Instalar ZOEK.exe

Malwarebytes Anti-Malware

www.malwarebytes.org

Data da Verificação: 14/03/2015

Hora da Verificação: 12:15:20

Arquivo de Log: Log.txt

Administrador: Não

Versão: 2.00.4.1028

Base de Dados de Malware: v2015.03.14.03

Base de Dados de Rootkit: v2015.02.25.01

Licença: Grátis

Proteção de Malware: Desabilitado

Proteção de Site Malicioso: Desabilitado

Auto-Proteção: Desabilitado

SO: Windows 7 Service Pack 1

Processador: x64

Sistema de Arquivos: NTFS

Usuário: CARLOS

Tipo da Verificação: Verificação Personalizada

Resultado: Terminado

Objetos Verificados: 503920

Tempo Decorrido: 2 hr, 20 min, 18 seg

Memória: Habilitado

Inicialização: Habilitado

Sistema de Arquivos: Habilitado

Arquivos Compactados: Habilitado

Rootkits: Habilitado

Heurística: Habilitado

PUP: Habilitado

PUM: Habilitado

Processos: 0

(Nenhum item malicioso detectado)

Módulos: 0

(Nenhum item malicioso detectado)

Chaves de Registro: 0

(Nenhum item malicioso detectado)

Valores de Registro: 0

(Nenhum item malicioso detectado)

Dados de Registro: 0

(Nenhum item malicioso detectado)

Pastas: 0

(Nenhum item malicioso detectado)

Arquivos: 12

PUP.Optional.BrowserWatch, C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowerWatchCH.dll.vir, Apagar ao Reiniciar, [25465aeb77131c1a2bd5b8b660a0f50b],

PUP.Optional.BrowserWatch, C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\BrowerWatchFF.dll.vir, Apagar ao Reiniciar, [b9b24401c7c375c1f40ce08e7789e61a],

PUP.Optional.ELEX, C:\AdwCleaner\Quarantine\C\Program Files (x86)\XTab\HPNotify.exe.vir, Apagar ao Reiniciar, [016a0a3be9a1a591b6ebdd52818154ac],

Trojan.Downloader, C:\Users\CARLOS\AppData\Local\Temp\nscB7FD.tmp, Quarentena, [f378fe473258c472477bc554ba49ae52],

PUP.Optional.Bundle, C:\Users\CARLOS\AppData\Local\Temp\nscB7FE.tmp, Quarentena, [aebd35109dedb38361da6d6e7b8ad927],

PUP.Optional.Bundle, C:\Users\CARLOS\AppData\Local\Temp\nse5046.tmp, Quarentena, [b5b651f427634cea6fcc5289e61ffd03],

Trojan.Downloader, C:\Users\CARLOS\AppData\Local\Temp\nso5035.tmp, Quarentena, [79f2ab9aa1e9d75f388a3edb50b32fd1],

Trojan.Downloader, C:\Users\CARLOS\AppData\Local\Temp\nsx3008.tmp, Quarentena, [4625de67bad0b284a31ffe1bdd26b64a],

PUP.Optional.Bundle, C:\Users\CARLOS\AppData\Local\Temp\nsx3009.tmp, Quarentena, [bbb0d76e6327ac8a132803d8c0450bf5],

Trojan.Downloader, C:\Users\CARLOS\AppData\Local\Temp\nszE302.tmp, Quarentena, [2447410461293501fcc62aef25dedc24],

PUP.Optional.Bundle, C:\Users\CARLOS\AppData\Local\Temp\nszE303.tmp, Quarentena, [d8935de8fc8e270f2d0e8952917449b7],

PUP.Optional.Shopperz.A, C:\Users\CARLOS\AppData\Local\Temp\n4461\Shopperz_2001-31705ed9.exe, Quarentena, [c5a620253f4b63d37ceaf82a4eb809f7],

Setores Físicos: 0

(Nenhum item malicioso detectado)

(end)

Baixe o **Farbar Recovery Scan Tool** e salve-o no Desktop (Área de Trabalho)

Obs: Ao acessar o link acima, clique no botão Download Now 64-Bit Version

Execute o Farbar seguindo as dicas deste tutorial:

**Analise importantes áreas do Windows com Farbar Recovery Scan Tool (versão 64 bits)**

*Serão criados dois relatórios no Desktop: FRST.txt e Addition.txt

Poste estes dois relatórios em sua próxima resposta. (Obs: se não couber em uma só resposta, pode dividi-la em mais postagens).

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015

Ran by CARLOS at 2015-03-15 12:48:30

Running from C:\Users\CARLOS\Desktop

Boot Mode: Normal

==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden

Adobe Flash Player 16 ActiveX (HKLM-x32...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) - Português (HKLM-x32...{AC76BA86-7AD7-1046-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Apple Mobile Device Support (HKLM...{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)

Apple Software Update (HKLM-x32...{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Atualização do produto Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32...{90120000-0016-0416-0000-0000000FF1CE}_ENTERPRISE_{717C9095-8AAE-41CB-B046-BD6E8399F4F3}) (Version:  - Microsoft)

Atualização do produto Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32...{90120000-001A-0416-0000-0000000FF1CE}_ENTERPRISE_{5016CB22-B9A7-44FB-AA72-AF28B27B15EA}) (Version:  - Microsoft)

Atualização do produto Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32...{90120000-0018-0416-0000-0000000FF1CE}_ENTERPRISE_{BE3A7C0C-0081-4694-B5F9-980DD66BDDF8}) (Version:  - Microsoft)

Atualização do produto Microsoft Office Word 2007 Help (KB963665) (HKLM-x32...{90120000-001B-0416-0000-0000000FF1CE}_ENTERPRISE_{7297E3A9-FCD4-4E0E-A306-7A90359E50E3}) (Version:  - Microsoft)

AVG 2015 (HKLM...\AVG) (Version: 2015.0.5751 - AVG Technologies)

AVG 2015 (Version: 15.0.4306 - AVG Technologies) Hidden

AVG 2015 (Version: 15.0.5751 - AVG Technologies) Hidden

Bonjour (HKLM...{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

BufferChm (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden

CCleaner (HKLM...\CCleaner) (Version: 4.07 - Piriform)

D110 (x32 Version: 140.0.283.000 - Hewlett-Packard) Hidden

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Galeria de Fotos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Ganhos de Capital 2013 (HKLM-x32...\Ganhos de Capital 2013) (Version:  - )

GBBD Defensor Safra (HKLM-x32...{DCB9EC14-9690-4226-90FA-3B7F22B86748}_is1) (Version: 3.11.0.1 - )

Google Chrome (HKLM-x32...\Google Chrome) (Version: 41.0.2272.89 - Google Inc.)

Google Earth (HKLM-x32...{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)

Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden

HP Photosmart D110 All-In-One Driver Software 14.0 Rel. 7 (HKLM...{DBC1DE57-B55A-4D57-9769-1DB9BE506AF7}) (Version: 14.0 - HP)

HPAppStudio (x32 Version: 140.0.95.000 - Hewlett-Packard) Hidden

HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden

HPPhotoGadget (x32 Version: 140.0.524.000 - Hewlett-Packard) Hidden

iCloud (HKLM...{309768A4-A2BB-4930-A5A2-8169678C9B4C}) (Version: 4.0.6.28 - Apple Inc.)

IRPF2012 - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País (HKLM-x32...\IRPF2012) (Version: 1.1 - Receita Federal do Brasil)

IRPF2013 - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País (HKLM-x32...\IRPF2013) (Version: 1.1 - Receita Federal do Brasil)

IRPF2014 - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País (HKLM-x32...\IRPF2014) (Version: 1.0 - Receita Federal do Brasil)

IRPF2015 - Declaração de Ajuste Anual, Final de Espólio e Saída Definitiva do País (HKLM-x32...\IRPF2015) (Version: 1.0 - Receita Federal do Brasil)

iTunes (HKLM...{D227565A-0033-40AD-89BA-653A205CDC11}) (Version: 12.1.1.4 - Apple Inc.)

Java 8 Update 31 (HKLM-x32...{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)

Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

Malwarebytes Anti-Malware versão 2.0.4.1028 (HKLM-x32...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Microsoft .NET Framework 4 Client Profile (HKLM...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4 Extended (HKLM...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM...{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32...{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office Enterprise 2007 (HKLM-x32...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office File Validation Add-In (HKLM-x32...{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Outlook Connector (HKLM-x32...{95140000-007A-0416-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32...{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM...{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM...{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32...{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Módulo de Proteção - Banco Santander (Brasil) S.A. (HKLM-x32...{83033d93-48d0-48fc-9c5b-82e57e7e0dd6}_is1) (Version: 3.12.0.2 - )

Módulo de Segurança -  Banco do Brasil (HKLM-x32...{36386dc9-8543-4b12-ae6b-220fd52f19f3}_is1) (Version: 3.12.0.2 - )

Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

MSXML 4.0 SP2 (KB973688) (HKLM-x32...{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

Network64 (Version: 140.0.215.000 - Hewlett-Packard) Hidden

Network64 (Version: 140.0.221.000 - Hewlett-Packard) Hidden

PS_AIO_07_D110_SW_Min (x32 Version: 140.0.142.000 - Hewlett-Packard) Hidden

QuickTime 7 (HKLM-x32...{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)

QuickTransfer (x32 Version: 140.0.98.000 - Hewlett-Packard) Hidden

RealDownloader (x32 Version: 1.3.3 - RealNetworks, Inc.) Hidden

RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden

RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden

RealPlayer (HKLM-x32...\RealPlayer 16.0) (Version: 16.0.3 - RealNetworks)

RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden

Receitanet (HKLM-x32...\ECC16E3C-16D1-4DC2-9D8A-6AC06B3005A5) (Version: 1.04 - Serpro - Serviço Federal de Processamento de Dados)

Revo Uninstaller 1.95 (HKLM-x32...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

Scan (x32 Version: 140.0.80.000 - Hewlett-Packard) Hidden

Skype™ 6.11 (HKLM-x32...{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)

Suporte para Aplicativos Apple (32-bit) (HKLM-x32...{447CDCE5-F555-429B-BFA6-642C3C6D684F}) (Version: 3.1.2 - Apple Inc.)

Suporte para Aplicativos Apple Apple (64-bit) (HKLM...{0DF7096B-715A-4233-8633-C7A16ED6D616}) (Version: 3.1.2 - Apple Inc.)

Toolbox (x32 Version: 140.0.428.000 - Hewlett-Packard) Hidden

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32...{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

VirtualDJ Home FREE (HKLM-x32...{B515962D-C979-44AC-9912-F7BB499B4B2C}) (Version: 7.3 - Atomix Productions)

Visual Studio 2012 x64 Redistributables (HKLM...{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)

Visual Studio 2012 x86 Redistributables (HKLM-x32...{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

WebReg (x32 Version: 140.0.212.017 - Hewlett-Packard) Hidden

Windows Live Essentials (HKLM-x32...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)

WinZip 19.0 (HKLM...{CD95F661-A5C4-44F5-A6AA-ECDD91C240E7}) (Version: 19.0.11294 - WinZip Computing, S.L. )

ZHPDiag 2015 (HKLM-x32...\ZHPDiag_is1) (Version: 2015 - Nicolas Coolman)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

==================== Restore Points  =========================

ATTENTION: System Restore is disabled.

Check "winmgmt" service or repair WMI.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 23:34 - 2015-02-08 23:11 - 00000822 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job =>

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job =>

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job =>

==================== Loaded Modules (whitelisted) ==============

2015-02-13 04:20 - 2015-02-13 04:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2015-02-13 04:20 - 2015-02-13 04:20 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Windows\System32:1AFBEE33_Abn.gbp

AlternateDataStreams: C:\Windows\System32:1AFBEE33_Bb.gbp

AlternateDataStreams: C:\Windows\System32:1AFBEE33_Sfr.gbp

AlternateDataStreams: C:\ProgramData\TEMP:373E1720

AlternateDataStreams: C:\Users\Todos os Usuários\TEMP:373E1720

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3504019602-3750793420-2798553429-1000\Control Panel\Desktop\Wallpaper -> C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 201.6.2.23 - 201.6.2.143

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== Accounts: =============================

Administrador (S-1-5-21-3504019602-3750793420-2798553429-500 - Administrator - Enabled) => C:\Users\Administrador

CARLOS (S-1-5-21-3504019602-3750793420-2798553429-1000 - Limited - Enabled) => C:\Users\CARLOS

Convidado (S-1-5-21-3504019602-3750793420-2798553429-501 - Limited - Disabled)

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface

Description: Adaptador de Túnel Teredo da Microsoft

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: tunnel

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Photosmart D110 series

Description: Photosmart D110 series

Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}

Manufacturer: HP

Service:

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Photosmart D110 series

Description: Photosmart D110 series

Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}

Manufacturer: HP

Service: StillCam

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

==================== Event log errors: =========================

Could not start eventlog service, could not read events.

Erro de sistema 5.

Acesso negado.

==================== Memory info ===========================

Processor: Pentium(R) Dual-Core CPU T4200 @ 2.00GHz

Percentage of memory in use: 35%

Total physical RAM: 4058.36 MB

Available physical RAM: 2603.46 MB

Total Pagefile: 8114.91 MB

Available Pagefile: 6393 MB

Total Virtual: 8192 MB

Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:148.95 GB) (Free:58.1 GB) NTFS

Drive f: () (Removable) (Total:1.81 GB) (Free:0.11 GB) FAT

==================== MBR & Partition Table ==================

==================== End Of Log ============================

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015

Ran by CARLOS (ATTENTION: The logged in user is not administrator) on CARLOS-PC on 15-03-2015 12:46:34

Running from C:\Users\CARLOS\Desktop

Loaded Profiles: CARLOS & Administrador (Available profiles: CARLOS & Administrador)

Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Português (Brasil)

Internet Explorer Version 11 (Default browser not detected!)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

Failed to access process -> smss.exe

Failed to access process -> csrss.exe

Failed to access process -> csrss.exe

Failed to access process -> wininit.exe

Failed to access process -> winlogon.exe

Failed to access process -> services.exe

Failed to access process -> lsass.exe

Failed to access process -> lsm.exe

Failed to access process -> svchost.exe

(GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe

Failed to access process -> svchost.exe

Failed to access process -> svchost.exe

Failed to access process -> svchost.exe

Failed to access process -> svchost.exe

Failed to access process -> svchost.exe

Failed to access process -> svchost.exe

Failed to access process -> spoolsv.exe

Failed to access process -> svchost.exe

Failed to access process -> armsvc.exe

Failed to access process -> AppleMobileDeviceService.exe

Failed to access process -> avgwdsvc.exe

Failed to access process -> mDNSResponder.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

Failed to access process -> netservice.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe

Failed to access process -> svchost.exe

Failed to access process -> svchost.exe

Failed to access process -> rndlresolversvc.exe

Failed to access process -> svchost.exe

Failed to access process -> svchost.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe

Failed to access process -> WLIDSVC.EXE

Failed to access process -> WLIDSVCM.EXE

Failed to access process -> GoogleCrashHandler.exe

Failed to access process -> GoogleCrashHandler64.exe

Failed to access process -> SearchIndexer.exe

Failed to access process -> iPodService.exe

(GAS Tecnologia) C:\Program Files (x86)\GbPlugin\gbpsv.exe

Failed to access process -> svchost.exe

Failed to access process -> WmiPrvSE.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_16_0_0_305_ActiveX.exe

Failed to access process -> SearchFilterHost.exe

Failed to access process -> SearchProtocolHost.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-02-13] (Apple Inc.)

HKLM-x32...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)

HKLM-x32...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3710416 2015-02-19] (AVG Technologies CZ, s.r.o.)

HKLM Group Policy restriction on software: C:\Program Files\AVAST Software\Avast\avastui.exe <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\AVAST Software\Avast\avastsvc.exe <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\AVAST Software\Avast\ashUpd.exe <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\AVAST Software\Avast\ashQuick.exe <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\AVAST Software\Avast\sched.exe <====== ATTENTION

Winlogon\Notify\ GbPluginAbn-x32: C:\Program Files (x86)\GbPlugin\gbiehAbn.dll (Banco Real)

Winlogon\Notify\ GbPluginBb-x32: C:\Program Files (x86)\GbPlugin\gbieh.dll (Banco do Brasil)

Winlogon\Notify\ GbPluginSfr-x32: C:\Program Files (x86)\GbPlugin\gbiehSfr.dll (Banco Safra)

HKLM...\Policies\Explorer: [HideSCAHealth] 1

HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore: [DisableSR/DisableConfig]  <===== ATTENTION

HKU\S-1-5-21-3504019602-3750793420-2798553429-1000...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-11-21] (Apple Inc.)

HKU\S-1-5-21-3504019602-3750793420-2798553429-1000...\Policies\Explorer: [NoLowDiskSpaceChecks] 1

HKU\S-1-5-21-3504019602-3750793420-2798553429-1000...\Policies\Explorer: [TaskbarNoNotification] 1

HKU\S-1-5-21-3504019602-3750793420-2798553429-1000...\MountPoints2: {d3dd82ce-62bf-11e4-9725-0023aee79dfb} - G:\iStudio.exe

HKU\S-1-5-18...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-11-03] (Microsoft Corporation)

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: [S-1-5-21-3504019602-3750793420-2798553429-1000] => http=127.0.0.1:64578;https=127.0.0.1:64578

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com

HKU.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.oquefazernainternet.com/

HKU.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.oquefazernainternet.com/

HKU\S-1-5-21-3504019602-3750793420-2798553429-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01

HKU\S-1-5-21-3504019602-3750793420-2798553429-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/pt-br/?ocid=iehp

HKU\S-1-5-21-3504019602-3750793420-2798553429-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com.br/

URLSearchHook: [S-1-5-21-3504019602-3750793420-2798553429-500] ATTENTION ==> Default URLSearchHook is missing.

SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL =

SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01

SearchScopes: HKU.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-21-3504019602-3750793420-2798553429-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=key7&utm_campaign=install_ie&utm_content=ds&from=key7&uid=WDCXWD1600BEVS-00VAT0_WD-WXE308E2188021880&ts=1422740558&type=default&q={searchTerms}

SearchScopes: HKU\S-1-5-21-3504019602-3750793420-2798553429-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=key7&utm_campaign=install_ie&utm_content=ds&from=key7&uid=WDCXWD1600BEVS-00VAT0_WD-WXE308E2188021880&ts=1422740558&type=default&q={searchTerms}

SearchScopes: HKU\S-1-5-21-3504019602-3750793420-2798553429-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=key7&utm_campaign=install_ie&utm_content=ds&from=key7&uid=WDCXWD1600BEVS-00VAT0_WD-WXE308E2188021880&ts=1422740558&type=default&q={searchTerms}

SearchScopes: HKU\S-1-5-21-3504019602-3750793420-2798553429-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=key7&utm_campaign=install_ie&utm_content=ds&from=key7&uid=WDCXWD1600BEVS-00VAT0_WD-WXE308E2188021880&ts=1422740558&type=default&q={searchTerms}

SearchScopes: HKU\S-1-5-21-3504019602-3750793420-2798553429-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=key7&utm_campaign=install_ie&utm_content=ds&from=key7&uid=WDCXWD1600BEVS-00VAT0_WD-WXE308E2188021880&ts=1422740558&type=default&q={searchTerms}

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)

BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2013-08-14] (RealDownloader)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-20] (Oracle Corporation)

BHO-x32: Auxiliar de Conexão de Conta da Microsoft -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)

BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540000} -> C:\Program Files (x86)\GbPlugin\gbieh.dll [2015-01-13] (Banco do Brasil)

BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540007} -> C:\Program Files (x86)\GbPlugin\gbiehabn.dll [2014-11-18] (Banco Real)

BHO-x32: GbIehObj Class -> {C41A1C0E-EA6C-11D4-B1B8-444553540023} -> C:\Program Files (x86)\GbPlugin\gbiehsfr.dll [2014-12-10] (Banco Safra)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-20] (Oracle Corporation)

DPF: HKLM-x32 {1663ed61-23eb-11d2-b92f-008048fdd814} https://empregos.bol.uol.com.br/erv2/vagas/activex/smsx.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2013-02-26] (Skype Technologies)

ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\Program Files (x86)\GbPlugin\gbieh.dll [1836928 2015-01-13] (Banco do Brasil)

ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399007} - C:\Program Files (x86)\GbPlugin\gbiehabn.dll [1939512 2014-11-18] (Banco Real)

ShellExecuteHooks-x32: GbPluginObj Class - {E37CB5F0-51F5-4395-A808-5FA49E399023} - C:\Program Files (x86)\GbPlugin\gbiehsfr.dll [1793840 2014-12-10] (Banco Safra)

Tcpip\Parameters: [DhcpNameServer] 201.6.2.23 201.6.2.143

StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe www.jogostempo.com?oem=brsoftv3&uid=WD-WXE308E21880_WDCWD1600BEVS-00VAT0&tm=1422627361

FireFox:

========

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)

FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-20] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-20] (Oracle Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)

FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll [2013-09-16] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2013-08-14] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2013-08-14] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2013-08-14] (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll [2013-09-16] (RealPlayer)

FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2013-08-14] (RealDownloader)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-3504019602-3750793420-2798553429-1000: gastecnologia.com.br/sf/abn -> C:\Users\CARLOS\AppData\Local\GAS Tecnologia\GBBD\npsf_abn.dll [2014-11-25] (GAS Tecnologia)

FF Plugin HKU\S-1-5-21-3504019602-3750793420-2798553429-1000: gastecnologia.com.br/sf/abn64 -> C:\Users\CARLOS\AppData\Local\GAS Tecnologia\GBBD\npsf_abn_64.dll [2014-11-25] (GAS Tecnologia)

FF Plugin HKU\S-1-5-21-3504019602-3750793420-2798553429-1000: gastecnologia.com.br/sf/bb -> C:\Users\CARLOS\AppData\Local\GAS Tecnologia\GBBD\npsf_bb.dll [2015-01-13] (GAS Tecnologia)

FF Plugin HKU\S-1-5-21-3504019602-3750793420-2798553429-1000: gastecnologia.com.br/sf/bb64 -> C:\Users\CARLOS\AppData\Local\GAS Tecnologia\GBBD\npsf_bb_64.dll [2015-01-13] (GAS Tecnologia)

FF Plugin HKU\S-1-5-21-3504019602-3750793420-2798553429-1000: gastecnologia.com.br/sf/sfr -> C:\Users\CARLOS\AppData\Local\GAS Tecnologia\GBBD\npsf_sfr.dll [2014-09-23] (GAS Tecnologia)

FF HKLM-x32...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-09-16]

FF HKLM-x32...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

Chrome:

=======

CHR HomePage: Default -> hxxp://yahoo.com.br/

CHR StartupUrls: Default -> "https://br.yahoo.com/"

CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}

CHR Profile: C:\Users\CARLOS\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Wallet) - C:\Users\CARLOS\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-31]

CHR Extension: (Gmail) - C:\Users\CARLOS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-31]

CHR HKU\S-1-5-21-3504019602-3750793420-2798553429-1000\SOFTWARE\Google\Chrome\Extensions...\Chrome\Extension: [oilkkkefbalmbfppgjmgjoefbclebkce] - https://clients2.google.com/service/update2/crx

CHR HKLM-x32...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14]

Opera:

=======

OPR Extension: (I - Cinema) - C:\Users\CARLOS\AppData\Roaming\Opera Software\Opera Stable\Extensions\dimfohdigjaffdaanhmbocfkpolglnjk [2015-01-31]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)

S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3411408 2015-02-19] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [308720 2015-02-19] (AVG Technologies CZ, s.r.o.)

R2 GbpSv; C:\Program Files (x86)\GbPlugin\gbpsv.exe [555320 2015-01-13] (GAS Tecnologia)

R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]

R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)

R2 lmhosts; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-13] (Microsoft Corporation)

U2 MyLocalService; C:\Windows\SysWOW64\NetService\netservice.exe [226888 2015-01-20] (QNT)

R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]

R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)

R2 NlaSvc; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-13] (Microsoft Corporation)

R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)

R2 nsi; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-13] (Microsoft Corporation)

R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]

R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [270816 2015-02-19] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [203544 2014-11-18] (AVG Technologies CZ, s.r.o.)

R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)

R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [341472 2015-02-03] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [133088 2015-01-23] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)

R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [284128 2015-01-16] (AVG Technologies CZ, s.r.o.)

S0 GbpKm; C:\Windows\SysWOW64\drivers\GbpKm.sys [49536 2013-05-08] (GAS Tecnologia)

S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [93400 2014-11-21] (Malwarebytes Corporation)

S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-03-14] (Malwarebytes Corporation)

R3 Warsaw_PP; C:\Program Files (x86)\GbPlugin\wsftprp64.sys [24792 2014-10-31] (GAS Tecnologia LTDA)

S3 BdApiUtil; ??\C:\Program Files (x86)\Baidu Security\Baidu Antivirus\BdApiUtil64.sys [X]

S3 BdCameraProtect; ??\C:\Program Files (x86)\Baidu Security\Baidu Antivirus\BdCameraProtect64.sys [X]

S3 BprotectEx; ??\C:\Windows\System32\drivers\BprotectEx.sys [X]

S3 cpuz134; ??\C:\Users\CARLOS\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]

S3 PCFApiUtil; ??\C:\Program Files (x86)\PC Faster\PCFApiUtil64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-15 12:46 - 2015-03-15 12:47 - 00020566 _____ () C:\Users\CARLOS\Desktop\FRST.txt

2015-03-15 12:46 - 2015-03-15 12:46 - 00000000 ____D () C:\FRST

2015-03-15 12:45 - 2015-03-15 12:45 - 02095616 _____ (Farbar) C:\Users\CARLOS\Desktop\FRST64.exe

2015-03-14 12:02 - 2015-03-14 12:04 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-03-14 12:02 - 2015-03-14 12:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-03-14 12:02 - 2015-03-14 12:02 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-03-14 12:02 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-03-14 12:02 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-03-14 12:02 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-03-13 19:11 - 2015-03-13 19:11 - 06052446 _____ () C:\Users\CARLOS\Desktop\Anexos_2015313.zip

2015-03-13 12:34 - 2015-03-13 12:33 - 00001937 _____ () C:\Users\Administrador\Desktop\ZHPFixReport.txt

2015-03-12 17:06 - 2015-03-12 17:06 - 00087147 _____ () C:\Users\Administrador\Desktop\ZHPDiag.txt

2015-03-12 17:05 - 2015-03-12 17:05 - 00000512 _____ () C:\PhysicalDisk0_MBR.bin

2015-03-12 16:59 - 2015-03-12 16:59 - 00001987 _____ () C:\Users\Administrador\Desktop\ZHPFix.lnk

2015-03-12 16:59 - 2015-03-12 16:59 - 00001860 _____ () C:\Users\Administrador\Desktop\ZHPDiag.lnk

2015-03-12 16:59 - 2015-03-12 16:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ZHP

2015-03-12 16:59 - 2015-03-12 16:59 - 00000000 ____D () C:\Program Files (x86)\ZHPDiag

2015-03-11 12:53 - 2015-03-11 12:53 - 00001941 _____ () C:\Users\CARLOS\Desktop\Orlando 2015 - Cláudia - Atalho.lnk

2015-03-11 12:41 - 2015-03-11 12:41 - 00001058 _____ () C:\Windows\WindowsUpdate.log

2015-03-02 14:20 - 2015-03-02 14:20 - 00000000 ____D () C:\Users\Administrador\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Programas RFB2015

2015-03-01 21:31 - 2015-03-14 12:14 - 00000000 ____D () C:\Users\CARLOS\Desktop\Cleaner´s

2015-02-27 21:16 - 2015-02-27 21:16 - 00000000 ____D () C:\Users\CARLOS\AppData\Local\WinZip

2015-02-27 21:16 - 2015-02-27 21:16 - 00000000 ____D () C:\Users\Administrador\AppData\Local\WinZip

2015-02-27 21:15 - 2015-02-27 21:16 - 00000000 ____D () C:\Users\Todos os Usuários\WinZip

2015-02-27 21:15 - 2015-02-27 21:16 - 00000000 ____D () C:\ProgramData\WinZip

2015-02-27 21:15 - 2015-02-27 21:15 - 00002211 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\WinZip.lnk

2015-02-27 21:15 - 2015-02-27 21:15 - 00001651 _____ () C:\WinZip Quick Pick.lnk

2015-02-27 21:15 - 2015-02-27 21:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip

2015-02-27 21:15 - 2015-02-27 21:15 - 00000000 ____D () C:\Program Files\WinZip

2015-02-27 21:13 - 2015-02-27 21:13 - 120105328 _____ () C:\Users\Administrador\Downloads\winzip-19-0-build-11294-32-bits [1].exe

2015-02-27 21:08 - 2015-02-27 21:08 - 00000000 ____D () C:\Users\CARLOS\Documents\Add-in Express

2015-02-27 18:43 - 2015-03-14 15:05 - 00051758 _____ () C:\Windows\PFRO.log

2015-02-27 17:54 - 2015-02-27 17:54 - 00000000 ____D () C:\Users\Todos os Usuários\Malwarebytes

2015-02-27 17:54 - 2015-02-27 17:54 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-02-27 16:32 - 2015-02-27 16:32 - 00000000 _____ () C:\essai.txt

2015-02-27 15:59 - 2015-03-13 12:34 - 00000000 ____D () C:\Users\Administrador\AppData\Roaming\ZHP

2015-02-27 14:11 - 2015-02-27 14:17 - 00000000 ____D () C:\AdwCleaner

2015-02-25 21:37 - 2015-02-25 22:08 - 00213547 _____ () C:\Users\CARLOS\Documents\1.pptx

2015-02-22 11:12 - 2015-02-22 11:12 - 00000000 ____D () C:\Users\Administrador\AppData\Local\Apple Computer

2015-02-22 11:12 - 2015-02-22 11:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2015-02-22 11:10 - 2015-02-22 11:12 - 00000000 ____D () C:\Users\Todos os Usuários\E1864A66-75E3-486a-BD95-D1B7D99A84A7

2015-02-22 11:10 - 2015-02-22 11:12 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7

2015-02-22 11:10 - 2015-02-22 11:12 - 00000000 ____D () C:\Program Files\iTunes

2015-02-22 11:10 - 2015-02-22 11:10 - 00000000 ____D () C:\Program Files\iPod

2015-02-22 11:10 - 2015-02-22 11:10 - 00000000 ____D () C:\Program Files (x86)\iTunes

2015-02-22 10:49 - 2015-03-15 12:36 - 00002712 _____ () C:\Windows\setupact.log

2015-02-22 10:49 - 2015-02-22 10:49 - 00000000 _____ () C:\Windows\setuperr.log

2015-02-22 01:42 - 2015-02-22 01:42 - 00000000 ____D () C:\Users\Administrador\AppData\Roaming\Macromedia

2015-02-21 22:29 - 2015-02-21 23:10 - 00000000 ___HD () C:\Users\CARLOS\Documents.4sh

2015-02-21 22:23 - 2015-02-21 22:25 - 11375064 _____ (New IT Solutions) C:\Users\CARLOS\Downloads\4shared-desktop-4-0-11-32-bits [1].exe

2015-02-21 17:47 - 2015-02-21 17:47 - 00000000 __SHD () C:\Users\Administrador\AppData\Local\EmieUserList

2015-02-21 17:47 - 2015-02-21 17:47 - 00000000 __SHD () C:\Users\Administrador\AppData\Local\EmieSiteList

2015-02-21 17:47 - 2015-02-21 17:47 - 00000000 __SHD () C:\Users\Administrador\AppData\Local\EmieBrowserModeList

2015-02-21 17:47 - 2015-02-21 17:47 - 00000000 ____D () C:\Users\Administrador\AppData\Roaming\RealNetworks

2015-02-21 17:46 - 2015-02-22 11:12 - 00000000 ____D () C:\Users\Administrador\AppData\Roaming\Apple Computer

2015-02-21 17:46 - 2015-02-21 17:46 - 00115528 _____ () C:\Users\Administrador\AppData\Local\GDIPFONTCACHEV1.DAT

2015-02-21 17:46 - 2015-02-21 17:46 - 00001389 _____ () C:\Users\Administrador\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-02-21 17:46 - 2015-02-21 17:46 - 00000000 ____D () C:\Users\Administrador\AppData\Roaming\AVG2015

2015-02-21 17:46 - 2015-02-21 17:46 - 00000000 ____D () C:\Users\Administrador\AppData\Roaming\Adobe

2015-02-21 17:46 - 2015-02-21 17:46 - 00000000 ____D () C:\Users\Administrador\AppData\Local\Google

2015-02-21 17:46 - 2015-02-21 17:46 - 00000000 ____D () C:\Users\Administrador\AppData\Local\Avg2015

2015-02-21 17:44 - 2015-02-21 17:46 - 00000000 ____D () C:\Users\Administrador

2015-02-21 17:44 - 2015-02-21 17:44 - 00000020 ___SH () C:\Users\Administrador\ntuser.ini

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Modelos

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Meus documentos

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Menu Iniciar

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Documents\Minhas músicas

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Documents\Minhas imagens

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Documents\Meus vídeos

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Dados de aplicativos

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Configurações locais

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\AppData\Roaming\Microsoft\Windows\Start Menu\Programas

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\AppData\Local\Histórico

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\AppData\Local\Dados de aplicativos

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Ambiente de rede

2015-02-21 17:44 - 2015-02-21 17:44 - 00000000 _SHDL () C:\Users\Administrador\Ambiente de impressão

2015-02-21 17:44 - 2013-05-15 18:38 - 00000000 ____D () C:\Users\Administrador\AppData\Roaming\TuneUp Software

2015-02-21 17:44 - 2013-04-23 10:12 - 00000000 ____D () C:\Users\Administrador\AppData\Local\Microsoft Help

2015-02-21 17:44 - 2009-07-14 01:54 - 00000000 ___RD () C:\Users\Administrador\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-02-21 17:44 - 2009-07-14 01:49 - 00000000 ___RD () C:\Users\Administrador\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance

2015-02-20 14:35 - 2015-02-20 14:35 - 00776274 _____ () C:\Users\CARLOS\Documents\europa 1.wlmp

2015-02-19 21:26 - 2015-02-19 21:26 - 00270816 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system