-3855528572-74286459-1001\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [517120 2017-03-19] (Microsoft Corporation)
HKU\S-1-5-21-1114943301-3855528572-74286459-1002\...\Run: [DisplaySwitch] => C:\programdata\samsung\DisplaySwitch.exe [1758512 2013-12-10] (TODO: <Company name>)
HKU\S-1-5-21-1114943301-3855528572-74286459-1002\...\Run: [Akamai NetSession Interface] => C:\Users\rahul_000\AppData\Local\Akamai\netsession_win.exe [4691384 2015-09-10] (Akamai Technologies, Inc.)
HKU\S-1-5-21-1114943301-3855528572-74286459-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9532120 2017-04-11] (Piriform Ltd)
HKU\S-1-5-21-1114943301-3855528572-74286459-1005\...\Run: [DisplaySwitch] => C:\programdata\samsung\DisplaySwitch.exe [1758512 2013-12-10] (TODO: <Company name>)
HKU\S-1-5-21-1114943301-3855528572-74286459-1005\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [517120 2017-03-19] (Microsoft Corporation)
HKU\S-1-5-21-1114943301-3855528572-74286459-1007\...\Run: [DisplaySwitch] => C:\programdata\samsung\DisplaySwitch.exe [1758512 2013-12-10] (TODO: <Company name>)
HKU\S-1-5-21-1114943301-3855528572-74286459-1007\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [517120 2017-03-19] (Microsoft Corporation)
AppInit_DLLs: C:\windows\system32\nvinitx.dll => Nenhum Arquivo
AppInit_DLLs: , C:\WINDOWS\system32\nvinitx.dll => Nenhum Arquivo
SSODL: EldosMountNotificator-cbfs5 - {9668EC9F-5899-4757-82EA-237145DF9C5F} - C:\windows\system32\cbfsMntNtf5.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator-cbfs5 - {9668EC9F-5899-4757-82EA-237145DF9C5F} - C:\windows\SysWOW64\cbfsMntNtf5.dll (EldoS Corporation)
ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\PROGRAM FILES (X86)\GbPlugin\gbieh.dll [1947872 2016-06-16] (Banco do Brasil)
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-05-07] (AVAST Software)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2017-05-07] (AVAST Software)
ShellIconOverlayIdentifiers: [1EldosIconOverlay-cbfs5] -> {66F3BB48-A328-41F2-8885-B4843E8114A8} => C:\windows\system32\cbfsMntNtf5.dll [2014-03-06] (EldoS Corporation)
ShellIconOverlayIdentifiers: [2EldosIconOverlay-cbfs5] -> {12E9C010-F44D-477F-BB6A-EF6827E4054E} => C:\windows\system32\cbfsMntNtf5.dll [2014-03-06] (EldoS Corporation)
ShellIconOverlayIdentifiers: [BitcasaBadFileOverlay] -> {EC168C82-5053-422A-BB08-3CD9ACA22E85} => C:\Program Files\Bitcasa\ExplorerMenu.dll [2014-04-24] ()
ShellIconOverlayIdentifiers: [BitcasaIconOverlay] -> {A6975448-A999-49BB-B3E4-7730CF6A82C0} => C:\Program Files\Bitcasa\ExplorerMenu.dll [2014-04-24] ()
ShellIconOverlayIdentifiers: [BitcasaMirrorOverlay] -> {8C403C00-4544-4A53-879B-1949390CDE13} => C:\Program Files\Bitcasa\ExplorerMenu.dll [2014-04-24] ()
ShellIconOverlayIdentifiers: [BitcasaNotMirrored] -> {775CDDED-E6D2-4DD8-8C1F-158BEF44B62A} => C:\Program Files\Bitcasa\ExplorerMenu.dll [2014-04-24] ()
ShellIconOverlayIdentifiers: [BitcasaProgressOverlay] -> {6FB8D52A-0064-45B2-B687-F596FEAD09C2} => C:\Program Files\Bitcasa\ExplorerMenu.dll [2014-04-24] ()
ShellIconOverlayIdentifiers: [EldosIconOverlay-cbfs5] -> {E47A726D-C20B-468E-8C39-30A3D9C602D7} => C:\windows\system32\cbfsMntNtf5.dll [2014-03-06] (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: [1EldosIconOverlay-cbfs5] -> {66F3BB48-A328-41F2-8885-B4843E8114A8} => C:\windows\SysWOW64\cbfsMntNtf5.dll [2014-03-06] (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: [2EldosIconOverlay-cbfs5] -> {12E9C010-F44D-477F-BB6A-EF6827E4054E} => C:\windows\SysWOW64\cbfsMntNtf5.dll [2014-03-06] (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: [EldosIconOverlay-cbfs5] -> {E47A726D-C20B-468E-8C39-30A3D9C602D7} => C:\windows\SysWOW64\cbfsMntNtf5.dll [2014-03-06] (EldoS Corporation)
Startup: C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nexon Launcher.lnk [2017-04-10]
ShortcutTarget: Nexon Launcher.lnk -> C:\Program Files (x86)\NEXON\Nexon Launcher\nexon_launcher.exe ()
CHR HKLM\SOFTWARE\Policies\Google: Restrição <======= ATENÇÃO

==================== Internet (Whitelisted) ====================

(Se um ítem for incluído na fixlist, sendo um ítem do Registro, será removido ou restaurado para o padrão.)

Tcpip\Parameters: [DhcpNameServer] 187.123.92.39 187.123.92.41
Tcpip\..\Interfaces\{04a777d4-1840-45a8-9147-51f2f4ded75a}: [DhcpNameServer] 187.123.92.39 187.123.92.41
Tcpip\..\Interfaces\{2fa42369-3f9e-41da-bb45-7e31e1b0832d}: [DhcpNameServer] 8.8.8.8

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://br.hao123.com/?tn=sdkw_inner_hp_09_hao123_br&guid=9f1c1506112b08bc455e8ac5b916a238
HKU\S-1-5-21-1114943301-3855528572-74286459-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung13.msn.com/?pc=smjb
HKU\S-1-5-21-1114943301-3855528572-74286459-1005\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://samsung13.msn.com/?pc=smjb
HKU\S-1-5-21-1114943301-3855528572-74286459-1005\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung13.msn.com/?pc=smjb
HKU\S-1-5-21-1114943301-3855528572-74286459-1007\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://samsung13.msn.com/?pc=smjb
SearchScopes: HKU\S-1-5-21-1114943301-3855528572-74286459-1002 -> DefaultScope {4F38063C-1A55-4238-B2E5-26AB46200370} URL = 
SearchScopes: HKU\S-1-5-21-1114943301-3855528572-74286459-1002 -> {4F38063C-1A55-4238-B2E5-26AB46200370} URL = 
SearchScopes: HKU\S-1-5-21-1114943301-3855528572-74286459-1005 -> DefaultScope {4F38063C-1A55-4238-B2E5-26AB46200370} URL = 
SearchScopes: HKU\S-1-5-21-1114943301-3855528572-74286459-1005 -> {4F38063C-1A55-4238-B2E5-26AB46200370} URL = 
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2017-04-03] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_121\bin\ssv.dll [2017-03-02] (Oracle Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2017-04-03] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-03-02] (Oracle Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2017-04-03] (Microsoft Corporation)
BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540000} -> C:\PROGRAM FILES (X86)\GBPLUGIN\gbieh.dll [2016-06-16] (Banco do Brasil)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2017-04-03] (Microsoft Corporation)
Handler-x32: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll [2016-01-04] (Belarc, Inc.)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-04-03] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-04-03] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-04-03] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2017-04-03] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\rahul_000\AppData\Roaming\Mozilla\Firefox\Profiles\61iwucp6.default-1491755514323 [2017-05-20]
FF Homepage: Mozilla\Firefox\Profiles\61iwucp6.default-1491755514323 -> hxxp:www.fidonav.com
FF HKU\S-1-5-21-1114943301-3855528572-74286459-1002\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: (McAfee Security Scan Plus) - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04] [não assinado]
FF HKU\S-1-5-21-1114943301-3855528572-74286459-1005\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_25_0_0_171.dll [2017-05-15] ()
FF Plugin: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-03-02] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-03-02] (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_171.dll [2017-05-15] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-17] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-17] (Intel Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2017-04-03] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2017-04-03] (Microsoft Corporation)
FF Plugin-x32: @nexon.net/NxGame -> C:\ProgramData\NexonUS\NGM\npNxGameUS.dll [2015-03-22] (Nexon)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-04-05] (Adobe Systems Inc.)

Chrome: 
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://www.google.com.br/
CHR Profile: C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default [2017-05-20]
CHR Extension: (Google Docs) - C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-22]
CHR Extension: (Google Drive) - C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-22]
CHR Extension: (YouTube) - C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]
CHR Extension: (Fire Dragon) - C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\cggmonnikkilkmkppbpjjbefmakjbcel [2015-11-18]
CHR Extension: (Google Search) - C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (Documentos Google off-line) - C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-21]
CHR Extension: (Pagamentos da Chrome Web Store) - C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-04-12]
CHR Extension: (Gmail) - C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-20]
CHR Extension: (Chrome Media Router) - C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-13]
CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <não encontrado (a)>

Opera: 
=======
OPR StartupUrls: "hxxp://br.hao123.com/?tn=sdkw_inner_hp_09_hao123_br&guid=9f1c1506112b08bc455e8ac5b916a238"
OPR Session Restore: -> está habilitado.

==================== Serviços (Whitelisted) ====================

(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7346208 2017-05-07] (AVAST Software s.r.o.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [263304 2017-05-07] (AVAST Software)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [3705536 2017-04-03] (Microsoft Corporation)
R2 GbpSv; C:\Program Files (x86)\GbPlugin\gbpsv.exe [631520 2016-06-20] (GAS Tecnologia)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [135488 2017-05-20] (SurfRight B.V.)
R2 hshld; C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe [2757752 2016-06-29] (AnchorFree Inc.)
S3 HssTrayService; C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE [103168 2016-06-29] ()
R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [329280 2016-02-19] (Intel Corporation)
S3 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [Arquivo não assinado]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
S3 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-17] (Intel Corporation)
S3 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2585376 2015-03-26] (IObit)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [188072 2015-08-15] ()
R2 RzKLService; C:\Program Files (x86)\Razer\Razer Cortex\RzKLService.exe [129168 2015-08-31] (Razer Inc.)
R2 SolutoLauncherService; C:\Program Files\Soluto\SolutoLauncherService.exe [221728 2013-12-08] (Soluto)
R3 SolutoRemoteService; C:\Program Files\Soluto\SolutoRemoteService.exe [1942016 2013-12-08] (GlavSoft LLC.) [Arquivo não assinado]
R2 SWUpdateService; C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [3196768 2015-11-06] (Samsung Electronics CO., LTD.)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [256120 2016-02-01] (Synaptics Incorporated)
R2 ThevSnapshotService; C:\Program Files (x86)\vSnapshot\1.0.0.0\vSnapshotServ.exe [152264 2016-12-24] ()
R2 Warsaw Technology; C:\Program Files\Diebold\Warsaw\core.exe [954416 2017-01-19] (GAS Tecnologia LTDA)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [342264 2017-03-19] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [102816 2017-03-19] (Microsoft Corporation)
S3 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2014-06-17] (Atheros) [Arquivo não assinado]

===================== Drivers (Whitelisted) ======================

(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)

R1 aswbidsdriver; C:\WINDOWS\system32\drivers\aswbidsdrivera.sys [311808 2017-05-07] (AVAST Software s.r.o.)
R0 aswbidsh; C:\WINDOWS\system32\drivers\aswbidsha.sys [190256 2017-05-07] (AVAST Software s.r.o.)
R0 aswblog; C:\WINDOWS\system32\drivers\aswbloga.sys [334576 2017-05-07] (AVAST Software s.r.o.)
R0 aswbuniv; C:\WINDOWS\system32\drivers\aswbuniva.sys [49016 2017-05-07] (AVAST Software s.r.o.)
S3 aswHwid; C:\WINDOWS\system32\drivers\aswHwid.sys [38296 2017-05-07] (AVAST Software)
R1 aswKbd; C:\WINDOWS\system32\drivers\aswKbd.sys [32600 2017-05-07] (AVAST Software)
R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [128648 2017-05-07] (AVAST Software)
R1 aswRdr; C:\WINDOWS\system32\drivers\aswRdr2.sys [101152 2017-05-07] (AVAST Software)
R0 aswRvrt; C:\WINDOWS\system32\drivers\aswRvrt.sys [75704 2017-05-07] (AVAST Software)
R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [1007160 2017-05-07] (AVAST Software)
R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [569192 2017-05-07] (AVAST Software)
R2 aswStm; C:\WINDOWS\system32\drivers\aswStm.sys [158880 2017-05-13] (AVAST Software)
R0 aswVmm; C:\WINDOWS\system32\drivers\aswVmm.sys [339696 2017-05-07] (AVAST Software)
R1 cbfs5; C:\windows\system32\drivers\cbfs5.sys [416960 2014-03-06] (EldoS Corporation)
R3 cpuz136; C:\WINDOWS\TEMP\cpuz136\cpuz136_x64.sys [23856 2017-05-16] (CPUID)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [77440 2017-05-09] ()
R1 gbpddfac; C:\WINDOWS\System32\drivers\gbpddfac64.sys [28888 2017-05-15] (GAS Tecnologia)
R0 gbpddreg; C:\WINDOWS\System32\drivers\gbpddreg64.sys [29816 2017-05-15] (GAS Tecnologia)
R3 GBPRCM; C:\Program Files (x86)\GbPlugin\gbprcm64.sys [29912 2015-09-22] (GAS Tecnologia)
R1 HWiNFO32; C:\windows\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-06-28] (REALiX(tm))
R2 MBAMChameleon; C:\WINDOWS\system32\drivers\MBAMChameleon.sys [187320 2017-05-14] (Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\system32\drivers\farflt.sys [113592 2017-05-15] (Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\drivers\mbam.sys [43968 2017-05-15] (Malwarebytes)
R0 MBAMSwissArmy; C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys [251832 2017-05-15] (Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\drivers\mwac.sys [93624 2017-05-20] (Malwarebytes)
R1 MpKsl983d8c65; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{1B7E818A-197D-4748-B952-C07F6576E13A}\MpKsl983d8c65.sys [44928 2017-05-20] (Microsoft Corporation)
R3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nvsmwu.inf_amd64_be58e4780959fe55\nvlddmkm.sys [13754936 2016-09-12] (NVIDIA Corporation)
R3 RadioHIDMini; C:\WINDOWS\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows (R) Win 7 DDK provider)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [604160 2017-03-19] (Realtek                                            )
R3 rtsuvc; C:\WINDOWS\system32\DRIVERS\rtsuvc.sys [2599128 2015-06-28] (Realtek Semiconductor Corp.)
R2 rzpmgrk; C:\windows\system32\drivers\rzpmgrk.sys [37184 2015-06-13] (Razer, Inc.)
S3 SDFRd; C:\WINDOWS\System32\drivers\SDFRd.sys [31128 2017-03-19] ()
R3 taphss6; C:\WINDOWS\System32\drivers\taphss6.sys [42184 2014-05-17] (Anchorfree Inc.)
S3 USBAAPL64; C:\WINDOWS\System32\Drivers\usbaapl64.sys [54784 2015-06-17] (Apple, Inc.) [Arquivo não assinado]
R3 Warsaw_PP; C:\Program Files (x86)\GbPlugin\wsftprp64.sys [24792 2015-09-22] (GAS Tecnologia LTDA)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44632 2017-03-19] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [294816 2017-03-19] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [121248 2017-03-19] (Microsoft Corporation)
R1 wsddfac; C:\WINDOWS\System32\drivers\wsddfac.sys [28376 2017-05-15] (GAS Tecnologia)
R1 wsddntf; C:\WINDOWS\system32\DRIVERS\wsddntf.sys [47176 2016-11-12] (GAS Tecnologia)
R1 wsddpp; C:\WINDOWS\system32\drivers\wsddpp.sys [25184 2016-11-12] (GAS Tecnologia)
R3 wsddprm; C:\WINDOWS\system32\drivers\wsddprm.sys [25184 2016-11-12] (GAS Tecnologia)
S3 xhunter1; C:\WINDOWS\xhunter1.sys [36808 2016-07-28] (Wellbia.com Co., Ltd.)

==================== NetSvcs (Whitelisted) ===================

(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)

==================== Um Mês Criados arquivos e pastas ========

(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)

2017-05-20 22:29 - 2017-05-20 22:30 - 00028809 _____ C:\Users\rahul_000\Desktop\FRST.txt
2017-05-20 22:29 - 2017-05-20 22:29 - 00000000 ____D C:\FRST
2017-05-20 22:28 - 2017-05-20 22:28 - 02429952 _____ (Farbar) C:\Users\rahul_000\Desktop\FRST64.exe
2017-05-20 22:27 - 2017-05-20 22:27 - 00000000 ___HD C:\OneDriveTemp
2017-05-20 09:36 - 2017-05-20 09:36 - 00003954 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1419515478
2017-05-20 09:36 - 2017-05-20 09:36 - 00001120 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2017-05-20 09:14 - 2017-05-20 09:14 - 00001962 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2017-05-20 09:14 - 2017-05-20 09:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2017-05-20 09:14 - 2017-05-20 09:14 - 00000000 ____D C:\Program Files\HitmanPro
2017-05-20 09:13 - 2017-05-20 09:48 - 00000000 ____D C:\Users\Todos os Usuários\HitmanPro
2017-05-20 09:13 - 2017-05-20 09:48 - 00000000 ____D C:\ProgramData\HitmanPro
2017-05-20 09:02 - 2017-05-20 09:08 - 11584088 _____ (SurfRight B.V.) C:\Users\rahul_000\Downloads\hitmanpro_x64.exe
2017-05-18 07:30 - 2017-05-18 07:36 - 00001171 _____ C:\Users\Public\Desktop\Warcraft III - The Frozen Throne.lnk
2017-05-18 06:27 - 2017-05-18 07:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Warcraft III
2017-05-18 06:27 - 2017-05-18 07:36 - 00000000 ____D C:\Program Files (x86)\Warcraft III
2017-05-18 06:27 - 2017-05-18 06:33 - 00001126 _____ C:\Users\Public\Desktop\Warcraft III.lnk
2017-05-17 01:50 - 2017-05-17 01:50 - 00000000 ____D C:\Users\rahul_000\AppData\Local\DBG
2017-05-16 06:02 - 2017-05-16 06:02 - 00003276 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2
2017-05-16 06:02 - 2017-05-16 06:02 - 00002415 _____ C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-05-16 05:58 - 2017-05-16 05:58 - 00000000 ____D C:\Users\Todos os Usuários\Microsoft OneDrive
2017-05-16 05:58 - 2017-05-16 05:58 - 00000000 ____D C:\ProgramData\Microsoft OneDrive
2017-05-16 05:54 - 2017-05-16 05:54 - 00000451 _____ C:\WINDOWS\system32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat
2017-05-16 05:53 - 2017-05-16 05:53 - 00000020 ___SH C:\Users\rahul_000\ntuser.ini
2017-05-16 02:25 - 2017-05-16 02:25 - 00000000 ____D C:\Windows.old
2017-05-16 02:24 - 2017-05-16 02:24 - 23681024 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 23677440 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 21353200 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 20505600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 20374424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 19335168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 12787200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 11870208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 08320920 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 08244736 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 07931392 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 07904784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 06759512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 06728192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 06292992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 05557760 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 05477088 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneCoreUAPCommonProxyStub.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 05225984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 04848440 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 04730368 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 04559360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 04469832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 04446208 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers_nt.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 04396032 _____ (Microsoft Corporation) C:\WINDOWS\system32\D3DCompiler_47.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 04175872 _____ (Microsoft Corporation) C:\WINDOWS\system32\StartTileData.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 03672064 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2017-05-16 02:24 - 2017-05-16 02:24 - 03667456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\D3DCompiler_47.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 03655680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 03307008 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 03116184 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 02969880 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreUIComponents.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 02957824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2017-05-16 02:24 - 2017-05-16 02:24 - 02859520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 02800128 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 02765824 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Shell.UnifiedTile.CuratedTileCollections.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 02651648 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 02635336 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 02499584 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.pcshell.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 02444192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2017-05-16 02:24 - 2017-05-16 02:24 - 02443776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 02435584 _____ (Microsoft Corporation) C:\WINDOWS\system32\ResetEngine.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 02399728 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 02330520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 02298880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 02259760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreUIComponents.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 02158544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 02085280 _____ (Microsoft Corporation) C:\WINDOWS\system32\UpdateAgent.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 02077184 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2017-05-16 02:24 - 2017-05-16 02:24 - 02056192 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2017-05-16 02:24 - 2017-05-16 02:24 - 02008576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2017-05-16 02:24 - 2017-05-16 02:24 - 01886208 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01878016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AzureSettingSyncProvider.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01852776 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01839872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01803264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01760264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01657344 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsPrint.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01628160 _____ (Microsoft Corporation) C:\WINDOWS\system32\comsvcs.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01626624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01611776 _____ (Microsoft Corporation) C:\WINDOWS\system32\SpeechPal.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01605632 _____ (Microsoft Corporation) C:\WINDOWS\system32\quartz.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01604312 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01600512 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01583616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01557288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01518088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01506816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\quartz.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01468416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01463296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01433600 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.Handlers.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01411128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01356800 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01325456 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01320352 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpx.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01302528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVPXENC.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01295872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01293824 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01291776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVPXENC.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01285120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01269760 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01260544 _____ (Microsoft Corporation) C:\WINDOWS\system32\GamePanel.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 01257472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01248768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AzureSettingSyncProvider.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01242624 _____ (Microsoft Corporation) C:\WINDOWS\system32\SharedStartModel.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01147296 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 01103872 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01087488 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01085440 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01075712 _____ (Microsoft Corporation) C:\WINDOWS\system32\StoreAgent.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01060352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsPrint.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01054208 _____ (Microsoft Corporation) C:\WINDOWS\system32\TokenBroker.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01051648 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01027584 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 01024416 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 01019904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00988168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00987648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00985600 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00980992 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys
2017-05-16 02:24 - 2017-05-16 02:24 - 00974848 _____ (Microsoft Corporation) C:\WINDOWS\system32\mmgaserver.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 00970240 _____ (Microsoft Corporation) C:\WINDOWS\system32\autochk.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 00925696 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpcWebFilter.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00923040 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00909312 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\autochk.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 00872472 _____ (Microsoft Corporation) C:\WINDOWS\system32\ClipSVC.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00864256 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationController.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00840192 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\StoreAgent.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00805888 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00799232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TokenBroker.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00790528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00775824 _____ (Microsoft Corporation) C:\WINDOWS\system32\oleaut32.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00751104 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00750560 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 00750080 _____ (Microsoft Corporation) C:\WINDOWS\system32\StorSvc.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00741784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Internal.Shell.Broker.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00731136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mmgaserver.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 00722944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2017-05-16 02:24 - 2017-05-16 02:24 - 00716440 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00712600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2017-05-16 02:24 - 2017-05-16 02:24 - 00708712 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00707072 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 00687104 _____ (Microsoft Corporation) C:\WINDOWS\system32\LogonController.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00681984 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00673280 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockAppBroker.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00673112 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppResolver.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00667040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00663040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00651680 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 00647168 _____ (Microsoft Corporation) C:\WINDOWS\system32\RDXService.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00646656 _____ (Microsoft Corporation) C:\WINDOWS\system32\LockHostingFramework.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00636416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WpcWebFilter.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00626520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 00624640 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00605936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\oleaut32.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00599576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00590848 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00585728 _____ (Microsoft Corporation) C:\WINDOWS\system32\OneDriveSettingSyncProvider.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIRibbonRes.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIRibbonRes.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00583160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00559000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 00545792 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2017-05-16 02:24 - 2017-05-16 02:24 - 00543640 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadcloudap.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00524800 _____ (Microsoft Corporation) C:\WINDOWS\system32\TileDataRepository.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00523296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppResolver.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00517632 _____ (Microsoft Corporation) C:\WINDOWS\system32\daxexec.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00510976 _____ (Microsoft Corporation) C:\WINDOWS\system32\TDLMigration.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00507392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00476672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\OneDriveSettingSyncProvider.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00457728 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00450048 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcdedit.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 00433664 _____ (Microsoft Corporation) C:\WINDOWS\system32\msIso.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00429568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2017-05-16 02:24 - 2017-05-16 02:24 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\WpAXHolder.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00416256 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgentUserBroker.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 00409600 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00409504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2017-05-16 02:24 - 2017-05-16 02:24 - 00406528 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputSwitch.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00392704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PlayToManager.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00388000 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2017-05-16 02:24 - 2017-05-16 02:24 - 00387928 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpps.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00386560 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00382368 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00373760 _____ (Microsoft Corporation) C:\WINDOWS\system32\InstallAgent.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgentUserBroker.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 00364032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00362496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\daxexec.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00358400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00354360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00354304 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputSwitch.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00347136 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsDocumentTargetPrint.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00338432 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00334336 _____ (Microsoft Corporation) C:\WINDOWS\system32\wc_storage.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00329728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00328704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InstallAgent.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\NotificationObjFactory.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00314880 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsEnvironment.Desktop.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00311192 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00301056 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseAppMgmtSvc.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00296448 _____ (Microsoft Corporation) C:\WINDOWS\system32\CloudBackupSettings.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00282112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VEEventDispatcher.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00280064 _____ (Microsoft Corporation) C:\WINDOWS\system32\WiFiDisplay.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00274944 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00266240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00257024 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00252928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsDocumentTargetPrint.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00251904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Gaming.Preview.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\domgmt.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00233472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WiFiDisplay.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00232960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00232960 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00232448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CloudBackupSettings.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00224256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Streaming.ps.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.AppDefaults.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00207264 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00203776 _____ (Microsoft Corporation) C:\WINDOWS\system32\PackageStateRoaming.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00175616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PackageStateRoaming.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00164864 _____ (Microsoft Corporation) C:\WINDOWS\system32\EnterpriseModernAppMgmtCSP.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00155136 _____ (Microsoft Corporation) C:\WINDOWS\system32\VEStoreEventHandlers.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00142240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wcifs.sys
2017-05-16 02:24 - 2017-05-16 02:24 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00119296 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataTimeUtil.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00118784 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netvsc.sys
2017-05-16 02:24 - 2017-05-16 02:24 - 00105456 _____ (Microsoft Corporation) C:\WINDOWS\system32\imagehlp.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00096256 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00095584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\imagehlp.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00094720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmjpegdec.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00089088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00087552 _____ (Microsoft Corporation) C:\WINDOWS\system32\asycfilt.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00084992 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00082944 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx
2017-05-16 02:24 - 2017-05-16 02:24 - 00081408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmjpegdec.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00080384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00078848 _____ (Microsoft Corporation) C:\WINDOWS\system32\offreg.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00078336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\asycfilt.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00072192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx
2017-05-16 02:24 - 2017-05-16 02:24 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00057856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\offreg.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00056832 _____ (Microsoft Corporation) C:\WINDOWS\system32\cldapi.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00052736 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00050176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cldapi.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00050176 _____ (Microsoft Corporation) C:\WINDOWS\system32\catsrvps.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00047104 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00038912 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicRender.sys
2017-05-16 02:24 - 2017-05-16 02:24 - 00032004 _____ C:\WINDOWS\system32\edgehtmlpluginpolicy.bin
2017-05-16 02:24 - 2017-05-16 02:24 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\system32\odbcconf.dll
2017-05-16 02:24 - 2017-05-16 02:24 - 00027040 _____ (Microsoft Corporation) C:\WINDOWS\system32\browser_broker.exe
2017-05-16 02:24 - 2017-05-16 02:24 - 00025088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\odbcconf.dll
2017-05-16 02:18 - 2017-05-16 02:18 - 00008192 _____ C:\WINDOWS\system32\config\userdiff
2017-05-16 02:18 - 2017-05-15 14:30 - 00000000 ____D C:\WINDOWS\ServiceProfiles
2017-05-16 02:15 - 2017-05-16 02:15 - 00000000 ____D C:\WINDOWS\SysWOW64\XPSViewer
2017-05-16 02:15 - 2017-05-16 02:15 - 00000000 ____D C:\Program Files\Reference Assemblies
2017-05-16 02:15 - 2017-05-16 02:15 - 00000000 ____D C:\Program Files\MSBuild
2017-05-16 02:15 - 2017-05-16 02:15 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2017-05-16 02:15 - 2017-05-16 02:15 - 00000000 ____D C:\Program Files (x86)\MSBuild
2017-05-16 02:14 - 2017-02-10 23:26 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2017-05-16 02:14 - 2017-02-10 23:26 - 00124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2017-05-16 02:14 - 2017-02-10 23:26 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2017-05-16 02:14 - 2017-02-10 23:21 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2017-05-16 02:14 - 2017-02-10 23:21 - 00103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2017-05-16 02:14 - 2017-02-10 23:21 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2017-05-15 15:20 - 2017-05-15 15:20 - 00000286 __RSH C:\Users\Todos os Usuários\ntuser.pol
2017-05-15 15:20 - 2017-05-15 15:20 - 00000286 __RSH C:\ProgramData\ntuser.pol
2017-05-15 15:14 - 2017-05-15 15:17 - 00019053 _____ C:\WINDOWS\diagwrn.xml
2017-05-15 15:14 - 2017-05-15 15:17 - 00019053 _____ C:\WINDOWS\diagerr.xml
2017-05-15 15:04 - 2017-05-20 08:54 - 00004166 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{3820EE0D-4461-46E7-B051-F1299219852E}
2017-05-15 15:04 - 2017-05-20 08:46 - 00004538 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player PPAPI Notifier
2017-05-15 15:04 - 2017-05-20 08:46 - 00004458 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2017-05-15 15:04 - 2017-05-16 05:53 - 00004268 _____ C:\WINDOWS\System32\Tasks\Avast Emergency Update
2017-05-15 15:04 - 2017-05-15 15:05 - 00003514 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2017-05-15 15:04 - 2017-05-15 15:05 - 00003268 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{7B31CF36-A6AB-4C23-BDF0-4AB1EB6CE01C}
2017-05-15 15:04 - 2017-05-15 15:05 - 00002874 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1114943301-3855528572-74286459-500
2017-05-15 15:04 - 2017-05-15 15:05 - 00002276 _____ C:\WINDOWS\System32\Tasks\Driver Booster SkipUAC (rahul_000)
2017-05-15 15:04 - 2017-05-15 15:04 - 00003482 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2017-05-15 15:04 - 2017-05-15 15:04 - 00003354 _____ C:\WINDOWS\System32\Tasks\SafeZone scheduled Autoupdate 1455278178
2017-05-15 15:04 - 2017-05-15 15:04 - 00003290 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2017-05-15 15:04 - 2017-05-15 15:04 - 00002936 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1114943301-3855528572-74286459-1002
2017-05-15 15:04 - 2017-05-15 15:04 - 00002876 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1114943301-3855528572-74286459-1005
2017-05-15 15:04 - 2017-05-15 15:04 - 00002568 _____ C:\WINDOWS\System32\Tasks\ShutdownOpt
2017-05-15 15:04 - 2017-05-15 15:04 - 00002514 _____ C:\WINDOWS\System32\Tasks\advRecovery
2017-05-15 15:04 - 2017-05-15 15:04 - 00002384 _____ C:\WINDOWS\System32\Tasks\SAgent
2017-05-15 15:04 - 2017-05-15 15:04 - 00002372 _____ C:\WINDOWS\System32\Tasks\DisplayChecker
2017-05-15 15:04 - 2017-05-15 15:04 - 00002280 _____ C:\WINDOWS\System32\Tasks\RTKCPL
2017-05-15 15:04 - 2017-05-15 15:04 - 00002250 _____ C:\WINDOWS\System32\Tasks\Uninstaller_SkipUac_rahul_000
2017-05-15 15:04 - 2017-05-15 15:04 - 00002216 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2017-05-15 15:04 - 2017-05-15 15:04 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-05-15 15:04 - 2017-05-15 15:04 - 00000000 ____D C:\WINDOWS\System32\Tasks\WPD
2017-05-15 15:04 - 2017-05-15 15:04 - 00000000 ____D C:\WINDOWS\System32\Tasks\SecTimeSync
2017-05-15 15:04 - 2017-05-15 15:04 - 00000000 ____D C:\WINDOWS\System32\Tasks\GenericSettingsHandler
2017-05-15 15:04 - 2017-05-15 15:04 - 00000000 ____D C:\WINDOWS\System32\Tasks\AVAST Software
2017-05-15 15:04 - 2017-05-15 15:04 - 00000000 ____D C:\WINDOWS\System32\Tasks\Apple
2017-05-15 15:04 - 2014-09-25 07:39 - 00003596 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2320355253-2224279592-2775355289-500
2017-05-15 15:04 - 2014-09-24 18:10 - 00003594 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-712471777-2381030718-1952048931-500
2017-05-15 15:01 - 2017-05-15 15:01 - 01840896 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-05-15 14:57 - 2017-05-15 14:57 - 00000020 ___SH C:\Users\UpdatusUser\ntuser.ini
2017-05-15 14:54 - 2017-05-15 14:54 - 00000000 ____D C:\Users\Public\Documents\Tools
2017-05-15 14:48 - 2017-05-15 14:48 - 00001576 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2017-05-15 14:41 - 2017-05-15 14:51 - 00000000 ____D C:\WINDOWS\system32\config\bbimigrate
2017-05-15 14:41 - 2017-05-15 14:41 - 00000000 ____D C:\Users\Todos os Usuários\USOShared
2017-05-15 14:41 - 2017-05-15 14:41 - 00000000 ____D C:\ProgramData\USOShared
2017-05-15 14:36 - 2017-05-17 01:50 - 00000000 ____D C:\Users\rahul_000
2017-05-15 14:36 - 2017-05-15 15:01 - 00000000 ____D C:\Users\UpdatusUser
2017-05-15 14:36 - 2017-05-15 15:01 - 00000000 ____D C:\Users\rober
2017-05-15 14:36 - 2017-05-15 14:58 - 00000000 ____D C:\Users\RahulCrescimento
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Modelos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Meus Documentos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Menu Iniciar
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Documents\Minhas Músicas
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Documents\Minhas Imagens
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Documents\Meus Vídeos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Dados de Aplicativos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Configurações Locais
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programas
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Local\Histórico
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Local\Dados de Aplicativos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Ambiente de Rede
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\UpdatusUser\Ambiente de Impressão
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Modelos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Meus Documentos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Menu Iniciar
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Documents\Minhas Músicas
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Documents\Minhas Imagens
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Documents\Meus Vídeos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Dados de Aplicativos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Configurações Locais
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\AppData\Roaming\Microsoft\Windows\Start Menu\Programas
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\AppData\Local\Histórico
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\AppData\Local\Dados de Aplicativos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Ambiente de Rede
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rober\Ambiente de Impressão
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Modelos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Meus Documentos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Menu Iniciar
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Documents\Minhas Músicas
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Documents\Minhas Imagens
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Documents\Meus Vídeos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Dados de Aplicativos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Configurações Locais
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\AppData\Roaming\Microsoft\Windows\Start Menu\Programas
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\AppData\Local\Histórico
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\AppData\Local\Dados de Aplicativos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Ambiente de Rede
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\RahulCrescimento\Ambiente de Impressão
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Modelos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Meus Documentos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Menu Iniciar
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Documents\Minhas Músicas
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Documents\Minhas Imagens
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Documents\Meus Vídeos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Dados de Aplicativos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Configurações Locais
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programas
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\AppData\Local\Histórico
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\AppData\Local\Dados de Aplicativos
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Ambiente de Rede
2017-05-15 14:36 - 2017-05-15 14:36 - 00000000 _SHDL C:\Users\rahul_000\Ambiente de Impressão
2017-05-15 14:35 - 2017-05-15 14:42 - 00000000 ____D C:\Users\Todos os Usuários\NVIDIA
2017-05-15 14:35 - 2017-05-15 14:42 - 00000000 ____D C:\ProgramData\NVIDIA
2017-05-15 14:35 - 2017-05-15 14:35 - 00000000 ____D C:\Users\Todos os Usuários\NVIDIA Corporation
2017-05-15 14:35 - 2017-05-15 14:35 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2017-05-15 14:35 - 2017-05-15 14:35 - 00000000 ____D C:\Program Files\Common Files\Atheros
2017-05-15 14:35 - 2016-08-01 21:54 - 06386744 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll
2017-05-15 14:35 - 2016-08-01 21:54 - 02466360 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvc64.dll
2017-05-15 14:35 - 2016-08-01 21:54 - 01762752 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvcr.dll
2017-05-15 14:35 - 2016-08-01 21:54 - 01365048 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe
2017-05-15 14:35 - 2016-08-01 21:54 - 00547896 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshext.dll
2017-05-15 14:35 - 2016-08-01 21:54 - 00393784 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmctray.dll
2017-05-15 14:35 - 2016-08-01 21:54 - 00081856 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshextr.dll
2017-05-15 14:35 - 2016-08-01 21:54 - 00071224 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvshext.dll
2017-05-15 14:35 - 2016-07-28 22:02 - 07242545 _____ C:\WINDOWS\system32\nvcoproc.bin
2017-05-15 14:34 - 2017-05-15 14:42 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2017-05-15 14:34 - 2017-05-15 14:42 - 00000000 ____D C:\Program Files\Intel
2017-05-15 14:34 - 2017-05-15 14:42 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2017-05-15 14:34 - 2017-03-19 05:56 - 02233344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2017-05-15 14:34 - 2016-02-19 03:09 - 00073360 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.DLL
2017-05-15 14:34 - 2016-02-19 03:09 - 00069776 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.DLL
2017-05-15 14:33 - 2017-05-15 14:33 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_SynTP_01011.Wdf
2017-05-15 14:33 - 2017-05-15 14:33 - 00000000 ____H C:\Users\Todos os Usuários\DP45977C.lfl
2017-05-15 14:33 - 2017-05-15 14:33 - 00000000 ____H C:\ProgramData\DP45977C.lfl
2017-05-15 14:33 - 2017-05-15 14:33 - 00000000 ____D C:\WINDOWS\SysWOW64\RTCOM
2017-05-15 14:33 - 2017-05-15 14:33 - 00000000 ____D C:\WINDOWS\system32\SRSLabs
2017-05-15 14:33 - 2017-05-15 14:33 - 00000000 ____D C:\Program Files\Realtek
2017-05-15 14:32 - 2017-05-15 14:32 - 00000000 ____D C:\Program Files\Synaptics
2017-05-15 14:30 - 2017-05-18 08:51 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-05-15 14:30 - 2017-05-15 14:52 - 00217384 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-05-15 12:35 - 2017-05-16 05:54 - 00000000 ___DC C:\WINDOWS\Panther
2017-05-15 12:35 - 2017-05-15 13:45 - 00000000 ___HD C:\$WINDOWS.~BT
2017-05-15 12:28 - 2017-05-15 12:34 - 00000036 _____ C:\WINDOWS\progress.ini
2017-05-15 10:30 - 2017-05-15 10:30 - 00000000 ____D C:\Users\rahul_000\AppData\Local\UNP
2017-05-15 10:13 - 2017-05-15 15:20 - 00000000 ___HD C:\$GetCurrent
2017-05-15 10:12 - 2017-05-16 05:54 - 00000000 ____D C:\Windows10Upgrade
2017-05-15 10:12 - 2017-05-15 10:12 - 06385872 _____ (Microsoft Corporation) C:\Users\rahul_000\Downloads\Windows10Upgrade9252.exe
2017-05-15 10:12 - 2017-05-15 10:12 - 00000751 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Assistente de Atualização do Windows 10.lnk
2017-05-15 10:12 - 2017-05-15 10:12 - 00000739 _____ C:\Users\rahul_000\Desktop\Assistente de Atualização do Windows 10.lnk
2017-05-14 20:52 - 2017-05-14 20:52 - 00187320 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMChameleon.sys
2017-05-14 20:51 - 2017-05-20 08:46 - 00093624 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2017-05-14 20:51 - 2017-05-15 14:54 - 00251832 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-05-14 20:51 - 2017-05-15 14:54 - 00113592 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2017-05-14 20:51 - 2017-05-15 14:54 - 00043968 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2017-05-14 20:51 - 2017-05-14 20:51 - 00001920 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-05-14 20:50 - 2017-05-15 14:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-05-14 20:50 - 2017-05-14 20:50 - 00000000 ____D C:\Users\Todos os Usuários\Malwarebytes
2017-05-14 20:50 - 2017-05-14 20:50 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-05-14 20:50 - 2017-05-14 20:50 - 00000000 ____D C:\Program Files\Malwarebytes
2017-05-14 20:50 - 2017-05-09 16:37 - 00077440 _____ C:\WINDOWS\system32\Drivers\mbae64.sys
2017-05-14 20:48 - 2017-05-14 21:16 - 391760698 _____ C:\Users\rahul_000\Downloads\windows10.0-kb4013429-x64_ddc8596f88577ab739cade1d365956a74598e710.msu (1).crdownload
2017-05-14 20:45 - 2017-05-14 20:49 - 63035592 _____ (Malwarebytes ) C:\Users\rahul_000\Downloads\mb3-setup-35891.35891-3.1.2.1733.exe
2017-05-14 11:49 - 2017-05-14 11:59 - 00000000 ____D C:\WINDOWS\Microsoft Antimalware
2017-05-13 18:32 - 2017-05-13 18:32 - 08536298 _____ C:\Users\rahul_000\Downloads\4019472.csv
2017-05-13 18:31 - 2017-05-13 18:31 - 07902204 _____ C:\Users\rahul_000\Downloads\4013429.csv
2017-05-13 17:50 - 2017-05-15 14:43 - 00000000 ____D C:\WINDOWS\system32\UNP
2017-05-13 17:50 - 2017-05-13 17:51 - 00000000 ____D C:\Program Files\UNP
2017-05-13 13:27 - 2017-05-13 13:27 - 00195346 _____ C:\Users\rahul_000\Downloads\wu170509 (2).diagcab
2017-05-13 11:38 - 2017-03-28 14:37 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\DdcWnsListener.dll
2017-05-13 11:38 - 2017-03-04 15:26 - 00261632 _____ (Microsoft Corporation) C:\WINDOWS\system32\indexeddbserver.dll
2017-05-13 11:38 - 2017-03-04 15:18 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\indexeddbserver.dll
2017-05-13 11:06 - 2017-05-13 11:11 - 36310454 _____ C:\Users\rahul_000\Downloads\windows10.0-kb4013429-x64_ddc8596f88577ab739cade1d365956a74598e710.msu.crdownload
2017-05-13 11:06 - 2017-05-13 11:06 - 00195346 _____ C:\Users\rahul_000\Downloads\wu170509.diagcab
2017-05-13 11:06 - 2017-05-13 11:06 - 00195346 _____ C:\Users\rahul_000\Downloads\wu170509 (1).diagcab
2017-05-13 10:45 - 2017-05-13 10:45 - 00158880 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswstm.sys
2017-05-07 22:09 - 2017-05-07 22:09 - 00001094 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk
2017-05-07 22:09 - 2017-05-07 22:08 - 00569192 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSP.sys
2017-05-07 22:09 - 2017-05-07 22:08 - 00339696 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswVmm.sys
2017-05-07 22:09 - 2017-05-07 22:08 - 00128648 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswMonFlt.sys
2017-05-07 22:09 - 2017-05-07 22:08 - 00101152 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRdr2.sys
2017-05-07 22:09 - 2017-05-07 22:08 - 00075704 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswRvrt.sys
2017-05-07 22:09 - 2017-05-07 22:08 - 00038296 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswHwid.sys
2017-05-07 22:09 - 2017-05-07 22:07 - 01007160 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswSnx.sys
2017-05-07 22:09 - 2017-05-07 22:07 - 00334576 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswbloga.sys
2017-05-07 22:09 - 2017-05-07 22:07 - 00311808 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswbidsdrivera.sys
2017-05-07 22:09 - 2017-05-07 22:07 - 00190256 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswbidsha.sys
2017-05-07 22:09 - 2017-05-07 22:07 - 00049016 _____ (AVAST Software s.r.o.) C:\WINDOWS\system32\Drivers\aswbuniva.sys
2017-05-07 22:09 - 2017-05-07 22:07 - 00032600 _____ (AVAST Software) C:\WINDOWS\system32\Drivers\aswKbd.sys
2017-05-07 22:08 - 2017-05-07 22:08 - 00400456 _____ (AVAST Software) C:\WINDOWS\system32\aswBoot.exe
2017-04-29 22:14 - 2017-04-29 22:14 - 00000000 ____D C:\Users\rahul_000\Desktop\Rpg Maker
2017-04-29 21:42 - 2017-04-29 21:46 - 09390592 _____ (Piriform Ltd) C:\Users\rahul_000\Downloads\ccsetup529pro.exe

==================== Um Mês Modificados arquivos e pastas ========

(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)

2017-05-20 22:28 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-05-20 22:27 - 2014-12-25 22:40 - 00000000 ___RD C:\Users\rahul_000\OneDrive
2017-05-20 22:19 - 2014-09-24 14:08 - 00000000 ____D C:\Users\Todos os Usuários\WinClon
2017-05-20 22:19 - 2014-09-24 14:08 - 00000000 ____D C:\ProgramData\WinClon
2017-05-20 22:16 - 2015-12-01 23:37 - 00000000 __SHD C:\Users\rahul_000\IntelGraphicsProfiles
2017-05-20 09:43 - 2014-12-25 23:09 - 00002270 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-05-20 09:36 - 2014-12-25 22:49 - 00000000 ____D C:\Program Files (x86)\Opera
2017-05-20 09:34 - 2017-03-19 06:03 - 00000000 ___HD C:\Program Files\WindowsApps
2017-05-20 09:31 - 2015-06-09 04:01 - 00000000 ____D C:\Users\rahul_000\AppData\Local\Battle.net
2017-05-20 09:27 - 2017-03-04 23:23 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\vSnapshot
2017-05-20 09:08 - 2016-11-21 04:24 - 00000000 ____D C:\Program Files (x86)\Heroes of the Storm
2017-05-20 08:53 - 2015-11-28 00:58 - 00000000 ____D C:\Program Files (x86)\Battle.net
2017-05-20 08:50 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\appcompat
2017-05-20 08:45 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-05-20 08:45 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\Macromed
2017-05-20 08:43 - 2017-03-19 06:01 - 00000000 ____D C:\WINDOWS\INF
2017-05-17 01:44 - 2017-03-19 05:51 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-05-17 01:37 - 2016-10-20 08:20 - 00000000 ____D C:\Users\rahul_000\AppData\Local\ConnectedDevicesPlatform
2017-05-16 06:17 - 2014-12-25 22:31 - 00000000 ____D C:\Users\rahul_000\AppData\Local\Packages
2017-05-16 05:56 - 2017-03-19 06:03 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-05-16 05:55 - 2014-11-06 00:06 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-05-16 02:29 - 2017-03-19 06:03 - 00028672 _____ C:\WINDOWS\system32\config\BCD-Template
2017-05-16 02:25 - 2017-03-19 06:06 - 00000000 ____D C:\WINDOWS\Setup
2017-05-16 02:25 - 2017-03-19 06:03 - 00000000 ___SD C:\WINDOWS\SysWOW64\F12
2017-05-16 02:25 - 2017-03-19 06:03 - 00000000 ___SD C:\WINDOWS\system32\F12
2017-05-16 02:25 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\SysWOW64\Dism
2017-05-16 02:25 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2017-05-16 02:25 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\appraiser
2017-05-16 02:25 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\ShellExperiences
2017-05-16 02:25 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\Provisioning
2017-05-16 02:25 - 2017-03-19 06:03 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2017-05-16 02:25 - 2017-03-19 06:03 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2017-05-16 02:25 - 2017-03-18 20:40 - 00000000 ____D C:\WINDOWS\system32\Dism
2017-05-16 02:15 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\SysWOW64\MUI
2017-05-16 02:15 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\MUI
2017-05-16 02:15 - 2017-03-19 05:56 - 00465408 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnet.dll
2017-05-16 02:15 - 2017-03-19 05:56 - 00389632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnet.dll
2017-05-16 02:15 - 2017-03-19 05:56 - 00217600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplayx.dll
2017-05-16 02:15 - 2017-03-19 05:56 - 00067584 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnathlp.dll
2017-05-16 02:15 - 2017-03-19 05:56 - 00061440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnathlp.dll
2017-05-16 02:15 - 2017-03-19 05:56 - 00046592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpwsockx.dll
2017-05-16 02:15 - 2017-03-19 05:56 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnsvr.exe
2017-05-16 02:15 - 2017-03-19 05:56 - 00024576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpmodemx.dll
2017-05-16 02:15 - 2017-03-19 05:56 - 00022528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnsvr.exe
2017-05-16 02:15 - 2017-03-19 05:56 - 00020480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplaysvr.exe
2017-05-16 02:15 - 2017-03-19 05:56 - 00010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhupnp.dll
2017-05-16 02:15 - 2017-03-19 05:56 - 00010240 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhpast.dll
2017-05-16 02:15 - 2017-03-19 05:56 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhupnp.dll
2017-05-16 02:15 - 2017-03-19 05:56 - 00008704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhpast.dll
2017-05-16 02:15 - 2017-03-19 05:56 - 00006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnlobby.dll
2017-05-16 02:15 - 2017-03-19 05:56 - 00006144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnaddr.dll
2017-05-16 02:15 - 2017-03-19 05:56 - 00005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnlobby.dll
2017-05-16 02:15 - 2017-03-19 05:56 - 00005120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnaddr.dll
2017-05-15 15:19 - 2017-03-19 06:03 - 00000000 ____D C:\Program Files\Windows NT
2017-05-15 15:18 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\WinBioDatabase
2017-05-15 15:18 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\Registration
2017-05-15 15:18 - 2017-03-18 20:40 - 00008192 _____ C:\WINDOWS\system32\config\ELAM
2017-05-15 15:17 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\rescache
2017-05-15 15:05 - 2017-03-20 13:03 - 00000000 ____D C:\WINDOWS\HoloShell
2017-05-15 15:04 - 2015-12-01 23:31 - 00023056 _____ C:\WINDOWS\system32\emptyregdb.dat
2017-05-15 15:03 - 2016-07-16 20:47 - 00000000 ____D C:\WINDOWS\system32\Tasks_Migrated
2017-05-15 15:02 - 2017-03-19 06:03 - 00000000 __RHD C:\Users\Public\Libraries
2017-05-15 15:01 - 2017-03-20 13:00 - 00793804 _____ C:\WINDOWS\system32\prfh0416.dat
2017-05-15 15:01 - 2017-03-20 13:00 - 00156854 _____ C:\WINDOWS\system32\prfc0416.dat
2017-05-15 14:55 - 2016-04-20 23:00 - 00029816 _____ (GAS Tecnologia) C:\WINDOWS\system32\Drivers\gbpddreg64.sys
2017-05-15 14:55 - 2016-04-20 23:00 - 00028888 _____ (GAS Tecnologia) C:\WINDOWS\system32\Drivers\gbpddfac64.sys
2017-05-15 14:55 - 2016-04-20 22:59 - 00000000 ____D C:\Program Files (x86)\GbPlugin
2017-05-15 14:54 - 2017-01-11 06:40 - 00028376 _____ (GAS Tecnologia) C:\WINDOWS\system32\Drivers\wsddfac.sys
2017-05-15 14:54 - 2016-04-20 22:59 - 00000000 ____D C:\Users\Todos os Usuários\GbPlugin
2017-05-15 14:54 - 2016-04-20 22:59 - 00000000 ____D C:\ProgramData\GbPlugin
2017-05-15 14:51 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\FxsTmp
2017-05-15 14:51 - 2017-03-18 20:40 - 01048576 _____ C:\WINDOWS\system32\config\BBI
2017-05-15 14:51 - 2016-01-18 03:51 - 00000000 ____D C:\WINDOWS\SysWOW64\NV
2017-05-15 14:51 - 2016-01-18 03:51 - 00000000 ____D C:\WINDOWS\system32\NV
2017-05-15 14:43 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
2017-05-15 14:43 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\spool
2017-05-15 14:43 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\oobe
2017-05-15 14:43 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\NDF
2017-05-15 14:43 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\system32\InputMethod
2017-05-15 14:43 - 2016-11-12 21:05 - 00000000 ____D C:\WINDOWS\SysWOW64\Cef
2017-05-15 14:43 - 2015-12-09 09:56 - 00000000 ____D C:\WINDOWS\system32\MpEngineStore
2017-05-15 14:43 - 2015-07-02 01:21 - 00000000 __SHD C:\WINDOWS\SysWOW64\AI_RecycleBin
2017-05-15 14:43 - 2015-06-29 03:37 - 00000000 ____D C:\WINDOWS\SysWOW64\Hotspot Shield
2017-05-15 14:43 - 2014-12-31 10:07 - 00000000 ____D C:\WINDOWS\SysWOW64\GPBAK
2017-05-15 14:43 - 2014-12-28 18:29 - 00000000 ____D C:\WINDOWS\SysWOW64\vbox
2017-05-15 14:43 - 2014-12-28 18:29 - 00000000 ____D C:\WINDOWS\system32\vbox
2017-05-15 14:43 - 2014-12-28 09:41 - 00000000 ____D C:\WINDOWS\system32\MRT
2017-05-15 14:43 - 2013-08-23 00:36 - 00000000 ____D C:\WINDOWS\system32\WindowsInternal.Inbox.Shared
2017-05-15 14:43 - 2013-08-23 00:36 - 00000000 ____D C:\WINDOWS\system32\WindowsInternal.Inbox.Media.Shared
2017-05-15 14:42 - 2017-04-10 01:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2017-05-15 14:42 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2017-05-15 14:42 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\InputMethod
2017-05-15 14:42 - 2017-03-19 06:03 - 00000000 ____D C:\Users\Todos os Usuários\regid.1991-06.com.microsoft
2017-05-15 14:42 - 2017-03-19 06:03 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-05-15 14:42 - 2017-03-19 06:03 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2017-05-15 14:42 - 2017-03-05 03:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2017-05-15 14:42 - 2017-01-23 08:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft II
2017-05-15 14:42 - 2016-12-03 08:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2017-05-15 14:42 - 2016-11-19 18:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Overwatch
2017-05-15 14:42 - 2016-10-25 23:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends
2017-05-15 14:42 - 2016-10-03 08:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Speccy
2017-05-15 14:42 - 2016-06-05 19:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2017-05-15 14:42 - 2016-04-03 08:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ferramentas do Microsoft Office 2016
2017-05-15 14:42 - 2016-03-26 11:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Visual Studio Code
2017-05-15 14:42 - 2016-02-05 09:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ChessBase
2017-05-15 14:42 - 2015-12-23 10:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RPG Maker MV
2017-05-15 14:42 - 2015-12-23 06:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2017-05-15 14:42 - 2015-11-16 07:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotspot Shield
2017-05-15 14:42 - 2015-10-13 08:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SQUARE ENIX
2017-05-15 14:42 - 2015-09-26 10:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
2017-05-15 14:42 - 2015-09-05 11:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone
2017-05-15 14:42 - 2015-07-10 01:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Synthesia
2017-05-15 14:42 - 2015-07-05 06:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2017-05-15 14:42 - 2015-07-02 01:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Soluto
2017-05-15 14:42 - 2015-06-27 22:05 - 00000000 ____D C:\Users\Todos os Usuários\regid.1986-12.com.adobe
2017-05-15 14:42 - 2015-06-27 22:05 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2017-05-15 14:42 - 2015-06-09 10:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2017-05-15 14:42 - 2015-06-09 04:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2017-05-15 14:42 - 2015-05-26 10:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iExplorer
2017-05-15 14:42 - 2015-05-06 04:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2017-05-15 14:42 - 2015-02-21 23:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RPG Maker VX Ace
2017-05-15 14:42 - 2014-12-28 18:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-05-15 14:42 - 2014-12-28 01:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-05-15 14:42 - 2014-12-26 23:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2017-05-15 14:42 - 2014-12-26 07:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NEXON
2017-05-15 14:42 - 2014-09-24 13:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2017-05-15 14:42 - 2014-09-24 13:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitcasa
2017-05-15 14:41 - 2017-03-19 06:03 - 00000000 ____D C:\Users\Todos os Usuários\USOPrivate
2017-05-15 14:41 - 2017-03-19 06:03 - 00000000 ____D C:\ProgramData\USOPrivate
2017-05-15 14:41 - 2013-08-23 00:36 - 00000000 ___HD C:\WINDOWS\system32\GroupPolicy
2017-05-15 14:40 - 2016-04-20 22:49 - 00000000 ____D C:\Users\rober\AppData\Local\Packages
2017-05-15 14:39 - 2016-05-18 10:43 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.5
2017-05-15 14:39 - 2015-12-01 02:48 - 00000000 ___RD C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2017-05-15 14:39 - 2015-11-16 07:33 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nexon
2017-05-15 14:39 - 2015-07-15 10:37 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2017-05-15 14:39 - 2015-07-12 06:07 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2017-05-15 14:39 - 2014-12-28 18:42 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Level Up! Games
2017-05-15 14:39 - 2014-12-28 18:32 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-05-15 14:39 - 2014-12-28 09:33 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Level Up! Gerenciador
2017-05-15 14:38 - 2015-06-07 02:11 - 00000000 ___RD C:\Users\RahulCrescimento\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
2017-05-15 14:38 - 2015-05-19 23:10 - 00000000 ____D C:\Users\RahulCrescimento\AppData\Local\Packages
2017-05-15 14:35 - 2017-03-19 06:03 - 00000000 ____D C:\WINDOWS\Help
2017-05-15 14:35 - 2017-03-18 20:40 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2017-05-15 14:35 - 2015-01-16 00:06 - 00000000 ____D C:\temp
2017-05-15 09:51 - 2014-12-26 23:12 - 00000000 ____D C:\Program Files (x86)\Steam
2017-05-15 09:48 - 2016-06-05 19:22 - 00000000 ____D C:\Program Files\CCleaner
2017-05-14 21:10 - 2014-12-30 03:37 - 00000000 ____D C:\Users\Todos os Usuários\Browser
2017-05-14 21:10 - 2014-12-30 03:37 - 00000000 ____D C:\ProgramData\Browser
2017-05-13 18:00 - 2014-12-28 18:29 - 00532136 _____ (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2017-05-13 11:45 - 2014-12-28 09:41 - 156335152 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2017-05-13 11:04 - 2015-01-10 05:30 - 00000000 ____D C:\Users\Todos os Usuários\Skype
2017-05-13 11:04 - 2015-01-10 05:30 - 00000000 ____D C:\ProgramData\Skype
2017-05-13 11:03 - 2017-04-10 01:30 - 00000000 ___RD C:\Program Files (x86)\Skype
2017-05-13 10:06 - 2015-06-29 03:34 - 00000000 ____D C:\Users\rahul_000\AppData\Local\ElevatedDiagnostics
2017-05-06 08:56 - 2016-02-01 10:27 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\Bioshock2Steam
2017-05-03 07:00 - 2014-09-24 14:17 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2017-04-29 22:56 - 2015-07-12 05:57 - 00000000 ____D C:\Users\rahul_000\AppData\Local\Steam
2017-04-29 22:11 - 2015-12-23 06:34 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\vlc
2017-04-29 22:10 - 2015-10-07 03:46 - 00000000 ____D C:\Users\rahul_000\Desktop\Old
2017-04-29 21:47 - 2016-06-05 19:22 - 00000865 _____ C:\Users\Public\Desktop\CCleaner.lnk
2017-04-29 05:29 - 2017-01-12 10:07 - 00000000 ____D C:\Users\rahul_000\AppData\Roaming\Curse Client
2017-04-28 10:30 - 2015-06-09 04:09 - 00000000 ____D C:\Program Files (x86)\World of Warcraft
2017-04-28 09:02 - 2017-01-23 07:45 - 00000000 ____D C:\Program Files (x86)\StarCraft II
2017-04-24 09:30 - 2015-09-05 11:09 - 00000000 ____D C:\Program Files (x86)\Hearthstone

==================== Arquivos na raiz de alguns diretórios =======

2017-05-15 14:33 - 2017-05-15 14:33 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-09-24 14:02 - 2013-02-19 16:34 - 2064264 _____ (Samsung Electronics) C:\ProgramData\MakeMarkerFile.exe
2014-09-24 14:02 - 2013-01-12 23:51 - 0003004 _____ () C:\ProgramData\MakeMarkerFile.xml
2015-07-02 01:21 - 2015-07-02 01:21 - 0000098 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc
2016-06-12 08:18 - 2016-06-12 08:18 - 0000016 _____ () C:\ProgramData\mntemp

Arquivos para serem movidos ou deletados:
====================
C:\Users\rahul_000\Setup.exe

==================== Bamital & volsnap ======================

(Não há correção automática para arquivos que não passaram na verificação.)

C:\WINDOWS\system32\winlogon.exe => O arquivo é assinado digitalmente
C:\WINDOWS\system32\wininit.exe => O arquivo é assinado digitalmente
C:\WINDOWS\explorer.exe => O arquivo é assinado digitalmente
C:\WINDOWS\SysWOW64\explorer.exe => O arquivo é assinado digitalmente
C:\WINDOWS\system32\svchost.exe => O arquivo é assinado digitalmente
C:\WINDOWS\SysWOW64\svchost.exe => O arquivo é assinado digitalmente
C:\WINDOWS\system32\services.exe => O arquivo é assinado digitalmente
C:\WINDOWS\system32\User32.dll => O arquivo é assinado digitalmente
C:\WINDOWS\SysWOW64\User32.dll => O arquivo é assinado digitalmente
C:\WINDOWS\system32\userinit.exe => O arquivo é assinado digitalmente
C:\WINDOWS\SysWOW64\userinit.exe => O arquivo é assinado digitalmente
C:\WINDOWS\system32\rpcss.dll => O arquivo é assinado digitalmente
C:\WINDOWS\system32\dnsapi.dll => O arquivo é assinado digitalmente
C:\WINDOWS\SysWOW64\dnsapi.dll => O arquivo é assinado digitalmente
C:\WINDOWS\system32\Drivers\volsnap.sys => O arquivo é assinado digitalmente

LastRegBack: 2017-05-15 14:30

==================== Fim de FRST.txt ============================

MBlog.txt

Addition.txt

[kevinf80]

What is this program, did you install it... Do you trust it...

C:\Program Files (x86)\vSnapshot

-Website Data-
Domain: rtp.vscreenshot.com
IP Address: 54.202.30.139
Port: [62499]
Type: Outbound
File: C:\Program Files (x86)\vSnapshot\1.0.0.0\vSnapshotServ.exe

[Blanknight]

That program is exactly my problem. I never installed it (probably came as a "freebie" in some download or another...my mistake) and do not trust it. I'm afraid of even tampering with the folder it is in...since that attack last week I started trying to be more careful with what I do in my computer, and not messing with unknown "exe" files is part of it...

 

Should I just delete it?

[kevinf80]

Thanks for those logs and information update, continue with the following: Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file" NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Open FRST and press the Fix button just once and wait. The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Open Malwarebytes, select > "settings" > "protection tab" Scroll down to "Scan Options" ensure Scan for Rootkits and Scan within Archives are both on.... Go back to "DashBoard" select the Blue "Scan Now" tab...... When the scan completes deal with any found entries... Then select "Export Summary" then "Text File (*.txt)" name that log and save , you can copy or attach that to your reply... Next, Download AdwCleaner by Xplode onto your Desktop. Or from this Mirror   Double click on Adwcleaner.exe to run the tool Click on the Scan in the Actions box Please wait fot the scan to finish.. When "Waiting for action.Please uncheck elements you want to keep" shows in top line.. Click on the Cleaning box. Next click OK on the "Closing Programs" pop up box. Click OK on the Information box & again OK to allow the necessary reboot After restart the AdwCleaner(C*)-Notepad log will appear, please copy/paste it in your next reply. Where * is the number relative to list of scans completed... Next, Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktop Ensure to get the correct version for your system.... 32 Bit version: https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en 64 Bit version: https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en Right click on the Tool, select “Run as Administrator” the tool will expand to the options Window In the "Scan Type" window, select Quick Scan Perform a scan and Click Finish when the scan is done. Retrieve the MSRT log as follows, and post it in your next reply: 1) Select the Windows key and R key together to open the "Run" function 2) Type or Copy/Paste the following command to the "Run Line" and Press Enter: notepad c:\windows\debug\mrt.log The log will include log details for each time MSRT has run, we only need the most recent log by date and time.... Let me see those logs, also tell me if there are any remaining issues or concerns..... Thank you, Kevin...

fixlist.txt

[Blanknight]

The problem seems to have been solved. What did you find? Anyway, here are the logs :

-----------------------Fixlog-------------------------------------

 

Resultado da Correção pela Farbar Recovery Scan Tool (x64) Versão: 20-05-2017
Executado por rahul_000 (21-05-2017 09:41:49) Run:1
Executando a partir de C:\Users\rahul_000\Desktop
Perfis Carregados: UpdatusUser & rahul_000 (Perfis Disponíveis: UpdatusUser & rahul_000 & RahulCrescimento & rober)
Modo da Inicialização: Normal
==============================================

fixlist Conteúdo:
*****************
Start
CloseProcesses:
CreateRestorePoint:
C:\Program Files (x86)\vSnapshot\1.0.0.0\vSnapshotServ.exe
C:\Program Files (x86)\vSnapshot
AppInit_DLLs: C:\windows\system32\nvinitx.dll => Nenhum Arquivo
AppInit_DLLs: , C:\WINDOWS\system32\nvinitx.dll => Nenhum Arquivo
CHR HKLM\SOFTWARE\Policies\Google: Restrição <======= ATENÇÃO 
Tcpip\..\Interfaces\{2fa42369-3f9e-41da-bb45-7e31e1b0832d}: [DhcpNameServer] 8.8.8.8 
C:\Users\rahul_000\ntuser.ini
C:\Users\rahul_000\Setup.exe 
Task: {02D303F3-3C69-4F14-BFF2-A615D7B0427A} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Nenhum Arquivo <==== ATENÇÃO
Task: {108899F4-9DBD-4A56-8078-D031DBB58EE4} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Nenhum Arquivo <==== ATENÇÃO
Task: {23A268BE-2F0C-4556-81DC-88F0E6AC6FE6} - \WPD\SqmUpload_S-1-5-21-1114943301-3855528572-74286459-1002 -> Nenhum Arquivo <==== ATENÇÃO
Task: {5875BEB2-AE4A-48CE-A311-1424DF477EB0} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Nenhum Arquivo <==== ATENÇÃO
Task: {5F31DFC9-DFAA-40C8-9FCB-75943724E30B} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Nenhum Arquivo <==== ATENÇÃO
Task: {6DDBC8B5-1673-40FE-B31F-A0ACD0B52EB2} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Nenhum Arquivo <==== ATENÇÃO
Task: {7C2585A6-7A7A-4C2C-8579-23308E38BE66} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Nenhum Arquivo <==== ATENÇÃO
Task: {822E8BA7-640B-41F0-B7D1-1C22BEAC1D50} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Nenhum Arquivo <==== ATENÇÃO
Task: {8A56B1EB-46BD-42BB-AF59-FAA3E85A1475} - \WPD\SqmUpload_S-1-5-21-1114943301-3855528572-74286459-1005 -> Nenhum Arquivo <==== ATENÇÃO
Task: {982D4B2E-742F-49BF-AB72-0F80153ADAD9} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Nenhum Arquivo <==== ATENÇÃO
Task: {A6D71998-2CBE-46F5-AE13-BE8A8EF60B01} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Nenhum Arquivo <==== ATENÇÃO
Task: {D27A8EBA-0DA7-4EBD-988C-954E84D8F688} - \GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-1114943301-3855528572-74286459-1002 -> Nenhum Arquivo <==== ATENÇÃO
Task: {D3721019-67DC-4BC6-B6C8-50A720C41BA8} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Nenhum Arquivo <==== ATENÇÃO
Task: {FBA9AECA-508A-494C-AA7C-6938F6C866E2} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Nenhum Arquivo <==== ATENÇÃO
AlternateDataStreams: C:\Program Files (x86)\GbPlugin:IncompleteStartProcessProtection.cnt [10]
AlternateDataStreams: C:\Program Files (x86)\GbPlugin:u6eBQrM0Z2K3FKLVBMG8dY3IkKT2rqFO+Sf68h8fDg== [32]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\gbpddfac64.sys:X5ZN8aGvT4 [2262]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\gbpddreg64.sys:X5ZN8aGvT4 [686]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\wsddfac.sys:X5ZN8aGXs4 [2410]
AlternateDataStreams: C:\ProgramData\GbPlugin:IncompleteStartGbprcm.cnt [22]
AlternateDataStreams: C:\Users\Todos os Usuários\GbPlugin:IncompleteStartGbprcm.cnt [22]
FirewallRules: [{320D7F54-DCFE-4039-B98B-1BC98551FA4D}] => (Block) LPort=138
FirewallRules: [{4F78AADF-D272-4099-8354-37F271154D72}] => (Block) LPort=135
CMD: ipconfig /flushdns
Hosts:
EmptyTemp:
end

*****************

Processos fechados com sucesso.
Ponto de Restauração criado com sucesso.
C:\Program Files (x86)\vSnapshot\1.0.0.0\vSnapshotServ.exe => movido com sucesso
C:\Program Files (x86)\vSnapshot => movido com sucesso
"C:\windows\system32\nvinitx.dll" => Dados do Valor removido (a) com sucesso..
", C:\WINDOWS\system32\nvinitx.dll" => Dados do Valor não encontrado (a).
HKLM\SOFTWARE\Policies\Google => chave removido (a) com sucesso.
HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2fa42369-3f9e-41da-bb45-7e31e1b0832d}\\DhcpNameServer => valor removido (a) com sucesso.
C:\Users\rahul_000\ntuser.ini => movido com sucesso
C:\Users\rahul_000\Setup.exe => movido com sucesso
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{02D303F3-3C69-4F14-BFF2-A615D7B0427A} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{02D303F3-3C69-4F14-BFF2-A615D7B0427A} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{108899F4-9DBD-4A56-8078-D031DBB58EE4} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{108899F4-9DBD-4A56-8078-D031DBB58EE4} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{23A268BE-2F0C-4556-81DC-88F0E6AC6FE6} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{23A268BE-2F0C-4556-81DC-88F0E6AC6FE6} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WPD\SqmUpload_S-1-5-21-1114943301-3855528572-74286459-1002 => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5875BEB2-AE4A-48CE-A311-1424DF477EB0} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5875BEB2-AE4A-48CE-A311-1424DF477EB0} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5F31DFC9-DFAA-40C8-9FCB-75943724E30B} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5F31DFC9-DFAA-40C8-9FCB-75943724E30B} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{6DDBC8B5-1673-40FE-B31F-A0ACD0B52EB2} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6DDBC8B5-1673-40FE-B31F-A0ACD0B52EB2} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{7C2585A6-7A7A-4C2C-8579-23308E38BE66} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7C2585A6-7A7A-4C2C-8579-23308E38BE66} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{822E8BA7-640B-41F0-B7D1-1C22BEAC1D50} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{822E8BA7-640B-41F0-B7D1-1C22BEAC1D50} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{8A56B1EB-46BD-42BB-AF59-FAA3E85A1475} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8A56B1EB-46BD-42BB-AF59-FAA3E85A1475} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WPD\SqmUpload_S-1-5-21-1114943301-3855528572-74286459-1005 => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{982D4B2E-742F-49BF-AB72-0F80153ADAD9} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{982D4B2E-742F-49BF-AB72-0F80153ADAD9} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{A6D71998-2CBE-46F5-AE13-BE8A8EF60B01} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A6D71998-2CBE-46F5-AE13-BE8A8EF60B01} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D27A8EBA-0DA7-4EBD-988C-954E84D8F688} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D27A8EBA-0DA7-4EBD-988C-954E84D8F688} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-1114943301-3855528572-74286459-1002 => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D3721019-67DC-4BC6-B6C8-50A720C41BA8} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D3721019-67DC-4BC6-B6C8-50A720C41BA8} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{FBA9AECA-508A-494C-AA7C-6938F6C866E2} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FBA9AECA-508A-494C-AA7C-6938F6C866E2} => chave removido (a) com sucesso.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent => chave removido (a) com sucesso.
C:\Program Files (x86)\GbPlugin => ":IncompleteStartProcessProtection.cnt" ADS removido (a) com sucesso..
C:\Program Files (x86)\GbPlugin => ":u6eBQrM0Z2K3FKLVBMG8dY3IkKT2rqFO+Sf68h8fDg==" ADS removido (a) com sucesso..
C:\WINDOWS\system32\Drivers\gbpddfac64.sys => ":X5ZN8aGvT4" ADS removido (a) com sucesso..
C:\WINDOWS\system32\Drivers\gbpddreg64.sys => ":X5ZN8aGvT4" ADS removido (a) com sucesso..
C:\WINDOWS\system32\Drivers\wsddfac.sys => ":X5ZN8aGXs4" ADS removido (a) com sucesso..
C:\ProgramData\GbPlugin => ":IncompleteStartGbprcm.cnt" ADS removido (a) com sucesso..
"C:\Users\Todos os Usuários\GbPlugin" => ":IncompleteStartGbprcm.cnt" ADS não encontrado (a).
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{320D7F54-DCFE-4039-B98B-1BC98551FA4D} => valor removido (a) com sucesso.
HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{4F78AADF-D272-4099-8354-37F271154D72} => valor removido (a) com sucesso.

========= ipconfig /flushdns =========

Configura‡ao de IP do Windows

Libera‡ao do Cache do DNS Resolver bem-sucedida.

========= Fim de CMD: =========

C:\Windows\System32\Drivers\etc\hosts => movido com sucesso
Hosts restaurado com sucesso.

=========== EmptyTemp: ==========

BITS transfer queue => 6053888 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 36089545 B
Java, Flash, Steam htmlcache => 413274041 B
Windows/system/drivers => 664971581 B
Edge => 1760 B
Chrome => 116461838 B
Firefox => 29982626 B
Opera => 727040 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 1642 B
NetworkService => 3766 B
UpdatusUser => 0 B
rahul_000 => 22569697 B
RahulCrescimento => 74205 B
rober => 27591 B

RecycleBin => 0 B
EmptyTemp: => 1.2 GB de dados temporários Removidos.

================================

O sistema precisou ser reiniciado.

==== Fim de Fixlog 09:43:53 ====

 

----------------------AdwCleaner Log--------------------------------------------------

 

# AdwCleaner v6.047 - Logfile created 21/05/2017 at 10:32:02
# Updated on 19/05/2017 by Malwarebytes
# Database : 2017-05-19.1 [Server]
# Operating System : Windows 10 Home Single Language  (X64)
# Username : rahul_000 - SYNC
# Running from : C:\Users\rahul_000\Desktop\adwcleaner_6.047.exe
# Mode: Clean
# Support : https://www.malwarebytes.com/support

***** [ Services ] *****

[-] Service deleted: YSearchUtilSvc

***** [ Folders ] *****

[-] Folder deleted: C:\ProgramData\{82950f97-ad75-497b-8295-50f97ad73e5e}
[-] Folder deleted: C:\Users\rahul_000\Unknown
[-] Folder deleted: C:\Users\rahul_000\AppData\Local\YSearchUtil
[-] Folder deleted: C:\StormAlert
[-] Folder deleted: C:\ProgramData\IObit\ASCDownloader
[-] Folder deleted: C:\Users\Public\Documents\Guid
[-] Folder deleted: C:\Users\Public\Documents\pc faster
[-] Folder deleted: C:\Program Files (x86)\Yahoo!\yset
[-] Folder deleted: C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Local\YSearchUtil

***** [ Files ] *****

[-] File deleted: C:\END
[-] File deleted: C:\Users\rahul_000\AppData\Roaming\Mozilla\Firefox\Profiles\61iwucp6.default-1491755514323\extensions\jid1-16aeif9OQIRKxA@jetpack.xpi

***** [ DLL ] *****

***** [ WMI ] *****

***** [ Shortcuts ] *****

***** [ Scheduled Tasks ] *****

***** [ Registry ] *****

[-] Key deleted: HKU\S-1-5-21-1114943301-3855528572-74286459-1002\Software\AppDataLow\Software\SpeedChecker
[#] Key deleted on reboot: HKCU\Software\AppDataLow\Software\SpeedChecker
[-] Key deleted: HKLM\SOFTWARE\dllpop100
[-] Key deleted: HKLM\SOFTWARE\IOBIT\ASC
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yahoo! SearchSet
[#] Key deleted on reboot: [x64] HKCU\Software\AppDataLow\Software\SpeedChecker
[-] Key deleted: [x64] HKLM\SOFTWARE\DtsEncodeTools
[-] Data restored: [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] 
[-] Key deleted: HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.ascplugin.protect
[-] Key deleted: HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh

***** [ Web browsers ] *****

[-] [C:\Users\rahul_000\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: bopakagnckmlgajfccecajhnimjiiedh
[-] [C:\Users\RahulCrescimento\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: br.ask.com
[-] [C:\Users\rober\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: br.ask.com
[-] [C:\Users\rober\AppData\Local\Google\Chrome\User Data\Default] [homepage] Deleted: hxxp://br.hao123.com/?tn=sdkw_inner_hp_09_hao123_br&guid=9f1c1506112b08bc455e8ac5b916a238

*************************

:: "Tracing" keys deleted
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C0].txt - [2812 Bytes] - [21/05/2017 10:32:02]
C:\AdwCleaner\AdwCleaner[S0].txt - [3248 Bytes] - [21/05/2017 10:30:03]

########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [2958 Bytes] ##########
 

 

-------------------------MSRT Log------------------------

 

---------------------------------------------------------------------------------------
Microsoft Windows Malicious Software Removal Tool v5.48, May 2017 (build 5.48.13801.0)
Started On Sun May 21 10:44:47 2017

Engine: 1.1.13701.0
Signatures: 1.241.491.0
Run Mode: Interactive Graphical Mode

Results Summary:
----------------
No infection found.
Successfully Submitted MAPS Report
Successfully Submitted Heartbeat Report
Microsoft Windows Malicious Software Removal Tool Finished On Sun May 21 10:49:44 2017

Return code: 0 (0x0)
 

MBScan.txt

[kevinf80]

The only issue you had was caused by this Program vSnapshot We remove that issue with FRST fix, we also do some general maintenance clean up your system....

vSnapshot will more than likely have came in piggybacked to some kind of free software... When we have finished cleaning up I recommend you install the following:

UnChecky - https://unchecky.com/ to help stop piggy backed unwanted extras when d/l software McShield - http://www.mcshield.net/ to protect your system from potential malware/infection when plugging in USB devices..   To clean up do the following: Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down: "Delfix link mirror" If your security program alerts to Delfix either, accept the alert or turn your security off. Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked:   Remove disinfection tools <----- this will remove tools we have used. Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created. Reset system settings <--- this will reset any system settings back to default that were changed either by us during cleansing or malware/infection Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Any remnant files/logs from tools we have used can be deleted… Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful.... Answers to Common Security Questions and best Practices Do I need a Registry Cleaner? Take care and surf safe Kevin...

[Blanknight]

I see. Anyway, the computer is running perfectly now, no new problems detected. Truly, thanks a lot for fixing it for me.

 

Take care,

Blanknight

[exile360]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.