Resultado do exame da Farbar Recovery Scan Tool (FRST) (x64) Versão: 11-03-2017
Executado por Leandro (administrador) em LEANDRO-PC (11-03-2017 07:28:55)
Executando a partir de C:\Users\Leandro\Downloads
Perfis Carregados: Leandro (Perfis Disponíveis: Leandro)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Idioma: Português (Brasil)
Internet Explorer Versão 11 (Navegador padrão: Chrome)
Modo da Inicialização: Normal
Tutorial da Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processos (Whitelisted) =================

(Se uma entrada for incluída na fixlist, o processo será fechado. O arquivo não será movido.)

(GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Motorola, Inc.) C:\Program Files\Motorola\Bluetooth\devmgrsrv.exe
(GraphOn Corporation) C:\Program Files (x86)\GraphOn\GO-Global\Client\UpdateService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe
() C:\ProgramData\KMSAuto\KMSES.exe
() C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\capiws.exe
(Banco Bradesco S.A.) C:\Program Files (x86)\Scpad\scpVista.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Motorola, Inc.) C:\Program Files\Motorola\Bluetooth\obexsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Macrovision Europe Ltd.) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe
(GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(GAS Tecnologia LTDA) C:\Program Files\Diebold\Warsaw\core.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\mspaint.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registro (Whitelisted) ====================

(Se uma entrada for incluída na fixlist, o ítem no Registro será restaurado para o padrão ou removido. O arquivo não será movido.)

HKLM\...\Run: [Diebold - Warsaw] => C:\Program Files\Diebold\Warsaw\core.exe [927280 2016-11-11] (GAS Tecnologia LTDA)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [8900328 2016-08-08] (AVAST Software)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\ GbPluginBb: C:\Program Files (x86)\GbPlugin\gbieh.dll [2016-06-16] (Banco do Brasil)
Winlogon\Notify\ GbPluginCef: C:\Program Files (x86)\GbPlugin\gbiehCef.dll [2016-07-13] (Caixa Economica Federal)
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27545056 2017-02-14] (Skype Technologies S.A.)
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: G - G:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {2c1ca0c1-52b5-11e2-bb62-4487fc2b4348} - E:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {2e09488f-fdac-11e1-a5fd-4487fc2b4348} - F:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {329404e8-f439-11e1-a38e-4487fc2b4348} - E:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {38fe9235-13e4-11e4-aba4-4487fc2b4348} - E:\iLinker.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {4fe113c3-e2cb-11e3-ac62-806e6f6e6963} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL E:\
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {50a177ba-f684-11e1-a3b6-4487fc2b4348} - E:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {50a177cb-f684-11e1-a3b6-4487fc2b4348} - E:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {600235d8-af73-11e3-8835-4487fc2b4348} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL E:\
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {8f2c9978-1611-11e2-871e-4487fc2b4348} - E:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {8fcdb7e5-13b5-11e2-b5c9-68a3c445f7b1} - G:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {919f6fda-5453-11e2-a656-4487fc2b4348} - E:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {a6472722-3302-11e2-ba56-4487fc2b4348} - E:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {a6472772-3302-11e2-ba56-4487fc2b4348} - E:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {a6472797-3302-11e2-ba56-4487fc2b4348} - E:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {af21e95a-cb2e-11e3-bb8e-4487fc2b4348} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL E:\
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {bc668b25-641e-11e2-b8dc-4487fc2b4348} - E:\iLinker.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {bffaf845-af56-11e2-b59f-4487fc2b4348} - E:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {d86e3dbf-260a-11e2-b8da-4487fc2b4348} - E:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {ee1f215a-af53-11e2-a390-4487fc2b4348} - E:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {ee1f216f-af53-11e2-a390-4487fc2b4348} - E:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {f3082d37-5395-11e2-b49f-4487fc2b4348} - E:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {f3082d6d-5395-11e2-b49f-4487fc2b4348} - E:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {f3082d81-5395-11e2-b49f-4487fc2b4348} - E:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {f3082d96-5395-11e2-b49f-4487fc2b4348} - E:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {fce15d5d-f426-11e1-a820-4487fc2b4348} - E:\AutoRun.exe
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\MountPoints2: {fce15d6d-f426-11e1-a820-4487fc2b4348} - E:\AutoRun.exe
HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => "C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe"
SSODL-x32: CompIBBrd - {A3717295-941D-416F-9384-ED1736729F1C} - C:\Program Files (x86)\Scpad\scpLIB.dll (Banco Bradesco S.A.)
ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399003} - C:\Program Files (x86)\GbPlugin\gbiehcef.dll [1903328 2016-07-13] (Caixa Economica Federal)
ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\PROGRAM FILES (X86)\GbPlugin\gbieh.dll [1947872 2016-06-16] (Banco do Brasil)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-07-11] (AVAST Software)
CHR HKLM\SOFTWARE\Policies\Google: Restrição <======= ATENÇÃO

==================== Internet (Whitelisted) ====================

(Se um ítem for incluído na fixlist, sendo um ítem do Registro, será removido ou restaurado para o padrão.)

Tcpip\Parameters: [DhcpNameServer] 200.11.14.195 8.8.8.8
Tcpip\..\Interfaces\{2ABE5E06-9EA7-4226-86E2-312E7D236D27}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{2ABE5E06-9EA7-4226-86E2-312E7D236D27}: [DhcpNameServer] 200.11.14.195 8.8.8.8
Tcpip\..\Interfaces\{58749BFD-571A-4A1D-BDCC-CA62239EC61E}: [DhcpNameServer] 200.11.14.194 8.8.8.8
Tcpip\..\Interfaces\{E8409B4C-9149-4E2D-9CD8-4AE5E81A413E}: [DhcpNameServer] 192.168.253.251 192.168.253.251

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://br.msn.com/
HKU\S-1-5-21-3644643762-1090977706-553488109-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://br.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset
URLSearchHook: HKLM-x32 - (Sem Nome) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - Nenhum Arquivo
SearchScopes: HKLM -> DefaultScope valor está ausente
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ir_14_41_ch&cd=2XzuyEtN2Y1L1QzuyCzz0AtA0CyEzz0FtCtBtAyDtC0B0AtAtN0D0Tzu0StCtDtDtAtN1L2XzutAtFtBtFtCtFyDtN1L1CzutCyEtBzytDyD1V1QtN1L1G1B1V1N2Y1L1Qzu2StCtC0F0C0B0FzztDtGyDzyyCtAtGyByC0AtBtG0FzztDtBtGtBzztCyCzy0DtDyCtC0BtAzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2StBtDzzzytCtDtDtDtG0EyD0E0DtGyE0E0FyBtGzy0EtAyDtGyEzztD0EyD0CyEyBtA0D0ByC2Q&cr=1614731964&ir=
SearchScopes: HKLM-x32 -> DefaultScope valor está ausente
SearchScopes: HKU\.DEFAULT -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
SearchScopes: HKU\S-1-5-21-3644643762-1090977706-553488109-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ir_14_41_ch&cd=2XzuyEtN2Y1L1QzuyCzz0AtA0CyEzz0FtCtBtAyDtC0B0AtAtN0D0Tzu0StCtDtDtAtN1L2XzutAtFtBtFtCtFyDtN1L1CzutCyEtBzytDyD1V1QtN1L1G1B1V1N2Y1L1Qzu2StCtC0F0C0B0FzztDtGyDzyyCtAtGyByC0AtBtG0FzztDtBtGtBzztCyCzy0DtDyCtC0BtAzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2StBtDzzzytCtDtDtDtG0EyD0E0DtGyE0E0FyBtGzy0EtAyDtGyEzztD0EyD0CyEyBtA0D0ByC2Q&cr=1614731964&ir=
SearchScopes: HKU\S-1-5-21-3644643762-1090977706-553488109-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ir_14_41_ch&cd=2XzuyEtN2Y1L1QzuyCzz0AtA0CyEzz0FtCtBtAyDtC0B0AtAtN0D0Tzu0StCtDtDtAtN1L2XzutAtFtBtFtCtFyDtN1L1CzutCyEtBzytDyD1V1QtN1L1G1B1V1N2Y1L1Qzu2StCtC0F0C0B0FzztDtGyDzyyCtAtGyByC0AtBtG0FzztDtBtGtBzztCyCzy0DtDyCtC0BtAzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2StBtDzzzytCtDtDtDtG0EyD0E0DtGyE0E0FyBtGzy0EtAyDtGyEzztD0EyD0CyEyBtA0D0ByC2Q&cr=1614731964&ir=
SearchScopes: HKU\S-1-5-21-3644643762-1090977706-553488109-1000 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL =
SearchScopes: HKU\S-1-5-21-3644643762-1090977706-553488109-1000 -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL =
SearchScopes: HKU\S-1-5-21-3644643762-1090977706-553488109-1000 -> {5734F3C8-BA8E-4F65-988B-D4090D26530C} URL = hxxps://br.search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-07-11] (AVAST Software)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: ssh2 Class -> {2E3C3651-B19C-4DD9-A979-901EC3E930AF} -> C:\Program Files (x86)\Scpad\scpsssh2.dll [2013-07-04] (Banco Bradesco S.A.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll [2017-01-30] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-07-11] (AVAST Software)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540000} -> C:\PROGRAM FILES (X86)\GBPLUGIN\gbieh.dll [2016-06-16] (Banco do Brasil)
BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540003} -> C:\Program Files (x86)\GbPlugin\gbiehcef.dll [2016-07-13] (Caixa Economica Federal)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-01-30] (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - Nenhum Arquivo
Toolbar: HKLM - Sem Nome - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - Nenhum Arquivo
Toolbar: HKU\S-1-5-21-3644643762-1090977706-553488109-1000 -> Sem Nome - {D4027C7F-154A-4066-A1AD-4243D8127440} - Nenhum Arquivo
Toolbar: HKU\S-1-5-21-3644643762-1090977706-553488109-1000 -> Sem Nome - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - Nenhum Arquivo
Toolbar: HKU\S-1-5-21-3644643762-1090977706-553488109-1000 -> Sem Nome - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - Nenhum Arquivo
DPF: HKLM-x32 {1241F20B-0688-45A5-ADB2-208AFE4A5DDC} hxxp://www.crm-acom.com.br/everest/plugins/gg-activex.cab
DPF: HKLM-x32 {9EC30204-384D-11D3-9CA3-00A024F0AF03} hxxps://cpne.bradesco.com.br/certifexp.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - Nenhum Arquivo
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - Nenhum Arquivo
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2012-10-01] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2017-01-01] (Skype Technologies)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Leandro\AppData\Roaming\OpenVPN Technologies\OpenVPN Client\Profiles\hwyjp991.default [2017-03-01]
FF Homepage: OpenVPN Technologies\OpenVPN Client\Profiles\hwyjp991.default -> resource://webapp/openvpn.html
FF ProfilePath: C:\Users\Leandro\AppData\Roaming\Mozilla\Firefox\Profiles\34tfdk74.default [2017-03-09]
FF user.js: detected! => C:\Users\Leandro\AppData\Roaming\Mozilla\Firefox\Profiles\34tfdk74.default\user.js [2014-09-29]
FF NetworkProxy: Mozilla\Firefox\Profiles\34tfdk74.default -> type", 0
FF Extension: (Iminent) - C:\Users\Leandro\AppData\Roaming\Mozilla\Firefox\Profiles\34tfdk74.default\Extensions\webbooster@iminent.com.xpi [2013-11-14] [não assinado]
FF Extension: (DVDVideoSoftTB ) - C:\Users\Leandro\AppData\Roaming\Mozilla\Firefox\Profiles\34tfdk74.default\Extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2013-01-09] [não assinado]
FF Extension: (SaveSense) - C:\Users\Leandro\AppData\Roaming\Mozilla\Firefox\Profiles\34tfdk74.default\Extensions\{8b337819-d1e8-48d3-8178-168ae8c99c36} [2014-03-18] [não assinado]
FF Extension: (DVDVideoSoft YouTube MP3 and Video Download) - C:\Users\Leandro\AppData\Roaming\Mozilla\Firefox\Profiles\34tfdk74.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2013-01-11] [não assinado]
FF SearchPlugin: C:\Users\Leandro\AppData\Roaming\Mozilla\Firefox\Profiles\34tfdk74.default\searchplugins\askcom.xml [2012-08-29]
FF SearchPlugin: C:\Users\Leandro\AppData\Roaming\Mozilla\Firefox\Profiles\34tfdk74.default\searchplugins\dvdvideosofttb-customized-web-search.xml [2013-01-09]
FF SearchPlugin: C:\Users\Leandro\AppData\Roaming\Mozilla\Firefox\Profiles\34tfdk74.default\searchplugins\iminent.xml [2013-11-18]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-07-11]
FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-07-11]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [speedanalysis@SpeedAnalysis.com] - C:\Users\Leandro\AppData\Roaming\Mozilla\Extensions\speedanalysis@SpeedAnalysis.com
FF Extension: (SpeedAnalysis.com) - C:\Users\Leandro\AppData\Roaming\Mozilla\Extensions\speedanalysis@SpeedAnalysis.com [2013-04-14] [não assinado]
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF HKU\S-1-5-21-3644643762-1090977706-553488109-1000\...\Firefox\Extensions: [speedanalysis@SpeedAnalysis.com] - C:\Users\Leandro\AppData\Roaming\Mozilla\Extensions\speedanalysis@SpeedAnalysis.com
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml [2012-08-31]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Dounty.xml [2014-09-05]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_24_0_0_221.dll [2017-02-15] ()
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2012-09-04] (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll [2013-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_24_0_0_221.dll [2017-02-15] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1209149.dll [2014-01-28] (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @graphon.com/GoGlobal -> C:\Program Files (x86)\GraphOn\GO-Global\Plugin\gg-nsplugin_ff3.windows\plugins [2014-01-06] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-01-30] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-01-30] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2012-09-04] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll [2013-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll [Nenhum Arquivo]
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll [Nenhum Arquivo]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-05-11] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3644643762-1090977706-553488109-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Leandro\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [Nenhum Arquivo]
FF Plugin HKU\S-1-5-21-3644643762-1090977706-553488109-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Leandro\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2013-08-27] (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-3644643762-1090977706-553488109-1000: gastecnologia.com.br/sf/bb64 -> C:\Users\Leandro\AppData\Local\GAS Tecnologia\GBBD\npsf_bb_64.dll [Nenhum Arquivo]
FF Plugin HKU\S-1-5-21-3644643762-1090977706-553488109-1000: gastecnologia.com.br/sf/cef -> C:\Users\Leandro\AppData\Local\GAS Tecnologia\GBBD\npsf_cef.dll [2014-12-09] (GAS Tecnologia)
FF Plugin HKU\S-1-5-21-3644643762-1090977706-553488109-1000: gastecnologia.com.br/sf/cef64 -> C:\Users\Leandro\AppData\Local\GAS Tecnologia\GBBD\npsf_cef_64.dll [2015-04-02] (GAS Tecnologia)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2012-10-01] (Microsoft Corporation)

Chrome:
=======
CHR DefaultProfile: Profile 1
CHR DefaultSearchURL: Profile 1 -> hxxps://br.search.yahoo.com/search?p={searchTerms}&fr=yset_chr_syc_oracle&type=default
CHR DefaultSearchKeyword: Profile 1 -> Yahoo
CHR DefaultSuggestURL: Profile 1 -> hxxps://br.search.yahoo.com/sugg/ie?output=fxjson&command={searchTerms}&nResults=10
CHR Profile: C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Default [2017-03-09]
CHR Extension: (Google Apresentações) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-02-13]
CHR Extension: (Google Docs) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-02-13]
CHR Extension: (Google Drive) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-02-13]
CHR Extension: (YouTube) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-02-13]
CHR Extension: (SpeedAnalysis.com) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfcbmgbfdbijmjgjihagbomfbjfjmgon [2017-02-13] [UpdateUrl: hxxps://srv.mzcdn.com/addons/speedanalysis/update.chrome.xml] <==== ATENÇÃO
CHR Extension: (Yahoo Partner) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Default\Extensions\fabhkdeopjkcpkmofliimbjckmocfiom [2017-02-13]
CHR Extension: (Yahoo Partner) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdbpcigaolookbahgdofnimidinicfid [2017-02-13]
CHR Extension: (Planilhas do Google) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-02-13]
CHR Extension: (Documentos Google off-line) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-03-09]
CHR Extension: (Avast Online Security) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-03-09]
CHR Extension: (GO-Global) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Default\Extensions\jjbmehaiobapkccjpobdfjammccbfbna [2017-02-13]
CHR Extension: (Skype) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2017-03-09]
CHR Extension: (Pagamentos da Chrome Web Store) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
CHR Extension: (Gmail) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-02-13]
CHR Extension: (Chrome Media Router) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-13]
CHR Profile: C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Guest Profile [2017-03-09]
CHR Profile: C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Profile 1 [2017-03-11]
CHR Extension: (Google Docs) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-11]
CHR Extension: (Google Drive) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]
CHR Extension: (YouTube) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]
CHR Extension: (Google Search) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-26]
CHR Extension: (Documentos Google off-line) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]
CHR Extension: (Avast Online Security) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-02-27]
CHR Extension: (Acesso Web) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\jekaallldjdjoloogjoidclbnpckjifm [2017-02-14]
CHR Extension: (GO-Global) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\jjbmehaiobapkccjpobdfjammccbfbna [2015-02-11]
CHR Extension: (GBBD Banco do Brasil) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\jkafhcogdnfhkmiepeebkkdbdphnjfll [2015-03-17]
CHR Extension: (Pagamentos da Chrome Web Store) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
CHR Extension: (GBBD Caixa Economica Federal) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pbcaplhfkihhldmlbjhgajdeghjdbffi [2015-03-13]
CHR Extension: (Gmail) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-31]
CHR Extension: (Chrome Media Router) - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-07]
CHR HKLM\...\Chrome\Extension: [pfkfdlcdbajamklbneflfbcmfgddmpae] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3644643762-1090977706-553488109-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pfkfdlcdbajamklbneflfbcmfgddmpae] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [cfcbmgbfdbijmjgjihagbomfbjfjmgon] - C:\Users\Leandro\AppData\Roaming\SpeedanAlysis\speedanalysis.crx [2013-02-14]
CHR HKLM-x32\...\Chrome\Extension: [fabhkdeopjkcpkmofliimbjckmocfiom] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fdbpcigaolookbahgdofnimidinicfid] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-07-01]
CHR HKLM-x32\...\Chrome\Extension: [jjbmehaiobapkccjpobdfjammccbfbna] - C:\Program Files (x86)\GraphOn\GO-Global\gg-chrome.crx [2013-09-25]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pelmeidfhdlhlbjimpabfcbnnojbboma] - C:\Users\Leandro\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx
CHR HKLM-x32\...\Chrome\Extension: [pfkfdlcdbajamklbneflfbcmfgddmpae] - hxxps://clients2.google.com/service/update2/crx

==================== Serviços (Whitelisted) ====================

(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-07-11] (AVAST Software)
S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [647680 2013-02-17] (Macrovision Europe Ltd.) [Arquivo não assinado]
R3 FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [1028096 2013-02-17] (Macrovision Europe Ltd.) [Arquivo não assinado]
R2 GbpSv; C:\Program Files (x86)\GbPlugin\gbpsv.exe [631520 2016-06-16] (GAS Tecnologia)
R2 GGUpdateClient; C:\Program Files (x86)\GraphOn\GO-Global\Client\UpdateService.exe [246808 2013-09-25] (GraphOn Corporation)
S2 HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [136192 2009-10-15] (HP) [Arquivo não assinado]
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89840 2015-03-28] (Hewlett-Packard Company)
R2 KMSEmulator; C:\ProgramData\KMSAuto\KMSES.exe [277504 2014-03-19] () [Arquivo não assinado]
R2 OpenVPNAccessClient; C:\Program Files (x86)\OpenVPN Technologies\OpenVPN Client\core\capiws.exe [24064 2010-08-12] () [Arquivo não assinado]
R2 scpVista; C:\Program Files (x86)\Scpad\scpVista.exe [360640 2013-07-04] (Banco Bradesco S.A.) [Arquivo não assinado]
R2 Warsaw Technology; C:\Program Files\Diebold\Warsaw\core.exe [927280 2016-11-11] (GAS Tecnologia LTDA)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-07-11] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-07-11] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [108304 2016-07-11] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-07-11] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-07-11] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1070904 2016-07-11] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [473592 2016-07-13] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [162904 2016-07-11] (AVAST Software)
S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [44640 2014-09-19] (The OpenVPN Project)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [292704 2016-08-05] (AVAST Software)
S3 btmaudio; C:\Windows\System32\drivers\btmaud.sys [43008 2010-11-30] (Motorola, Inc.)
S3 BTMMODEM; C:\Windows\System32\DRIVERS\btmcom.sys [52736 2010-11-30] (Motorola, Inc.)
S3 BTMNET; C:\Windows\System32\DRIVERS\btmnet.sys [30208 2010-11-30] (Motorola, Inc.)
R3 CamSuiteVAC; C:\Windows\System32\DRIVERS\CamSuiteVAC.sys [56320 2008-09-18] ()
R3 GBPRCM; C:\PROGRAM FILES (X86)\GBPLUGIN\gbprcm64.sys [29912 2015-09-03] (GAS Tecnologia)
S3 InputFilter_Hid_FlexDef2b; C:\Windows\System32\DRIVERS\InputFilter_FlexDef2b.sys [17920 2010-06-19] (Siliten)
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2010-04-28] (Marvell Semiconductor, Inc.)
R3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2010-08-03] (The OpenVPN Project)
R3 Warsaw_PP; C:\Program Files (x86)\GbPlugin\wsftprp64.sys [24792 2014-10-31] (GAS Tecnologia LTDA)
R1 wsddfac; C:\Windows\System32\drivers\wsddfac.sys [101080 2017-03-11] (GAS Tecnologia)
R1 wsddntf; C:\Windows\System32\DRIVERS\wsddntf.sys [36984 2016-06-16] (GAS Tecnologia)
R1 wsddpp; C:\Windows\system32\drivers\wsddpp.sys [25184 2016-11-11] (GAS Tecnologia)
R3 wsddprm; C:\Windows\system32\drivers\wsddprm.sys [25184 2016-11-11] (GAS Tecnologia)
R1 {fef7f75c-f985-4250-96f9-8183cd04238b}w64; C:\Windows\System32\drivers\{fef7f75c-f985-4250-96f9-8183cd04238b}w64.sys [48792 2014-09-29] (StdLib)
S3 BprotectEx; \??\C:\Windows\System32\drivers\BprotectEx.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 ewusbmbb; system32\DRIVERS\ewusbwwan.sys [X]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S1 gbpddfac; system32\drivers\gbpddfac64.sys [X]
S0 gbpddreg; system32\drivers\gbpddreg64.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 mod7700; system32\DRIVERS\mod7700.sys [X]
S3 PCFApiUtil; \??\C:\Program Files (x86)\Baidu Security\PC Faster\5.0.0.0\PCFApiUtil64.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]

==================== NetSvcs (Whitelisted) ===================

(Se uma entrada for incluída na fixlist, será removida do Registro. O arquivo não será movido, a menos que seja colocado separadamente.)


==================== Três Meses Criados arquivos e pastas ========

(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)

2017-03-11 07:28 - 2017-03-11 07:29 - 00035268 _____ C:\Users\Leandro\Downloads\FRST.txt
2017-03-11 07:28 - 2017-03-11 07:28 - 02424832 _____ (Farbar) C:\Users\Leandro\Downloads\FRST64.exe
2017-03-11 07:28 - 2017-03-11 07:28 - 00000000 ____D C:\FRST
2017-03-10 10:19 - 2017-03-10 10:47 - 00010023 _____ C:\Users\Leandro\Desktop\Apontamentos Paredão.xlsx
2017-03-09 09:54 - 2017-03-09 09:54 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk
2017-03-09 09:54 - 2017-03-09 09:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2017-03-09 07:00 - 2017-03-09 07:00 - 00138072 _____ C:\Users\Leandro\AppData\Local\GDIPFONTCACHEV1.DAT
2017-03-09 06:38 - 2017-03-09 06:38 - 00519984 _____ C:\Windows\system32\FNTCACHE.DAT
2017-03-08 09:56 - 2017-03-08 09:56 - 01631200 _____ (Skype Technologies S.A.) C:\Users\Leandro\Downloads\Baixaki_skype [1].exe
2017-03-08 07:20 - 2017-03-08 07:21 - 01806392 _____ ( ) C:\Users\Leandro\Downloads\Baixaki_skype.exe
2017-03-07 17:11 - 2017-03-07 17:11 - 00212712 _____ C:\Users\Leandro\Desktop\A_265198_P_60250.pdf
2017-03-03 15:14 - 2017-03-03 15:14 - 00001724 _____ C:\Users\Public\Desktop\IRPF2017 - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País.lnk
2017-03-03 15:14 - 2017-03-03 15:14 - 00000000 ____D C:\Users\Leandro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Programas RFB2017
2017-03-03 15:14 - 2017-03-03 15:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Programas RFB2017
2017-03-03 15:10 - 2017-03-03 15:13 - 28203488 _____ (Receita Federal do Brasil) C:\Users\Leandro\Downloads\IRPF2017Win32v1.0.exe
2017-03-03 13:32 - 2017-03-03 13:32 - 00013563 _____ C:\Users\Leandro\Desktop\AVALIAÇÃO DE DEPARTAMENTOS POR PROCESSO.xlsx
2017-03-01 11:29 - 2017-03-01 11:29 - 00004726 _____ C:\Users\Leandro\Downloads\42170302955426000205550010000005231000118854.xml
2017-02-27 15:23 - 2017-02-27 15:23 - 00014258 _____ C:\Users\Leandro\Desktop\refeições.xlsx
2017-02-24 13:21 - 2017-02-24 13:21 - 00054266 _____ C:\Users\Leandro\Desktop\INPDFViewer.pdf
2017-02-21 11:13 - 2017-02-21 11:13 - 00137178 _____ C:\Users\Leandro\Downloads\Boletos.pdf
2017-02-20 09:50 - 2017-03-10 17:13 - 00536300 _____ C:\Users\Leandro\Desktop\CAIXA E BANCO 2017(1).xlsx
2017-02-18 10:00 - 2017-02-18 10:00 - 00028499 _____ C:\Users\Leandro\Desktop\Organograma Adm Pva.xlsx
2017-02-14 09:30 - 2017-02-14 09:30 - 00002722 _____ C:\Users\Leandro\Desktop\Acesso Web.lnk
2017-02-11 12:07 - 2017-02-11 12:07 - 05991424 _____ (Senior Sistemas SA.) C:\Users\Leandro\Desktop\WA.exe
2017-02-10 09:21 - 2017-02-10 09:21 - 00351023 _____ C:\Users\Leandro\Downloads\5b4f27bc313c01845e118738f71529be486ab8a94506ff7f5dca4029beeea03b8b7a184a320754698fa2349cae7f479aebcb8b79ab60f7af1d17d3f64bb153e9.pdf
2017-02-09 11:49 - 2017-02-09 11:49 - 00003108 _____ C:\Windows\System32\Tasks\{1CD4C13D-293E-427E-8D5D-86F1809A9D1F}
2017-02-09 09:36 - 2017-03-09 13:32 - 00091642 _____ C:\Users\Leandro\Desktop\Extrato B.B.PVA.CAS.pdf
2017-02-09 09:36 - 2017-02-09 09:36 - 00024617 _____ C:\Users\Leandro\Downloads\00909022017.pdf
2017-02-06 15:19 - 2017-02-06 15:19 - 00027953 _____ C:\Users\Leandro\Downloads\Fat494417 (2).pdf
2017-02-04 07:14 - 2017-02-04 07:14 - 00145067 _____ C:\Users\Leandro\Downloads\certificado_final-0004148268.pdf
2017-02-04 06:51 - 2017-02-04 06:51 - 02449513 _____ C:\Users\Leandro\Desktop\PRF_BAT_17011350B01.pdf
2017-02-04 06:46 - 2017-02-04 06:47 - 02449513 _____ C:\Users\Leandro\Downloads\PRF_BAT_17011350B01.pdf
2017-02-03 10:08 - 2017-02-03 10:08 - 00033533 _____ C:\Users\Leandro\Downloads\Fat498262.pdf
2017-02-01 16:11 - 2017-03-10 06:58 - 00000000 ____D C:\Users\Leandro\RDP6
2017-02-01 16:07 - 2017-02-01 16:07 - 00000000 ____D C:\Users\Leandro\RemoteApp
2017-01-30 12:43 - 2017-01-30 12:43 - 00043144 _____ C:\Users\Leandro\Desktop\Cópia de TERCEIROS.xlsx
2017-01-25 09:46 - 2017-02-14 09:30 - 00000000 ____D C:\Users\Leandro\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aplicativos do Google Chrome
2017-01-23 06:41 - 2017-01-23 06:41 - 00022537 _____ C:\Users\Leandro\Downloads\CTe611006 (1).pdf
2017-01-17 09:12 - 2017-01-17 09:12 - 00027953 _____ C:\Users\Leandro\Downloads\Fat494417 (1).pdf
2017-01-17 09:11 - 2017-01-17 09:11 - 00035835 _____ C:\Users\Leandro\Downloads\DACTE494417 (1).pdf
2017-01-17 09:10 - 2017-01-17 09:10 - 00035835 _____ C:\Users\Leandro\Downloads\DACTE494417.pdf
2017-01-16 09:22 - 2017-01-16 09:22 - 00027953 _____ C:\Users\Leandro\Downloads\Fat494417.pdf
2017-01-16 07:25 - 2017-01-16 07:25 - 00049445 _____ C:\Users\Leandro\Downloads\CTe611006.pdf
2017-01-16 07:15 - 2017-01-16 07:15 - 00000000 ____D C:\Users\Leandro\AppData\Local\YSearchUtil
2017-01-16 06:43 - 2017-01-16 06:43 - 00022395 _____ C:\Users\Leandro\Downloads\DACTE487683.pdf
2017-01-16 06:43 - 2017-01-16 06:43 - 00022395 _____ C:\Users\Leandro\Downloads\DACTE487683 (1).pdf
2017-01-16 06:43 - 2017-01-16 06:43 - 00001948 _____ C:\Users\Leandro\Downloads\EXCEL487683.csv
2017-01-16 06:37 - 2017-01-16 06:37 - 00002657 _____ C:\Users\Leandro\Downloads\visualizador.jnlp
2017-01-10 21:06 - 2017-01-10 21:06 - 00698476 _____ C:\Users\Leandro\Downloads\relatorioProcessado.pdf
2017-01-05 20:17 - 2017-01-05 20:17 - 00211882 _____ C:\Users\Leandro\Downloads\SK9NJD_LUIS MIGUEL_SILVA_FOR.pdf
2017-01-05 20:14 - 2017-01-05 20:14 - 00211800 _____ C:\Users\Leandro\Downloads\SK9NJD_ANA PAULA_OLIVEIRA_FOR.pdf
2017-01-05 20:07 - 2017-01-05 20:07 - 00211764 _____ C:\Users\Leandro\Downloads\SK9NJD_LEANDRO_SILVA_FOR.pdf
2017-01-02 09:57 - 2017-01-27 06:34 - 00003180 _____ C:\Windows\System32\Tasks\OneDrive Standalone Update Task v2
2016-12-29 13:06 - 2016-11-11 13:41 - 00025184 ____N (GAS Tecnologia) C:\Windows\system32\Drivers\wsddpp.sys
2016-12-29 11:25 - 2017-03-11 07:08 - 00101080 _____ (GAS Tecnologia) C:\Windows\system32\Drivers\wsddfac.sys
2016-12-29 11:23 - 2016-11-11 13:41 - 00025184 ____N (GAS Tecnologia) C:\Windows\system32\Drivers\wsddprm.sys
2016-12-28 21:35 - 2016-12-28 21:35 - 00015626 _____ C:\Users\Leandro\Downloads\voucher_3147262-PASSAGENS (1).pdf
2016-12-28 21:28 - 2016-12-28 21:44 - 00223126 _____ C:\Users\Leandro\Downloads\SK9NJD_LUIS MIGUEL_SILVA_MGF.pdf
2016-12-28 21:27 - 2016-12-28 21:28 - 00223201 _____ C:\Users\Leandro\Downloads\SK9NJD_ANA PAULA_OLIVEIRA_MGF.pdf
2016-12-28 21:26 - 2016-12-28 21:30 - 00223204 _____ C:\Users\Leandro\Downloads\SK9NJD_LEANDRO_SILVA_MGF.pdf
2016-12-28 20:57 - 2016-12-28 20:57 - 00040418 _____ C:\Users\Leandro\Downloads\voucher_3147263 HOTEL.pdf
2016-12-28 20:57 - 2016-12-28 20:57 - 00015626 _____ C:\Users\Leandro\Downloads\voucher_3147262-PASSAGENS.pdf
2016-12-19 18:17 - 2016-12-19 18:17 - 00064651 _____ C:\Users\Leandro\Downloads\NF ULS 221.pdf

==================== Três Meses Modificados arquivos e pastas ========

(Se uma entrada for incluída na fixlist, o arquivo/pasta será movido.)

2017-03-11 07:15 - 2012-08-28 21:32 - 00004180 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2017-03-11 07:15 - 2009-07-14 00:45 - 00029648 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-03-11 07:15 - 2009-07-14 00:45 - 00029648 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-03-11 07:12 - 2009-07-14 13:55 - 09724252 _____ C:\Windows\system32\prfh0416.dat
2017-03-11 07:12 - 2009-07-14 13:55 - 08789388 _____ C:\Windows\system32\prfc0416.dat
2017-03-11 07:12 - 2009-07-14 01:13 - 00006254 _____ C:\Windows\system32\PerfStringBackup.INI
2017-03-11 07:08 - 2014-01-27 05:24 - 00000204 _____ C:\Windows\Tasks\AutoKMS.job
2017-03-11 07:08 - 2012-10-09 10:23 - 00000000 ____D C:\Users\Todos os Usuários\GbPlugin
2017-03-11 07:08 - 2012-10-09 10:23 - 00000000 ____D C:\ProgramData\GbPlugin
2017-03-11 07:07 - 2015-11-16 09:11 - 00000914 _____ C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job
2017-03-11 07:07 - 2012-12-31 18:07 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2017-03-11 07:07 - 2012-10-09 10:23 - 00000000 ____D C:\Program Files (x86)\GbPlugin
2017-03-11 07:06 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-03-10 17:48 - 2012-08-29 16:12 - 00000902 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2017-03-10 17:27 - 2012-08-30 15:46 - 00000000 ____D C:\Users\Leandro\Documents\Arquivos do Outlook
2017-03-10 16:16 - 2015-11-16 09:11 - 00000918 _____ C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job
2017-03-10 15:36 - 2014-12-16 12:41 - 00000000 ____D C:\Programações Mega
2017-03-10 11:50 - 2015-06-20 11:41 - 00000000 ___RD C:\Users\Leandro\OneDrive
2017-03-10 10:05 - 2013-07-11 12:50 - 00003958 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{DDADC446-3F1E-4159-82D0-8E47223D015A}
2017-03-10 09:28 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\inf
2017-03-10 06:55 - 2013-03-29 07:42 - 00000000 ____D C:\Users\Leandro\Desktop\Diversos
2017-03-10 06:55 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\tracing
2017-03-09 13:32 - 2016-06-02 14:25 - 00081501 _____ C:\Users\Leandro\Desktop\Extrato B.B.PVA.TV.pdf
2017-03-09 13:32 - 2013-03-30 14:24 - 03008000 ___SH C:\Users\Leandro\Downloads\Thumbs.db
2017-03-09 13:24 - 2014-05-29 14:06 - 00000000 ____D C:\Users\Leandro\Desktop\OBRA
2017-03-09 09:54 - 2014-09-16 08:57 - 00000000 ___RD C:\Program Files (x86)\Skype
2017-03-09 09:54 - 2012-08-30 16:21 - 00000000 ____D C:\Users\Todos os Usuários\Skype
2017-03-09 09:54 - 2012-08-30 16:21 - 00000000 ____D C:\ProgramData\Skype
2017-03-09 06:54 - 2013-03-27 10:59 - 00000000 ____D C:\Users\Leandro\.receitanet
2017-03-09 06:32 - 2014-04-09 06:33 - 00000000 ____D C:\Windows\pss
2017-03-07 15:05 - 2013-12-08 13:02 - 00000000 ____D C:\Users\Todos os Usuários\Package Cache
2017-03-07 15:05 - 2013-12-08 13:02 - 00000000 ____D C:\ProgramData\Package Cache
2017-03-07 15:05 - 2012-08-30 16:22 - 00000000 ____D C:\Users\Leandro\AppData\Roaming\Skype
2017-03-06 10:28 - 2016-09-16 09:56 - 00015342 _____ C:\Users\Leandro\Desktop\Passagens Aéreas.xlsx
2017-03-06 10:07 - 2016-08-26 13:28 - 00000000 ____D C:\Users\Leandro\Desktop\Passagens
2017-03-06 09:33 - 2016-07-05 07:26 - 00000000 ____D C:\Users\Leandro\Desktop\documentos
2017-03-03 15:14 - 2013-03-27 09:10 - 00000000 ___HD C:\Program Files (x86)\InstallJammer Registry
2017-03-03 15:14 - 2013-03-27 09:10 - 00000000 ____D C:\Arquivos de Programas RFB
2017-03-03 11:46 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\system32\NDF
2017-03-03 07:16 - 2016-03-22 17:42 - 00000000 ____D C:\Users\Leandro\Desktop\Contratos
2017-03-02 07:16 - 2016-04-20 15:03 - 00131274 _____ C:\Users\Leandro\Desktop\Bens. 13.04.xlsm
2017-02-28 09:41 - 2016-07-23 14:29 - 00043029 _____ C:\Users\Leandro\Desktop\OBRAS TV E CASTELLAR.xlsx
2017-02-25 11:18 - 2013-09-02 12:10 - 00000000 ____D C:\Users\Leandro\AppData\LocalLow\Scpad
2017-02-24 13:22 - 2013-01-21 14:12 - 00000441 _____ C:\Windows\BRWMARK.INI
2017-02-24 09:02 - 2014-10-16 09:33 - 00000000 ____D C:\Users\Leandro\Desktop\Campo Verde-MT
2017-02-23 15:13 - 2016-08-23 13:25 - 02807650 _____ C:\Users\Leandro\Desktop\GERENCIAMENTO DE RH - BR 070 (PVA)(7).xlsm
2017-02-15 09:51 - 2012-08-29 16:12 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-02-15 09:51 - 2012-08-29 16:12 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-02-15 09:51 - 2012-08-29 16:12 - 00003840 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-02-15 09:51 - 2012-08-29 16:12 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2017-02-15 09:51 - 2012-08-29 16:12 - 00000000 ____D C:\Windows\system32\Macromed

==================== Arquivos na raiz de alguns diretórios =======

2012-08-28 21:30 - 2013-02-01 21:31 - 0000125 _____ () C:\Users\Leandro\AppData\Roaming\default.pls
2013-04-14 21:19 - 2013-04-14 21:16 - 0030894 _____ () C:\Users\Leandro\AppData\Roaming\speedanalysis.ico
2015-03-13 14:33 - 2015-03-13 14:37 - 0032562 _____ () C:\Users\Leandro\AppData\Roaming\unins000.dat
2015-03-13 14:37 - 2015-03-13 14:37 - 0730322 _____ () C:\Users\Leandro\AppData\Roaming\unins000.exe
2015-03-10 10:44 - 2015-03-10 10:43 - 0815826 _____ () C:\Users\Leandro\AppData\Roaming\unins001.exe
2016-06-01 11:49 - 2016-07-09 11:22 - 0022145 _____ () C:\Users\Leandro\AppData\Roaming\Valores Separados por Vírgula.ADR
2014-02-16 21:04 - 2014-02-16 21:05 - 0004608 _____ () C:\Users\Leandro\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-11-18 09:05 - 2014-04-14 10:54 - 0007598 _____ () C:\Users\Leandro\AppData\Local\Resmon.ResmonCfg
2014-09-29 14:28 - 2014-09-29 14:28 - 0000152 _____ () C:\ProgramData\bc.ini

Arquivos para serem movidos ou deletados:
====================
C:\Users\Leandro\pdfprint.dat


==================== Bamital & volsnap ======================

(Não há correção automática para arquivos que não passaram na verificação.)

C:\Windows\system32\winlogon.exe => O arquivo é assinado digitalmente
C:\Windows\system32\wininit.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\wininit.exe => O arquivo é assinado digitalmente
C:\Windows\explorer.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\explorer.exe => O arquivo é assinado digitalmente
C:\Windows\system32\svchost.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\svchost.exe => O arquivo é assinado digitalmente
C:\Windows\system32\services.exe => O arquivo é assinado digitalmente
C:\Windows\system32\User32.dll => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\User32.dll => O arquivo é assinado digitalmente
C:\Windows\system32\userinit.exe => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\userinit.exe => O arquivo é assinado digitalmente
C:\Windows\system32\rpcss.dll => O arquivo é assinado digitalmente
C:\Windows\system32\dnsapi.dll => O arquivo é assinado digitalmente
C:\Windows\SysWOW64\dnsapi.dll => O arquivo é assinado digitalmente
C:\Windows\system32\Drivers\volsnap.sys => O arquivo é assinado digitalmente

LastRegBack: 2017-03-06 08:54

==================== Fim de FRST.txt ============================