Publicité
Publicité
Format du document : text/plain
Prévisualisation
Resultado do exame da Farbar Recovery Scan Tool (FRST) (x64) Versão: 25-01-2017 01
Executado por i3 (administrador) em I3-PC (26-01-2017 15:53:59)
Executando a partir de C:\Users\i3\Desktop
Perfis Carregados: i3 (Perfis Disponíveis: i3 & Administrador)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Idioma: Português (Brasil)
Internet Explorer Versão 11 (Navegador padrão: Chrome)
Modo da Inicialização: Normal
Tutorial da Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processos (Whitelisted) =================
(Se uma entrada for incluída na fixlist, o processo será fechado. O arquivo não será movido.)
(GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe
() C:\Program Files (x86)\UPCleaner\0.8.45.10803\UGSvc.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
() C:\Program Files (x86)\AnyDesk\AnyDesk.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler64.exe
(Garmin Ltd. or its subsidiaries) C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.4\bin\pg_ctl.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.4\bin\postgres.exe
(GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.4\bin\postgres.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(A.E.T. Europe B.V.) C:\Windows\System32\aetcrss1.exe
(GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe
() C:\Program Files (x86)\AnyDesk\AnyDesk.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registro (Whitelisted) ====================
(Se uma entrada for incluída na fixlist, o ítem no Registro será restaurado para o padrão ou removido. O arquivo não será movido.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11613288 2010-11-19] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1340192 2016-01-29] (Microsoft Corporation)
HKLM\...\Run: [CertificateRegistration] => C:\Windows\system32\aetcrss1.exe [25600 2013-03-04] (A.E.T. Europe B.V.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated)
HKLM\...\Run: [Diebold - Warsaw] => C:\Program Files\Diebold\Warsaw\core.exe [925744 2016-06-23] (GAS Tecnologia LTDA)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2383040 2016-10-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [IniciarPrograma] => C:\NetStart\PDV\Integracao.exe [745984 2016-04-20] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596504 2016-04-01] (Oracle Corporation)
Winlogon\Notify\ GbPluginBb: C:\Program Files (x86)\GbPlugin\gbieh.dll [2015-03-10] (Banco do Brasil)
Winlogon\Notify\ GbPluginCef: C:\Program Files (x86)\GbPlugin\gbiehCef.dll [2016-12-08] (Caixa Economica Federal)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1 [0 2017-01-20] ()
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1 [0 2017-01-20] ()
HKU\S-1-5-21-3110093057-3549608537-592685653-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-3110093057-3549608537-592685653-1000\...\Run: [GarminExpressTrayApp] => "C:\Program Files (x86)\Garmin\Express Tray\tray.exe"
HKU\S-1-5-21-3110093057-3549608537-592685653-1000\...\Run: [Adobe Acrobat Synchronizer] => "C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe"
HKU\S-1-5-21-3110093057-3549608537-592685653-1000\...\Run: [Chromium] => c:\users\i3\appdata\local\chromium\application\chrome.exe --auto-launch-at-startup --profile-directory=Default --restore-last-session
HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1407912 2017-01-16] (Garmin Ltd. or its subsidiaries)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-04-15] (Microsoft Corporation)
ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\Program Files (x86)\GbPlugin\gbieh.dll [1864576 2015-03-10] (Banco do Brasil)
ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399003} - C:\PROGRAM FILES (X86)\GbPlugin\gbiehcef.dll [1903328 2016-12-08] (Caixa Economica Federal)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Nenhum Arquivo
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AnyDesk.lnk [2015-10-22]
ShortcutTarget: AnyDesk.lnk -> C:\Program Files (x86)\AnyDesk\AnyDesk.exe ()
GroupPolicy: Restrição - Chrome <======= ATENÇÃO
CHR HKLM\SOFTWARE\Policies\Google: Restrição <======= ATENÇÃO
==================== Internet (Whitelisted) ====================
(Se um ítem for incluído na fixlist, sendo um ítem do Registro, será removido ou restaurado para o padrão.)
Hosts: Há mais de uma entrada no Hosts. Veja a seção Hosts do Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{AC22ADD4-351C-46D1-A35C-F91BA9C3956A}: [DhcpNameServer] 192.168.0.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://br.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_aslgsfs_17_04¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyByE0DtDtB0ByE0F0ByE0Dzy0CyE0FyCtN0D0Tzu0StCzzyEzytN1L2XzutAtFtByDtFtCtFtCtDzztN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StBtD0E0AyEyCtD0CtGyCtDtAtBtGyD0AtA0CtGtB0ByDtBtGtDzyzztAtD0Dzy0D0F0DzytC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyD0B0FyE0D0B0DtGyDyEyBzytGyEtC0FtDtGzyyDyC0AtG0F0Fzy0FtD0B0D0D0Azyzyzy2QtN0A0LzutB%26cr%3D1854743941%26a%3Dwbf_aslgsfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1420045648&from=smt&uid=WDCXWD2000JS-98NCB1_WD-WCANL169595095950&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1428491558&from=wpm040831&uid=WDCXWD2000JS-98NCB1_WD-WCANL169595095950
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1420045648&from=smt&uid=WDCXWD2000JS-98NCB1_WD-WCANL169595095950&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-3110093057-3549608537-592685653-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.delta-homes.com/web/?type=ds&ts=1428491558&from=wpm040831&uid=WDCXWD2000JS-98NCB1_WD-WCANL169595095950&q={searchTerms}
HKU\S-1-5-21-3110093057-3549608537-592685653-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pt-br/?ocid=iehp
HKU\S-1-5-21-3110093057-3549608537-592685653-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.delta-homes.com/web/?type=ds&ts=1428491558&from=wpm040831&uid=WDCXWD2000JS-98NCB1_WD-WCANL169595095950&q={searchTerms}
URLSearchHook: [S-1-5-21-3110093057-3549608537-592685653-1000] ATENÇÃO => A URLSearchHook Padrão está ausente
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_aslgsfs_17_04¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyByE0DtDtB0ByE0F0ByE0Dzy0CyE0FyCtN0D0Tzu0StCzzyEzytN1L2XzutAtFtByDtFtCtFtCtDzztN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StBtD0E0AyEyCtD0CtGyCtDtAtBtGyD0AtA0CtGtB0ByDtBtGtDzyzztAtD0Dzy0D0F0DzytC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyD0B0FyE0D0B0DtGyDyEyBzytGyEtC0FtDtGzyyDyC0AtG0F0Fzy0FtD0B0D0D0Azyzyzy2QtN0A0LzutB%26cr%3D1854743941%26a%3Dwbf_aslgsfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_aslgsfs_17_04¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyByE0DtDtB0ByE0F0ByE0Dzy0CyE0FyCtN0D0Tzu0StCzzyEzytN1L2XzutAtFtByDtFtCtFtCtDzztN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StBtD0E0AyEyCtD0CtGyCtDtAtBtGyD0AtA0CtGtB0ByDtBtGtDzyzztAtD0Dzy0D0F0DzytC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyD0B0FyE0D0B0DtGyDyEyBzytGyEtC0FtDtGzyyDyC0AtG0F0Fzy0FtD0B0D0D0Azyzyzy2QtN0A0LzutB%26cr%3D1854743941%26a%3Dwbf_aslgsfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_aslgsfs_17_04¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyByE0DtDtB0ByE0F0ByE0Dzy0CyE0FyCtN0D0Tzu0StCzzyEzytN1L2XzutAtFtByDtFtCtFtCtDzztN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StBtD0E0AyEyCtD0CtGyCtDtAtBtGyD0AtA0CtGtB0ByDtBtGtDzyzztAtD0Dzy0D0F0DzytC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyD0B0FyE0D0B0DtGyDyEyBzytGyEtC0FtDtGzyyDyC0AtG0F0Fzy0FtD0B0D0D0Azyzyzy2QtN0A0LzutB%26cr%3D1854743941%26a%3Dwbf_aslgsfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM-x32 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
SearchScopes: HKLM-x32 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_aslgsfs_17_04¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyByE0DtDtB0ByE0F0ByE0Dzy0CyE0FyCtN0D0Tzu0StCzzyEzytN1L2XzutAtFtByDtFtCtFtCtDzztN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StBtD0E0AyEyCtD0CtGyCtDtAtBtGyD0AtA0CtGtB0ByDtBtGtDzyzztAtD0Dzy0D0F0DzytC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyD0B0FyE0D0B0DtGyDyEyBzytGyEtC0FtDtGzyyDyC0AtG0F0Fzy0FtD0B0D0D0Azyzyzy2QtN0A0LzutB%26cr%3D1854743941%26a%3Dwbf_aslgsfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3110093057-3549608537-592685653-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_aslgsfs_17_04¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyByE0DtDtB0ByE0F0ByE0Dzy0CyE0FyCtN0D0Tzu0StCzzyEzytN1L2XzutAtFtByDtFtCtFtCtDzztN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StBtD0E0AyEyCtD0CtGyCtDtAtBtGyD0AtA0CtGtB0ByDtBtGtDzyzztAtD0Dzy0D0F0DzytC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyD0B0FyE0D0B0DtGyDyEyBzytGyEtC0FtDtGzyyDyC0AtG0F0Fzy0FtD0B0D0D0Azyzyzy2QtN0A0LzutB%26cr%3D1854743941%26a%3Dwbf_aslgsfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3110093057-3549608537-592685653-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_aslgsfs_17_04¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyByE0DtDtB0ByE0F0ByE0Dzy0CyE0FyCtN0D0Tzu0StCzzyEzytN1L2XzutAtFtByDtFtCtFtCtDzztN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StBtD0E0AyEyCtD0CtGyCtDtAtBtGyD0AtA0CtGtB0ByDtBtGtDzyzztAtD0Dzy0D0F0DzytC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyD0B0FyE0D0B0DtGyDyEyBzytGyEtC0FtDtGzyyDyC0AtG0F0Fzy0FtD0B0D0D0Azyzyzy2QtN0A0LzutB%26cr%3D1854743941%26a%3Dwbf_aslgsfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3110093057-3549608537-592685653-1000 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
SearchScopes: HKU\S-1-5-21-3110093057-3549608537-592685653-1000 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040831&utm_campaign=install_ie&utm_content=ds&from=wpm040831&uid=WDCXWD2000JS-98NCB1_WD-WCANL169595095950&ts=1428491616&type=default&q={searchTerms}
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Sem Nome -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> Nenhum Arquivo
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-04-25] (Oracle Corporation)
BHO-x32: Auxiliar de Conexão de Conta da Microsoft -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540000} -> C:\Program Files (x86)\GbPlugin\gbieh.dll [2015-03-10] (Banco do Brasil)
BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540003} -> C:\PROGRAM FILES (X86)\GBPLUGIN\gbiehcef.dll [2016-12-08] (Caixa Economica Federal)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-04-25] (Oracle Corporation)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1420045648&from=smt&uid=WDCXWD2000JS-98NCB1_WD-WCANL169595095950
FireFox:
========
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2016-10-25] (Adobe Systems)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2016-10-06] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-04-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-04-25] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=6.0.11.2571 -> C:\Program Files (x86)\Real Alternative\browser\plugins\nppl3260.dll [2006-10-07] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.1739 -> C:\Program Files (x86)\Real Alternative\browser\plugins\nprpjplug.dll [2006-10-07] (RealNetworks, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2016-10-25] (Adobe Systems)
FF Plugin HKU\S-1-5-21-3110093057-3549608537-592685653-1000: gastecnologia.com.br/sf/bb -> C:\Users\i3\AppData\Local\GAS Tecnologia\GBBD\npsf_bb.dll [2014-08-15] (GAS Tecnologia)
FF Plugin HKU\S-1-5-21-3110093057-3549608537-592685653-1000: gastecnologia.com.br/sf/cef -> C:\Users\i3\AppData\Local\GAS Tecnologia\GBBD\npsf_cef.dll [2014-12-22] (GAS Tecnologia)
Chrome:
=======
CHR DefaultProfile: Profile 3
CHR HomePage: Profile 3 -> hxxp://www.search.ask.com/?gct=hp
CHR StartupUrls: Profile 3 -> "hxxps://www.facebook.com/"
CHR Profile: C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 2 [2015-04-14]
CHR Extension: (Google Docs) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-04]
CHR Extension: (Google Drive) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-04]
CHR Extension: (YouTube) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-04]
CHR Extension: (Google Search) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-03-30]
CHR Extension: (Zwinky) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\fidlffpkjchmiflngkkakcmbjmehkdbg [2015-04-08]
CHR Extension: (Google Wallet) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-03-05]
CHR Extension: (Gmail) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-30]
CHR Profile: C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 3 [2017-01-26]
CHR Extension: (Adblock Plus) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-10-27]
CHR Extension: (Pagamentos da Chrome Web Store) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-19]
CHR Extension: (GBBD Caixa Economica Federal) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\nnjbodopomfddehlalfilheomcahbpei [2015-04-14]
CHR Extension: (Chrome Media Router) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-17]
CHR HKLM\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3110093057-3549608537-592685653-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fnelgfmpooffemibikhmcklfnnimgijo] - C:\Users\i3\AppData\Local\CRE\fnelgfmpooffemibikhmcklfnnimgijo.crx
CHR HKU\S-1-5-21-3110093057-3549608537-592685653-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nnjbodopomfddehlalfilheomcahbpei] - C:\Users\i3\AppData\Local\GAS Tecnologia\GBBD\cef\sf.crx [2014-08-19]
CHR HKU\S-1-5-21-3110093057-3549608537-592685653-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fnelgfmpooffemibikhmcklfnnimgijo] - C:\Users\i3\AppData\Local\CRE\fnelgfmpooffemibikhmcklfnnimgijo.crx
CHR HKLM-x32\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
==================== Serviços (Whitelisted) ====================
(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2207960 2016-09-26] (Adobe Systems, Incorporated)
R2 AnyDesk; C:\Program Files (x86)\AnyDesk\AnyDesk.exe [1344608 2015-05-16] ()
R2 Garmin Device Interaction Service; C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe [1039376 2017-01-16] (Garmin Ltd. or its subsidiaries)
R2 GbpSv; C:\Program Files (x86)\GbPlugin\gbpsv.exe [631520 2016-12-08] (GAS Tecnologia)
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [Arquivo não assinado]
S3 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2016-01-29] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [374344 2016-01-29] (Microsoft Corporation)
R2 postgresql-9.4; C:\Program Files (x86)\PostgreSQL\9.4\bin\pg_ctl.exe [78848 2015-05-20] (PostgreSQL Global Development Group) [Arquivo não assinado]
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [Arquivo não assinado]
R2 UGSVC; C:\Program Files (x86)\UPCleaner\0.8.45.10803\UGSvc.exe [656768 2015-07-27] ()
R2 Warsaw Technology; C:\Program Files\Diebold\Warsaw\core.exe [925744 2016-06-23] (GAS Tecnologia LTDA)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
===================== Drivers (Whitelisted) ======================
(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)
S3 EZUSB; C:\Windows\System32\DRIVERS\ezusb64.sys [33280 2009-09-28] (Castles Technology Co.,Ltd)
S1 gbpddfac; C:\Windows\System32\drivers\gbpddfac64.sys [28888 2016-09-05] (GAS Tecnologia)
S1 gbpddfac; C:\Windows\SysWOW64\drivers\gbpddfac64.sys [28888 2015-12-08] (GAS Tecnologia)
R3 GBPRCM; C:\Program Files (x86)\GbPlugin\gbprcm64.sys [29912 2015-12-08] (GAS Tecnologia)
S3 MpFilter; C:\Windows\system32\DRIVERS\MpFilter.sys [289120 2015-11-13] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133816 2015-11-13] (Microsoft Corporation)
S3 Warsaw_PP; C:\Program Files (x86)\GbPlugin\wsftprp64.sys [24792 2014-10-31] (GAS Tecnologia LTDA)
S1 wsddfac; C:\Windows\System32\drivers\wsddfac.sys [101080 2016-09-08] (GAS Tecnologia)
R1 wsddntf; C:\Windows\System32\DRIVERS\wsddntf.sys [36984 2016-06-16] (GAS Tecnologia)
S1 wsddpp; C:\Windows\system32\drivers\wsddpp.sys [97376 2016-06-08] (GAS Tecnologia)
S3 BprotectEx; \??\C:\Windows\System32\drivers\BprotectEx.sys [X]
S0 gbpddreg; system32\drivers\gbpddreg64.sys [X]
S2 NPF; \??\C:\Program Files (x86)\UPCleaner\0.8.45.10803\npf64.sys [X]
S3 PCFApiUtil; \??\C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\PCFApiUtil64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S1 UGBroMon; \??\C:\Program Files (x86)\UPCleaner\0.8.45.10803\UGBroMon64.sys [X]
S1 UGKrnlDrv; \??\C:\Program Files (x86)\UPCleaner\0.8.45.10803\UGKrnlDrv64.sys [X]
S1 UGProtect; \??\C:\Program Files (x86)\UPCleaner\0.8.45.10803\UGProtect64.sys [X]
S2 UPKernel; \??\C:\Program Files (x86)\UPCleaner\0.8.45.10803\UPKernel64.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)
==================== Um Mês Criados arquivos e pastas ========
(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)
2017-01-26 15:44 - 2017-01-26 15:46 - 00033367 _____ C:\Users\i3\Desktop\Addition.txt
2017-01-26 15:43 - 2017-01-26 15:53 - 00025991 _____ C:\Users\i3\Desktop\FRST.txt
2017-01-26 15:43 - 2017-01-26 15:53 - 00000000 ____D C:\FRST
2017-01-26 15:43 - 2017-01-26 15:43 - 02420736 _____ (Farbar) C:\Users\i3\Downloads\FRST64.exe
2017-01-26 15:41 - 2017-01-26 15:42 - 02420736 _____ (Farbar) C:\Users\i3\Desktop\FRST64.exe
2017-01-26 15:41 - 2017-01-26 15:41 - 01762816 _____ (Farbar) C:\Users\i3\Downloads\FRST.exe
2017-01-23 17:29 - 2017-01-23 17:30 - 01034556 _____ C:\Users\i3\Downloads\api-ms-win-crt-runtime-l1-1-0.dll
2017-01-23 10:41 - 2017-01-26 15:10 - 00000000 ____D C:\Users\i3\AppData\Local\{9A5CAC00-BEF4-C0B8-D36C-E550F70419C8}
2017-01-23 10:29 - 2017-01-23 10:29 - 00000000 ____D C:\Users\Todos os Usuários\TweakBit
2017-01-23 10:29 - 2017-01-23 10:29 - 00000000 ____D C:\ProgramData\TweakBit
2017-01-23 10:28 - 2017-01-23 10:28 - 00407784 _____ (TweakBit) C:\Users\i3\Downloads\fix_api-ms-win-crt-runtime-l1-1-0.dll-setup.exe
2017-01-20 14:43 - 2016-11-09 21:49 - 00036651 _____ C:\Users\i3\Desktop\AdobePremierePro11AllTrial.pimx
2017-01-20 14:38 - 2016-03-31 16:49 - 00000566 _____ C:\Users\i3\Desktop\AdobeFontsRecommended_x64-mul.pimx
2017-01-20 14:37 - 2017-01-20 14:37 - 00000000 ____D C:\Users\i3\Desktop\2
2017-01-20 14:37 - 2016-03-31 16:48 - 00000557 _____ C:\Users\i3\Desktop\AdobeFontsRequired_x64-mul.pimx
2017-01-20 14:36 - 2017-01-20 14:37 - 00000000 ____D C:\Users\i3\Desktop\1
2017-01-20 11:06 - 2016-11-17 03:34 - 00000000 ____D C:\Users\i3\Desktop\Crack
2017-01-19 17:39 - 2017-01-20 14:44 - 00001106 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Premiere Pro CC 2017.lnk
2017-01-19 17:39 - 2017-01-19 17:39 - 00000000 ____D C:\Users\Public\Documents\Adobe
2017-01-19 17:35 - 2017-01-19 17:35 - 00000000 ____D C:\Users\Public\Documents\AdobeInstalledCodecs
2017-01-19 17:22 - 2017-01-19 17:22 - 00001137 _____ C:\Users\Public\Desktop\Adobe Creative Cloud.lnk
2017-01-19 15:24 - 2017-01-19 15:52 - 00000000 ____D C:\Users\i3\Downloads\Adobe Premiere Pro CC 2017 v11.0.1 + Crack [SadeemPC]
2017-01-18 08:48 - 2017-01-18 08:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
2017-01-16 16:15 - 2017-01-16 16:15 - 00867230 _____ C:\Users\i3\Downloads\PROJETO REVISÃO 2 (3).pdf
2017-01-16 16:14 - 2017-01-16 16:14 - 00852020 _____ C:\Users\i3\Downloads\PROJETO REVISÃO 2 (2).pdf
2017-01-16 16:14 - 2017-01-16 16:14 - 00852020 _____ C:\Users\i3\Downloads\PROJETO REVISÃO 2 (1).pdf
2017-01-16 15:26 - 2017-01-16 15:26 - 00020989 _____ C:\Users\i3\Downloads\PROJETO REVISÃO 2.pdf
2017-01-05 09:32 - 2017-01-05 09:32 - 00001302 _____ C:\Users\i3\Desktop\EasyPHP Devserver 16.1.1.lnk
2017-01-05 09:30 - 2017-01-05 09:32 - 00000000 ____D C:\Program Files (x86)\EasyPHP-Devserver-16.1
2017-01-04 12:42 - 2017-01-04 12:42 - 00192291 _____ C:\Users\i3\Desktop\Dreamweaver crash log (1).mdmp
2017-01-03 13:35 - 2017-01-11 15:22 - 00000000 ____D C:\Users\i3\Desktop\faixada
==================== Um Mês Modificados arquivos e pastas ========
(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)
2017-01-26 15:18 - 2009-07-14 02:45 - 00014128 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-01-26 15:18 - 2009-07-14 02:45 - 00014128 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-01-26 15:10 - 2014-05-29 11:21 - 00000000 __SHD C:\Users\i3\AppData\Local\EmieUserList
2017-01-26 15:10 - 2014-05-29 11:21 - 00000000 __SHD C:\Users\i3\AppData\Local\EmieSiteList
2017-01-26 08:18 - 2015-01-24 15:41 - 00000000 ____D C:\Users\Todos os Usuários\GbPlugin
2017-01-26 08:18 - 2015-01-24 15:41 - 00000000 ____D C:\ProgramData\GbPlugin
2017-01-26 08:18 - 2009-07-14 03:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-25 14:54 - 2015-10-21 15:28 - 00002281 _____ C:\Users\i3\Desktop\Ciaf-800 - Atalho.lnk
2017-01-20 08:17 - 2014-04-10 20:24 - 00088328 _____ C:\Users\i3\AppData\Local\GDIPFONTCACHEV1.DAT
2017-01-20 08:15 - 2009-07-14 02:45 - 05042000 _____ C:\Windows\system32\FNTCACHE.DAT
2017-01-19 17:39 - 2014-06-06 17:59 - 00000000 ____D C:\Program Files\Adobe
2017-01-19 17:39 - 2014-06-06 17:47 - 00000000 ____D C:\Program Files\Common Files\Adobe
2017-01-19 17:39 - 2014-06-06 17:24 - 00000000 ____D C:\Users\Todos os Usuários\Adobe
2017-01-19 17:39 - 2014-06-06 17:24 - 00000000 ____D C:\ProgramData\Adobe
2017-01-19 17:39 - 2014-04-17 10:43 - 00000000 ____D C:\Users\i3\AppData\Roaming\Adobe
2017-01-19 17:25 - 2014-04-15 17:44 - 00000000 ____D C:\Users\i3\AppData\Roaming\uTorrent
2017-01-19 17:22 - 2015-02-11 11:02 - 00001149 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk
2017-01-19 15:39 - 2016-04-02 14:50 - 00001456 _____ C:\Users\i3\AppData\Local\Adobe Salvar para Web 13.0 Prefs
2017-01-19 08:17 - 2014-06-06 17:23 - 00000000 ____D C:\Users\i3\AppData\Local\Adobe
2017-01-19 08:14 - 2014-08-19 15:49 - 00000000 ____D C:\Users\Todos os Usuários\boost_interprocess
2017-01-19 08:14 - 2014-08-19 15:49 - 00000000 ____D C:\ProgramData\boost_interprocess
2017-01-18 08:49 - 2015-04-09 11:35 - 00000000 ____D C:\Program Files (x86)\Garmin
2017-01-18 08:49 - 2015-02-11 11:00 - 00000000 ____D C:\Users\Todos os Usuários\Package Cache
2017-01-18 08:49 - 2015-02-11 11:00 - 00000000 ____D C:\ProgramData\Package Cache
2017-01-18 08:48 - 2015-04-09 11:35 - 00003554 _____ C:\Windows\System32\Tasks\GarminUpdaterTask
2017-01-12 16:31 - 2014-05-21 16:46 - 00000000 ____D C:\Users\i3\AppData\Roaming\vlc
2017-01-12 14:47 - 2016-09-14 12:26 - 00000000 ____D C:\Users\i3\Documents\Adobe
2017-01-09 14:19 - 2015-08-03 12:21 - 00000132 _____ C:\Users\i3\AppData\Roaming\Preferências do Formato PNG do Adobe CS6
2017-01-06 08:18 - 2014-04-10 20:25 - 00000000 ____D C:\Program Files (x86)\Google
2017-01-05 09:33 - 2016-03-30 16:59 - 00000000 ____D C:\Users\i3\Desktop\franklin
2017-01-03 15:11 - 2016-10-05 12:28 - 00000000 ____D C:\Users\i3\Desktop\Imagens_D.Rossi
2017-01-03 13:38 - 2016-03-03 12:58 - 00000000 ____D C:\Users\i3\Desktop\cleise
2017-01-03 10:08 - 2009-07-29 14:08 - 00705474 _____ C:\Windows\system32\prfh0416.dat
2017-01-03 10:08 - 2009-07-29 14:08 - 00147314 _____ C:\Windows\system32\prfc0416.dat
2017-01-03 10:08 - 2009-07-14 03:13 - 01634498 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-03 10:08 - 2009-07-14 01:20 - 00000000 ____D C:\Windows\inf
==================== Arquivos na raiz de alguns diretórios =======
2016-02-27 16:10 - 2016-09-14 12:44 - 0000132 _____ () C:\Users\i3\AppData\Roaming\Preferências do Formato GIF do Adobe CS6
2015-08-03 12:21 - 2017-01-09 14:19 - 0000132 _____ () C:\Users\i3\AppData\Roaming\Preferências do Formato PNG do Adobe CS6
2014-08-19 15:49 - 2014-08-19 15:49 - 0015595 _____ () C:\Users\i3\AppData\Roaming\unins000.dat
2014-08-19 15:49 - 2014-08-19 15:49 - 0730322 _____ () C:\Users\i3\AppData\Roaming\unins000.exe
2015-01-24 15:39 - 2015-01-24 15:40 - 0016820 _____ () C:\Users\i3\AppData\Roaming\unins001.dat
2015-01-24 15:39 - 2015-01-24 15:39 - 0815314 _____ () C:\Users\i3\AppData\Roaming\unins001.exe
2016-04-02 14:50 - 2017-01-19 15:39 - 0001456 _____ () C:\Users\i3\AppData\Local\Adobe Salvar para Web 13.0 Prefs
2016-05-05 12:08 - 2016-05-05 12:08 - 0003584 _____ () C:\Users\i3\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-08-06 17:26 - 2014-08-06 17:26 - 0007602 _____ () C:\Users\i3\AppData\Local\Resmon.ResmonCfg
Alguns arquivos em TEMP:
====================
2014-04-15 19:19 - 2014-04-15 19:20 - 1164000 _____ (Highlightly) C:\Users\i3\AppData\Local\Temp\2vdc1b1x.na4.exe
2015-10-19 08:35 - 2015-10-19 08:35 - 4320072 _____ (Google) C:\Users\i3\AppData\Local\Temp\7E87.exe
2015-08-12 10:03 - 2015-08-12 10:03 - 0735248 _____ () C:\Users\i3\AppData\Local\Temp\Adobe Dreamweaver CC 2015 7698 Crack Serial Key__10924_i1579050919_il453782.exe
2015-08-12 10:12 - 2015-08-12 10:12 - 0735248 _____ () C:\Users\i3\AppData\Local\Temp\Adobe Dreamweaver CC 2015 7698 Crack Serial Key__10924_i1579056411_il453782.exe
2015-10-16 18:20 - 2015-05-16 10:53 - 1344608 _____ () C:\Users\i3\AppData\Local\Temp\AnyDeskUninst093c.exe
2015-02-10 09:31 - 2015-02-10 09:31 - 0663448 _____ (Ask Partner Network) C:\Users\i3\AppData\Local\Temp\APNSetup.exe
2015-05-25 09:34 - 2015-05-25 09:34 - 4694856 _____ (Google) C:\Users\i3\AppData\Local\Temp\B07D.exe
2014-04-15 17:44 - 2014-04-15 17:44 - 19943464 _____ (Baidu, Inc.) C:\Users\i3\AppData\Local\Temp\Baidu_Secure_SystemUp_4.0.5.64967.exe
2014-12-31 15:14 - 2014-12-31 15:14 - 0152688 _____ (C.L.A.R.A) C:\Users\i3\AppData\Local\Temp\ce98ac2e-20c0-4a93-86f6-bdb3e61caf55.exe
2016-11-23 08:47 - 2016-11-23 08:47 - 0737856 _____ (Oracle Corporation) C:\Users\i3\AppData\Local\Temp\jre-8u111-windows-au.exe
2014-12-18 15:29 - 2014-12-18 15:29 - 0641448 _____ (Oracle Corporation) C:\Users\i3\AppData\Local\Temp\jre-8u31-windows-au.exe
2015-08-12 10:15 - 2015-08-12 10:15 - 0703272 _____ (Opera Software) C:\Users\i3\AppData\Local\Temp\Opera_NI_stable.exe
2014-04-15 19:19 - 2014-04-15 19:20 - 1563291 _____ () C:\Users\i3\AppData\Local\Temp\p4avzll1.ebr.exe
2014-12-31 15:05 - 2014-12-31 15:05 - 0308320 _____ (One Syn) C:\Users\i3\AppData\Local\Temp\smt_mystartsearch.exe
2014-04-15 19:05 - 2013-03-12 06:59 - 0275552 ___RS (Tarma Software Research Pty Ltd) C:\Users\i3\AppData\Local\Temp\Tsu9BFDDD96.dll
2014-07-08 14:16 - 2014-07-08 14:16 - 0005757 _____ () C:\Users\i3\AppData\Local\Temp\UNT8729.tmp.exe
2014-07-08 14:16 - 2014-07-08 14:16 - 0117957 _____ () C:\Users\i3\AppData\Local\Temp\UNT8768.tmp.exe
2014-07-08 14:16 - 2014-07-08 14:16 - 0291697 _____ () C:\Users\i3\AppData\Local\Temp\UNT8769.tmp.exe
2014-07-08 14:16 - 2014-07-08 14:16 - 0005937 _____ () C:\Users\i3\AppData\Local\Temp\UNT876A.tmp.exe
2014-07-08 14:16 - 2014-07-08 14:16 - 0179277 _____ () C:\Users\i3\AppData\Local\Temp\UNT876B.tmp.exe
2014-07-08 14:16 - 2014-07-08 14:16 - 0152997 _____ () C:\Users\i3\AppData\Local\Temp\UNT876C.tmp.exe
2014-07-08 14:16 - 2014-07-08 14:16 - 0004394 _____ () C:\Users\i3\AppData\Local\Temp\UNT876D.tmp.exe
2014-07-08 14:16 - 2014-07-08 14:16 - 0031093 _____ () C:\Users\i3\AppData\Local\Temp\UNT876E.tmp.exe
2014-07-08 14:16 - 2014-07-08 14:16 - 0024857 _____ () C:\Users\i3\AppData\Local\Temp\UNT877F.tmp.exe
2014-07-08 14:17 - 2014-07-08 14:17 - 0005757 _____ () C:\Users\i3\AppData\Local\Temp\UNTE030.tmp.exe
2014-07-08 14:17 - 2014-07-08 14:17 - 0244977 _____ () C:\Users\i3\AppData\Local\Temp\UNTE031.tmp.exe
2014-07-08 14:17 - 2014-07-08 14:17 - 0039117 _____ () C:\Users\i3\AppData\Local\Temp\UNTE032.tmp.exe
2014-07-08 14:17 - 2014-07-08 14:17 - 0005937 _____ () C:\Users\i3\AppData\Local\Temp\UNTE033.tmp.exe
2014-07-08 14:17 - 2014-07-08 14:17 - 0087297 _____ () C:\Users\i3\AppData\Local\Temp\UNTE034.tmp.exe
2014-07-08 14:17 - 2014-07-08 14:17 - 0224537 _____ () C:\Users\i3\AppData\Local\Temp\UNTE035.tmp.exe
2014-07-08 14:17 - 2014-07-08 14:17 - 0004394 _____ () C:\Users\i3\AppData\Local\Temp\UNTE046.tmp.exe
2014-07-08 14:17 - 2014-07-08 14:17 - 0031093 _____ () C:\Users\i3\AppData\Local\Temp\UNTE047.tmp.exe
2014-07-08 14:17 - 2014-07-08 14:17 - 0024857 _____ () C:\Users\i3\AppData\Local\Temp\UNTE048.tmp.exe
2014-04-15 17:46 - 2014-04-15 17:46 - 0081768 _____ (Conduit) C:\Users\i3\AppData\Local\Temp\utt4630.tmp.exe
2014-06-06 18:24 - 2014-06-06 18:24 - 0308076 _____ () C:\Users\i3\AppData\Local\Temp\_inst1.exe
2015-01-24 15:59 - 2015-01-24 15:59 - 0308076 _____ () C:\Users\i3\AppData\Local\Temp\_inst2.exe
2006-05-24 01:10 - 2006-05-24 01:10 - 0455600 ____R (Macrovision Corporation) C:\Users\i3\AppData\Local\Temp\_isE648.exe
==================== Bamital & volsnap ======================
(Não há correção automática para arquivos que não passaram na verificação.)
C:\Windows\system32\winlogon.exe => O arquivo é assinado digitalmente
C:\Windows\system32\wininit.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\wininit.exe => O arquivo é assinado digitalmente
C:\Windows\explorer.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\explorer.exe => O arquivo é assinado digitalmente
C:\Windows\system32\svchost.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\svchost.exe => O arquivo é assinado digitalmente
C:\Windows\system32\services.exe => O arquivo é assinado digitalmente
C:\Windows\system32\User32.dll => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\User32.dll => O arquivo é assinado digitalmente
C:\Windows\system32\userinit.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\userinit.exe => O arquivo é assinado digitalmente
C:\Windows\system32\rpcss.dll => O arquivo é assinado digitalmente
C:\Windows\system32\dnsapi.dll => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\dnsapi.dll => O arquivo é assinado digitalmente
C:\Windows\system32\Drivers\volsnap.sys => O arquivo é assinado digitalmente
LastRegBack: 2017-01-23 16:53
==================== Fim de FRST.txt ============================
Executado por i3 (administrador) em I3-PC (26-01-2017 15:53:59)
Executando a partir de C:\Users\i3\Desktop
Perfis Carregados: i3 (Perfis Disponíveis: i3 & Administrador)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Idioma: Português (Brasil)
Internet Explorer Versão 11 (Navegador padrão: Chrome)
Modo da Inicialização: Normal
Tutorial da Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processos (Whitelisted) =================
(Se uma entrada for incluída na fixlist, o processo será fechado. O arquivo não será movido.)
(GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe
() C:\Program Files (x86)\UPCleaner\0.8.45.10803\UGSvc.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
() C:\Program Files (x86)\AnyDesk\AnyDesk.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.32.7\GoogleCrashHandler64.exe
(Garmin Ltd. or its subsidiaries) C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.4\bin\pg_ctl.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.4\bin\postgres.exe
(GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.4\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.4\bin\postgres.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(A.E.T. Europe B.V.) C:\Windows\System32\aetcrss1.exe
(GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe
() C:\Program Files (x86)\AnyDesk\AnyDesk.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registro (Whitelisted) ====================
(Se uma entrada for incluída na fixlist, o ítem no Registro será restaurado para o padrão ou removido. O arquivo não será movido.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11613288 2010-11-19] (Realtek Semiconductor)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1340192 2016-01-29] (Microsoft Corporation)
HKLM\...\Run: [CertificateRegistration] => C:\Windows\system32\aetcrss1.exe [25600 2013-03-04] (A.E.T. Europe B.V.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated)
HKLM\...\Run: [Diebold - Warsaw] => C:\Program Files\Diebold\Warsaw\core.exe [925744 2016-06-23] (GAS Tecnologia LTDA)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2383040 2016-10-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [IniciarPrograma] => C:\NetStart\PDV\Integracao.exe [745984 2016-04-20] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596504 2016-04-01] (Oracle Corporation)
Winlogon\Notify\ GbPluginBb: C:\Program Files (x86)\GbPlugin\gbieh.dll [2015-03-10] (Banco do Brasil)
Winlogon\Notify\ GbPluginCef: C:\Program Files (x86)\GbPlugin\gbiehCef.dll [2016-12-08] (Caixa Economica Federal)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1 [0 2017-01-20] ()
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1 [0 2017-01-20] ()
HKU\S-1-5-21-3110093057-3549608537-592685653-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-3110093057-3549608537-592685653-1000\...\Run: [GarminExpressTrayApp] => "C:\Program Files (x86)\Garmin\Express Tray\tray.exe"
HKU\S-1-5-21-3110093057-3549608537-592685653-1000\...\Run: [Adobe Acrobat Synchronizer] => "C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe"
HKU\S-1-5-21-3110093057-3549608537-592685653-1000\...\Run: [Chromium] => c:\users\i3\appdata\local\chromium\application\chrome.exe --auto-launch-at-startup --profile-directory=Default --restore-last-session
HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1407912 2017-01-16] (Garmin Ltd. or its subsidiaries)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-04-15] (Microsoft Corporation)
ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\Program Files (x86)\GbPlugin\gbieh.dll [1864576 2015-03-10] (Banco do Brasil)
ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399003} - C:\PROGRAM FILES (X86)\GbPlugin\gbiehcef.dll [1903328 2016-12-08] (Caixa Economica Federal)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2016-10-25] ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Nenhum Arquivo
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AnyDesk.lnk [2015-10-22]
ShortcutTarget: AnyDesk.lnk -> C:\Program Files (x86)\AnyDesk\AnyDesk.exe ()
GroupPolicy: Restrição - Chrome <======= ATENÇÃO
CHR HKLM\SOFTWARE\Policies\Google: Restrição <======= ATENÇÃO
==================== Internet (Whitelisted) ====================
(Se um ítem for incluído na fixlist, sendo um ítem do Registro, será removido ou restaurado para o padrão.)
Hosts: Há mais de uma entrada no Hosts. Veja a seção Hosts do Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{AC22ADD4-351C-46D1-A35C-F91BA9C3956A}: [DhcpNameServer] 192.168.0.1
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://br.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_aslgsfs_17_04¶m1=1¶m2=f%3D1%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyByE0DtDtB0ByE0F0ByE0Dzy0CyE0FyCtN0D0Tzu0StCzzyEzytN1L2XzutAtFtByDtFtCtFtCtDzztN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StBtD0E0AyEyCtD0CtGyCtDtAtBtGyD0AtA0CtGtB0ByDtBtGtDzyzztAtD0Dzy0D0F0DzytC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyD0B0FyE0D0B0DtGyDyEyBzytGyEtC0FtDtGzyyDyC0AtG0F0Fzy0FtD0B0D0D0Azyzyzy2QtN0A0LzutB%26cr%3D1854743941%26a%3Dwbf_aslgsfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1420045648&from=smt&uid=WDCXWD2000JS-98NCB1_WD-WCANL169595095950&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1428491558&from=wpm040831&uid=WDCXWD2000JS-98NCB1_WD-WCANL169595095950
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1420045648&from=smt&uid=WDCXWD2000JS-98NCB1_WD-WCANL169595095950&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-3110093057-3549608537-592685653-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.delta-homes.com/web/?type=ds&ts=1428491558&from=wpm040831&uid=WDCXWD2000JS-98NCB1_WD-WCANL169595095950&q={searchTerms}
HKU\S-1-5-21-3110093057-3549608537-592685653-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pt-br/?ocid=iehp
HKU\S-1-5-21-3110093057-3549608537-592685653-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.delta-homes.com/web/?type=ds&ts=1428491558&from=wpm040831&uid=WDCXWD2000JS-98NCB1_WD-WCANL169595095950&q={searchTerms}
URLSearchHook: [S-1-5-21-3110093057-3549608537-592685653-1000] ATENÇÃO => A URLSearchHook Padrão está ausente
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_aslgsfs_17_04¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyByE0DtDtB0ByE0F0ByE0Dzy0CyE0FyCtN0D0Tzu0StCzzyEzytN1L2XzutAtFtByDtFtCtFtCtDzztN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StBtD0E0AyEyCtD0CtGyCtDtAtBtGyD0AtA0CtGtB0ByDtBtGtDzyzztAtD0Dzy0D0F0DzytC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyD0B0FyE0D0B0DtGyDyEyBzytGyEtC0FtDtGzyyDyC0AtG0F0Fzy0FtD0B0D0D0Azyzyzy2QtN0A0LzutB%26cr%3D1854743941%26a%3Dwbf_aslgsfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_aslgsfs_17_04¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyByE0DtDtB0ByE0F0ByE0Dzy0CyE0FyCtN0D0Tzu0StCzzyEzytN1L2XzutAtFtByDtFtCtFtCtDzztN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StBtD0E0AyEyCtD0CtGyCtDtAtBtGyD0AtA0CtGtB0ByDtBtGtDzyzztAtD0Dzy0D0F0DzytC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyD0B0FyE0D0B0DtGyDyEyBzytGyEtC0FtDtGzyyDyC0AtG0F0Fzy0FtD0B0D0D0Azyzyzy2QtN0A0LzutB%26cr%3D1854743941%26a%3Dwbf_aslgsfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_aslgsfs_17_04¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyByE0DtDtB0ByE0F0ByE0Dzy0CyE0FyCtN0D0Tzu0StCzzyEzytN1L2XzutAtFtByDtFtCtFtCtDzztN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StBtD0E0AyEyCtD0CtGyCtDtAtBtGyD0AtA0CtGtB0ByDtBtGtDzyzztAtD0Dzy0D0F0DzytC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyD0B0FyE0D0B0DtGyDyEyBzytGyEtC0FtDtGzyyDyC0AtG0F0Fzy0FtD0B0D0D0Azyzyzy2QtN0A0LzutB%26cr%3D1854743941%26a%3Dwbf_aslgsfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKLM-x32 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
SearchScopes: HKLM-x32 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_aslgsfs_17_04¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyByE0DtDtB0ByE0F0ByE0Dzy0CyE0FyCtN0D0Tzu0StCzzyEzytN1L2XzutAtFtByDtFtCtFtCtDzztN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StBtD0E0AyEyCtD0CtGyCtDtAtBtGyD0AtA0CtGtB0ByDtBtGtDzyzztAtD0Dzy0D0F0DzytC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyD0B0FyE0D0B0DtGyDyEyBzytGyEtC0FtDtGzyyDyC0AtG0F0Fzy0FtD0B0D0D0Azyzyzy2QtN0A0LzutB%26cr%3D1854743941%26a%3Dwbf_aslgsfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3110093057-3549608537-592685653-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_aslgsfs_17_04¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyByE0DtDtB0ByE0F0ByE0Dzy0CyE0FyCtN0D0Tzu0StCzzyEzytN1L2XzutAtFtByDtFtCtFtCtDzztN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StBtD0E0AyEyCtD0CtGyCtDtAtBtGyD0AtA0CtGtB0ByDtBtGtDzyzztAtD0Dzy0D0F0DzytC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyD0B0FyE0D0B0DtGyDyEyBzytGyEtC0FtDtGzyyDyC0AtG0F0Fzy0FtD0B0D0D0Azyzyzy2QtN0A0LzutB%26cr%3D1854743941%26a%3Dwbf_aslgsfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3110093057-3549608537-592685653-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://br.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_aslgsfs_17_04¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dbr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyByE0DtDtB0ByE0F0ByE0Dzy0CyE0FyCtN0D0Tzu0StCzzyEzytN1L2XzutAtFtByDtFtCtFtCtDzztN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StBtD0E0AyEyCtD0CtGyCtDtAtBtGyD0AtA0CtGtB0ByDtBtGtDzyzztAtD0Dzy0D0F0DzytC2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0CyD0B0FyE0D0B0DtGyDyEyBzytGyEtC0FtDtGzyyDyC0AtG0F0Fzy0FtD0B0D0D0Azyzyzy2QtN0A0LzutB%26cr%3D1854743941%26a%3Dwbf_aslgsfs_17_04%26os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3110093057-3549608537-592685653-1000 -> {2211d4a5-48d0-47f5-a7cd-81e861470f7f} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
SearchScopes: HKU\S-1-5-21-3110093057-3549608537-592685653-1000 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = hxxp://www.delta-homes.com/web/?utm_source=b&utm_medium=wpm040831&utm_campaign=install_ie&utm_content=ds&from=wpm040831&uid=WDCXWD2000JS-98NCB1_WD-WCANL169595095950&ts=1428491616&type=default&q={searchTerms}
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Sem Nome -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> Nenhum Arquivo
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-04-25] (Oracle Corporation)
BHO-x32: Auxiliar de Conexão de Conta da Microsoft -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540000} -> C:\Program Files (x86)\GbPlugin\gbieh.dll [2015-03-10] (Banco do Brasil)
BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540003} -> C:\PROGRAM FILES (X86)\GBPLUGIN\gbiehcef.dll [2016-12-08] (Caixa Economica Federal)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-04-25] (Oracle Corporation)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1420045648&from=smt&uid=WDCXWD2000JS-98NCB1_WD-WCANL169595095950
FireFox:
========
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2016-10-25] (Adobe Systems)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2016-10-06] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-04-25] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-04-25] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=6.0.11.2571 -> C:\Program Files (x86)\Real Alternative\browser\plugins\nppl3260.dll [2006-10-07] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.1739 -> C:\Program Files (x86)\Real Alternative\browser\plugins\nprpjplug.dll [2006-10-07] (RealNetworks, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-16] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.2.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2016-01-20] (VideoLAN)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2016-10-25] (Adobe Systems)
FF Plugin HKU\S-1-5-21-3110093057-3549608537-592685653-1000: gastecnologia.com.br/sf/bb -> C:\Users\i3\AppData\Local\GAS Tecnologia\GBBD\npsf_bb.dll [2014-08-15] (GAS Tecnologia)
FF Plugin HKU\S-1-5-21-3110093057-3549608537-592685653-1000: gastecnologia.com.br/sf/cef -> C:\Users\i3\AppData\Local\GAS Tecnologia\GBBD\npsf_cef.dll [2014-12-22] (GAS Tecnologia)
Chrome:
=======
CHR DefaultProfile: Profile 3
CHR HomePage: Profile 3 -> hxxp://www.search.ask.com/?gct=hp
CHR StartupUrls: Profile 3 -> "hxxps://www.facebook.com/"
CHR Profile: C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 2 [2015-04-14]
CHR Extension: (Google Docs) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-04]
CHR Extension: (Google Drive) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-04]
CHR Extension: (YouTube) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-04]
CHR Extension: (Google Search) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-03-30]
CHR Extension: (Zwinky) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\fidlffpkjchmiflngkkakcmbjmehkdbg [2015-04-08]
CHR Extension: (Google Wallet) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-03-05]
CHR Extension: (Gmail) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-30]
CHR Profile: C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 3 [2017-01-26]
CHR Extension: (Adblock Plus) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-10-27]
CHR Extension: (Pagamentos da Chrome Web Store) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-19]
CHR Extension: (GBBD Caixa Economica Federal) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\nnjbodopomfddehlalfilheomcahbpei [2015-04-14]
CHR Extension: (Chrome Media Router) - C:\Users\i3\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-17]
CHR HKLM\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3110093057-3549608537-592685653-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fnelgfmpooffemibikhmcklfnnimgijo] - C:\Users\i3\AppData\Local\CRE\fnelgfmpooffemibikhmcklfnnimgijo.crx
CHR HKU\S-1-5-21-3110093057-3549608537-592685653-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nnjbodopomfddehlalfilheomcahbpei] - C:\Users\i3\AppData\Local\GAS Tecnologia\GBBD\cef\sf.crx [2014-08-19]
CHR HKU\S-1-5-21-3110093057-3549608537-592685653-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fnelgfmpooffemibikhmcklfnnimgijo] - C:\Users\i3\AppData\Local\CRE\fnelgfmpooffemibikhmcklfnnimgijo.crx
CHR HKLM-x32\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
==================== Serviços (Whitelisted) ====================
(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2207960 2016-09-26] (Adobe Systems, Incorporated)
R2 AnyDesk; C:\Program Files (x86)\AnyDesk\AnyDesk.exe [1344608 2015-05-16] ()
R2 Garmin Device Interaction Service; C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe [1039376 2017-01-16] (Garmin Ltd. or its subsidiaries)
R2 GbpSv; C:\Program Files (x86)\GbPlugin\gbpsv.exe [631520 2016-12-08] (GAS Tecnologia)
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [Arquivo não assinado]
S3 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2016-01-29] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [374344 2016-01-29] (Microsoft Corporation)
R2 postgresql-9.4; C:\Program Files (x86)\PostgreSQL\9.4\bin\pg_ctl.exe [78848 2015-05-20] (PostgreSQL Global Development Group) [Arquivo não assinado]
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [Arquivo não assinado]
R2 UGSVC; C:\Program Files (x86)\UPCleaner\0.8.45.10803\UGSvc.exe [656768 2015-07-27] ()
R2 Warsaw Technology; C:\Program Files\Diebold\Warsaw\core.exe [925744 2016-06-23] (GAS Tecnologia LTDA)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
===================== Drivers (Whitelisted) ======================
(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)
S3 EZUSB; C:\Windows\System32\DRIVERS\ezusb64.sys [33280 2009-09-28] (Castles Technology Co.,Ltd)
S1 gbpddfac; C:\Windows\System32\drivers\gbpddfac64.sys [28888 2016-09-05] (GAS Tecnologia)
S1 gbpddfac; C:\Windows\SysWOW64\drivers\gbpddfac64.sys [28888 2015-12-08] (GAS Tecnologia)
R3 GBPRCM; C:\Program Files (x86)\GbPlugin\gbprcm64.sys [29912 2015-12-08] (GAS Tecnologia)
S3 MpFilter; C:\Windows\system32\DRIVERS\MpFilter.sys [289120 2015-11-13] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133816 2015-11-13] (Microsoft Corporation)
S3 Warsaw_PP; C:\Program Files (x86)\GbPlugin\wsftprp64.sys [24792 2014-10-31] (GAS Tecnologia LTDA)
S1 wsddfac; C:\Windows\System32\drivers\wsddfac.sys [101080 2016-09-08] (GAS Tecnologia)
R1 wsddntf; C:\Windows\System32\DRIVERS\wsddntf.sys [36984 2016-06-16] (GAS Tecnologia)
S1 wsddpp; C:\Windows\system32\drivers\wsddpp.sys [97376 2016-06-08] (GAS Tecnologia)
S3 BprotectEx; \??\C:\Windows\System32\drivers\BprotectEx.sys [X]
S0 gbpddreg; system32\drivers\gbpddreg64.sys [X]
S2 NPF; \??\C:\Program Files (x86)\UPCleaner\0.8.45.10803\npf64.sys [X]
S3 PCFApiUtil; \??\C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\PCFApiUtil64.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S1 UGBroMon; \??\C:\Program Files (x86)\UPCleaner\0.8.45.10803\UGBroMon64.sys [X]
S1 UGKrnlDrv; \??\C:\Program Files (x86)\UPCleaner\0.8.45.10803\UGKrnlDrv64.sys [X]
S1 UGProtect; \??\C:\Program Files (x86)\UPCleaner\0.8.45.10803\UGProtect64.sys [X]
S2 UPKernel; \??\C:\Program Files (x86)\UPCleaner\0.8.45.10803\UPKernel64.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)
==================== Um Mês Criados arquivos e pastas ========
(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)
2017-01-26 15:44 - 2017-01-26 15:46 - 00033367 _____ C:\Users\i3\Desktop\Addition.txt
2017-01-26 15:43 - 2017-01-26 15:53 - 00025991 _____ C:\Users\i3\Desktop\FRST.txt
2017-01-26 15:43 - 2017-01-26 15:53 - 00000000 ____D C:\FRST
2017-01-26 15:43 - 2017-01-26 15:43 - 02420736 _____ (Farbar) C:\Users\i3\Downloads\FRST64.exe
2017-01-26 15:41 - 2017-01-26 15:42 - 02420736 _____ (Farbar) C:\Users\i3\Desktop\FRST64.exe
2017-01-26 15:41 - 2017-01-26 15:41 - 01762816 _____ (Farbar) C:\Users\i3\Downloads\FRST.exe
2017-01-23 17:29 - 2017-01-23 17:30 - 01034556 _____ C:\Users\i3\Downloads\api-ms-win-crt-runtime-l1-1-0.dll
2017-01-23 10:41 - 2017-01-26 15:10 - 00000000 ____D C:\Users\i3\AppData\Local\{9A5CAC00-BEF4-C0B8-D36C-E550F70419C8}
2017-01-23 10:29 - 2017-01-23 10:29 - 00000000 ____D C:\Users\Todos os Usuários\TweakBit
2017-01-23 10:29 - 2017-01-23 10:29 - 00000000 ____D C:\ProgramData\TweakBit
2017-01-23 10:28 - 2017-01-23 10:28 - 00407784 _____ (TweakBit) C:\Users\i3\Downloads\fix_api-ms-win-crt-runtime-l1-1-0.dll-setup.exe
2017-01-20 14:43 - 2016-11-09 21:49 - 00036651 _____ C:\Users\i3\Desktop\AdobePremierePro11AllTrial.pimx
2017-01-20 14:38 - 2016-03-31 16:49 - 00000566 _____ C:\Users\i3\Desktop\AdobeFontsRecommended_x64-mul.pimx
2017-01-20 14:37 - 2017-01-20 14:37 - 00000000 ____D C:\Users\i3\Desktop\2
2017-01-20 14:37 - 2016-03-31 16:48 - 00000557 _____ C:\Users\i3\Desktop\AdobeFontsRequired_x64-mul.pimx
2017-01-20 14:36 - 2017-01-20 14:37 - 00000000 ____D C:\Users\i3\Desktop\1
2017-01-20 11:06 - 2016-11-17 03:34 - 00000000 ____D C:\Users\i3\Desktop\Crack
2017-01-19 17:39 - 2017-01-20 14:44 - 00001106 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Premiere Pro CC 2017.lnk
2017-01-19 17:39 - 2017-01-19 17:39 - 00000000 ____D C:\Users\Public\Documents\Adobe
2017-01-19 17:35 - 2017-01-19 17:35 - 00000000 ____D C:\Users\Public\Documents\AdobeInstalledCodecs
2017-01-19 17:22 - 2017-01-19 17:22 - 00001137 _____ C:\Users\Public\Desktop\Adobe Creative Cloud.lnk
2017-01-19 15:24 - 2017-01-19 15:52 - 00000000 ____D C:\Users\i3\Downloads\Adobe Premiere Pro CC 2017 v11.0.1 + Crack [SadeemPC]
2017-01-18 08:48 - 2017-01-18 08:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
2017-01-16 16:15 - 2017-01-16 16:15 - 00867230 _____ C:\Users\i3\Downloads\PROJETO REVISÃO 2 (3).pdf
2017-01-16 16:14 - 2017-01-16 16:14 - 00852020 _____ C:\Users\i3\Downloads\PROJETO REVISÃO 2 (2).pdf
2017-01-16 16:14 - 2017-01-16 16:14 - 00852020 _____ C:\Users\i3\Downloads\PROJETO REVISÃO 2 (1).pdf
2017-01-16 15:26 - 2017-01-16 15:26 - 00020989 _____ C:\Users\i3\Downloads\PROJETO REVISÃO 2.pdf
2017-01-05 09:32 - 2017-01-05 09:32 - 00001302 _____ C:\Users\i3\Desktop\EasyPHP Devserver 16.1.1.lnk
2017-01-05 09:30 - 2017-01-05 09:32 - 00000000 ____D C:\Program Files (x86)\EasyPHP-Devserver-16.1
2017-01-04 12:42 - 2017-01-04 12:42 - 00192291 _____ C:\Users\i3\Desktop\Dreamweaver crash log (1).mdmp
2017-01-03 13:35 - 2017-01-11 15:22 - 00000000 ____D C:\Users\i3\Desktop\faixada
==================== Um Mês Modificados arquivos e pastas ========
(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)
2017-01-26 15:18 - 2009-07-14 02:45 - 00014128 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-01-26 15:18 - 2009-07-14 02:45 - 00014128 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-01-26 15:10 - 2014-05-29 11:21 - 00000000 __SHD C:\Users\i3\AppData\Local\EmieUserList
2017-01-26 15:10 - 2014-05-29 11:21 - 00000000 __SHD C:\Users\i3\AppData\Local\EmieSiteList
2017-01-26 08:18 - 2015-01-24 15:41 - 00000000 ____D C:\Users\Todos os Usuários\GbPlugin
2017-01-26 08:18 - 2015-01-24 15:41 - 00000000 ____D C:\ProgramData\GbPlugin
2017-01-26 08:18 - 2009-07-14 03:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-25 14:54 - 2015-10-21 15:28 - 00002281 _____ C:\Users\i3\Desktop\Ciaf-800 - Atalho.lnk
2017-01-20 08:17 - 2014-04-10 20:24 - 00088328 _____ C:\Users\i3\AppData\Local\GDIPFONTCACHEV1.DAT
2017-01-20 08:15 - 2009-07-14 02:45 - 05042000 _____ C:\Windows\system32\FNTCACHE.DAT
2017-01-19 17:39 - 2014-06-06 17:59 - 00000000 ____D C:\Program Files\Adobe
2017-01-19 17:39 - 2014-06-06 17:47 - 00000000 ____D C:\Program Files\Common Files\Adobe
2017-01-19 17:39 - 2014-06-06 17:24 - 00000000 ____D C:\Users\Todos os Usuários\Adobe
2017-01-19 17:39 - 2014-06-06 17:24 - 00000000 ____D C:\ProgramData\Adobe
2017-01-19 17:39 - 2014-04-17 10:43 - 00000000 ____D C:\Users\i3\AppData\Roaming\Adobe
2017-01-19 17:25 - 2014-04-15 17:44 - 00000000 ____D C:\Users\i3\AppData\Roaming\uTorrent
2017-01-19 17:22 - 2015-02-11 11:02 - 00001149 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk
2017-01-19 15:39 - 2016-04-02 14:50 - 00001456 _____ C:\Users\i3\AppData\Local\Adobe Salvar para Web 13.0 Prefs
2017-01-19 08:17 - 2014-06-06 17:23 - 00000000 ____D C:\Users\i3\AppData\Local\Adobe
2017-01-19 08:14 - 2014-08-19 15:49 - 00000000 ____D C:\Users\Todos os Usuários\boost_interprocess
2017-01-19 08:14 - 2014-08-19 15:49 - 00000000 ____D C:\ProgramData\boost_interprocess
2017-01-18 08:49 - 2015-04-09 11:35 - 00000000 ____D C:\Program Files (x86)\Garmin
2017-01-18 08:49 - 2015-02-11 11:00 - 00000000 ____D C:\Users\Todos os Usuários\Package Cache
2017-01-18 08:49 - 2015-02-11 11:00 - 00000000 ____D C:\ProgramData\Package Cache
2017-01-18 08:48 - 2015-04-09 11:35 - 00003554 _____ C:\Windows\System32\Tasks\GarminUpdaterTask
2017-01-12 16:31 - 2014-05-21 16:46 - 00000000 ____D C:\Users\i3\AppData\Roaming\vlc
2017-01-12 14:47 - 2016-09-14 12:26 - 00000000 ____D C:\Users\i3\Documents\Adobe
2017-01-09 14:19 - 2015-08-03 12:21 - 00000132 _____ C:\Users\i3\AppData\Roaming\Preferências do Formato PNG do Adobe CS6
2017-01-06 08:18 - 2014-04-10 20:25 - 00000000 ____D C:\Program Files (x86)\Google
2017-01-05 09:33 - 2016-03-30 16:59 - 00000000 ____D C:\Users\i3\Desktop\franklin
2017-01-03 15:11 - 2016-10-05 12:28 - 00000000 ____D C:\Users\i3\Desktop\Imagens_D.Rossi
2017-01-03 13:38 - 2016-03-03 12:58 - 00000000 ____D C:\Users\i3\Desktop\cleise
2017-01-03 10:08 - 2009-07-29 14:08 - 00705474 _____ C:\Windows\system32\prfh0416.dat
2017-01-03 10:08 - 2009-07-29 14:08 - 00147314 _____ C:\Windows\system32\prfc0416.dat
2017-01-03 10:08 - 2009-07-14 03:13 - 01634498 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-03 10:08 - 2009-07-14 01:20 - 00000000 ____D C:\Windows\inf
==================== Arquivos na raiz de alguns diretórios =======
2016-02-27 16:10 - 2016-09-14 12:44 - 0000132 _____ () C:\Users\i3\AppData\Roaming\Preferências do Formato GIF do Adobe CS6
2015-08-03 12:21 - 2017-01-09 14:19 - 0000132 _____ () C:\Users\i3\AppData\Roaming\Preferências do Formato PNG do Adobe CS6
2014-08-19 15:49 - 2014-08-19 15:49 - 0015595 _____ () C:\Users\i3\AppData\Roaming\unins000.dat
2014-08-19 15:49 - 2014-08-19 15:49 - 0730322 _____ () C:\Users\i3\AppData\Roaming\unins000.exe
2015-01-24 15:39 - 2015-01-24 15:40 - 0016820 _____ () C:\Users\i3\AppData\Roaming\unins001.dat
2015-01-24 15:39 - 2015-01-24 15:39 - 0815314 _____ () C:\Users\i3\AppData\Roaming\unins001.exe
2016-04-02 14:50 - 2017-01-19 15:39 - 0001456 _____ () C:\Users\i3\AppData\Local\Adobe Salvar para Web 13.0 Prefs
2016-05-05 12:08 - 2016-05-05 12:08 - 0003584 _____ () C:\Users\i3\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-08-06 17:26 - 2014-08-06 17:26 - 0007602 _____ () C:\Users\i3\AppData\Local\Resmon.ResmonCfg
Alguns arquivos em TEMP:
====================
2014-04-15 19:19 - 2014-04-15 19:20 - 1164000 _____ (Highlightly) C:\Users\i3\AppData\Local\Temp\2vdc1b1x.na4.exe
2015-10-19 08:35 - 2015-10-19 08:35 - 4320072 _____ (Google) C:\Users\i3\AppData\Local\Temp\7E87.exe
2015-08-12 10:03 - 2015-08-12 10:03 - 0735248 _____ () C:\Users\i3\AppData\Local\Temp\Adobe Dreamweaver CC 2015 7698 Crack Serial Key__10924_i1579050919_il453782.exe
2015-08-12 10:12 - 2015-08-12 10:12 - 0735248 _____ () C:\Users\i3\AppData\Local\Temp\Adobe Dreamweaver CC 2015 7698 Crack Serial Key__10924_i1579056411_il453782.exe
2015-10-16 18:20 - 2015-05-16 10:53 - 1344608 _____ () C:\Users\i3\AppData\Local\Temp\AnyDeskUninst093c.exe
2015-02-10 09:31 - 2015-02-10 09:31 - 0663448 _____ (Ask Partner Network) C:\Users\i3\AppData\Local\Temp\APNSetup.exe
2015-05-25 09:34 - 2015-05-25 09:34 - 4694856 _____ (Google) C:\Users\i3\AppData\Local\Temp\B07D.exe
2014-04-15 17:44 - 2014-04-15 17:44 - 19943464 _____ (Baidu, Inc.) C:\Users\i3\AppData\Local\Temp\Baidu_Secure_SystemUp_4.0.5.64967.exe
2014-12-31 15:14 - 2014-12-31 15:14 - 0152688 _____ (C.L.A.R.A) C:\Users\i3\AppData\Local\Temp\ce98ac2e-20c0-4a93-86f6-bdb3e61caf55.exe
2016-11-23 08:47 - 2016-11-23 08:47 - 0737856 _____ (Oracle Corporation) C:\Users\i3\AppData\Local\Temp\jre-8u111-windows-au.exe
2014-12-18 15:29 - 2014-12-18 15:29 - 0641448 _____ (Oracle Corporation) C:\Users\i3\AppData\Local\Temp\jre-8u31-windows-au.exe
2015-08-12 10:15 - 2015-08-12 10:15 - 0703272 _____ (Opera Software) C:\Users\i3\AppData\Local\Temp\Opera_NI_stable.exe
2014-04-15 19:19 - 2014-04-15 19:20 - 1563291 _____ () C:\Users\i3\AppData\Local\Temp\p4avzll1.ebr.exe
2014-12-31 15:05 - 2014-12-31 15:05 - 0308320 _____ (One Syn) C:\Users\i3\AppData\Local\Temp\smt_mystartsearch.exe
2014-04-15 19:05 - 2013-03-12 06:59 - 0275552 ___RS (Tarma Software Research Pty Ltd) C:\Users\i3\AppData\Local\Temp\Tsu9BFDDD96.dll
2014-07-08 14:16 - 2014-07-08 14:16 - 0005757 _____ () C:\Users\i3\AppData\Local\Temp\UNT8729.tmp.exe
2014-07-08 14:16 - 2014-07-08 14:16 - 0117957 _____ () C:\Users\i3\AppData\Local\Temp\UNT8768.tmp.exe
2014-07-08 14:16 - 2014-07-08 14:16 - 0291697 _____ () C:\Users\i3\AppData\Local\Temp\UNT8769.tmp.exe
2014-07-08 14:16 - 2014-07-08 14:16 - 0005937 _____ () C:\Users\i3\AppData\Local\Temp\UNT876A.tmp.exe
2014-07-08 14:16 - 2014-07-08 14:16 - 0179277 _____ () C:\Users\i3\AppData\Local\Temp\UNT876B.tmp.exe
2014-07-08 14:16 - 2014-07-08 14:16 - 0152997 _____ () C:\Users\i3\AppData\Local\Temp\UNT876C.tmp.exe
2014-07-08 14:16 - 2014-07-08 14:16 - 0004394 _____ () C:\Users\i3\AppData\Local\Temp\UNT876D.tmp.exe
2014-07-08 14:16 - 2014-07-08 14:16 - 0031093 _____ () C:\Users\i3\AppData\Local\Temp\UNT876E.tmp.exe
2014-07-08 14:16 - 2014-07-08 14:16 - 0024857 _____ () C:\Users\i3\AppData\Local\Temp\UNT877F.tmp.exe
2014-07-08 14:17 - 2014-07-08 14:17 - 0005757 _____ () C:\Users\i3\AppData\Local\Temp\UNTE030.tmp.exe
2014-07-08 14:17 - 2014-07-08 14:17 - 0244977 _____ () C:\Users\i3\AppData\Local\Temp\UNTE031.tmp.exe
2014-07-08 14:17 - 2014-07-08 14:17 - 0039117 _____ () C:\Users\i3\AppData\Local\Temp\UNTE032.tmp.exe
2014-07-08 14:17 - 2014-07-08 14:17 - 0005937 _____ () C:\Users\i3\AppData\Local\Temp\UNTE033.tmp.exe
2014-07-08 14:17 - 2014-07-08 14:17 - 0087297 _____ () C:\Users\i3\AppData\Local\Temp\UNTE034.tmp.exe
2014-07-08 14:17 - 2014-07-08 14:17 - 0224537 _____ () C:\Users\i3\AppData\Local\Temp\UNTE035.tmp.exe
2014-07-08 14:17 - 2014-07-08 14:17 - 0004394 _____ () C:\Users\i3\AppData\Local\Temp\UNTE046.tmp.exe
2014-07-08 14:17 - 2014-07-08 14:17 - 0031093 _____ () C:\Users\i3\AppData\Local\Temp\UNTE047.tmp.exe
2014-07-08 14:17 - 2014-07-08 14:17 - 0024857 _____ () C:\Users\i3\AppData\Local\Temp\UNTE048.tmp.exe
2014-04-15 17:46 - 2014-04-15 17:46 - 0081768 _____ (Conduit) C:\Users\i3\AppData\Local\Temp\utt4630.tmp.exe
2014-06-06 18:24 - 2014-06-06 18:24 - 0308076 _____ () C:\Users\i3\AppData\Local\Temp\_inst1.exe
2015-01-24 15:59 - 2015-01-24 15:59 - 0308076 _____ () C:\Users\i3\AppData\Local\Temp\_inst2.exe
2006-05-24 01:10 - 2006-05-24 01:10 - 0455600 ____R (Macrovision Corporation) C:\Users\i3\AppData\Local\Temp\_isE648.exe
==================== Bamital & volsnap ======================
(Não há correção automática para arquivos que não passaram na verificação.)
C:\Windows\system32\winlogon.exe => O arquivo é assinado digitalmente
C:\Windows\system32\wininit.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\wininit.exe => O arquivo é assinado digitalmente
C:\Windows\explorer.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\explorer.exe => O arquivo é assinado digitalmente
C:\Windows\system32\svchost.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\svchost.exe => O arquivo é assinado digitalmente
C:\Windows\system32\services.exe => O arquivo é assinado digitalmente
C:\Windows\system32\User32.dll => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\User32.dll => O arquivo é assinado digitalmente
C:\Windows\system32\userinit.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\userinit.exe => O arquivo é assinado digitalmente
C:\Windows\system32\rpcss.dll => O arquivo é assinado digitalmente
C:\Windows\system32\dnsapi.dll => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\dnsapi.dll => O arquivo é assinado digitalmente
C:\Windows\system32\Drivers\volsnap.sys => O arquivo é assinado digitalmente
LastRegBack: 2017-01-23 16:53
==================== Fim de FRST.txt ============================